Edit tour

Windows Analysis Report
https://emsonline.tritech.com

Overview

General Information

Sample URL:	https://emsonline.tritech.com
Analysis ID:	601594
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Passes username and password via HTTP get

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6200 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://emsonline.tritech.com MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,7003227980610139258,3128681342980020932,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	HTTPS traffic detected: 15.205.24.192:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.205.24.192:443 -> 192.168.2.6:49818 version: TLS 1.2

Networking

Passes username and password via HTTP get

Source: global traffic

HTTP get: POST /p/u/getAuthenticationRequirements.do HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveContent-Length: 0Accept: application/xml, text/xml, */*; q=0.01X-Citrix-IsUsingHTTPS: YesX-Citrix-AM-CredentialTypes: none, username, domain, password, newpassword, passcode, savecredentials, textcredential, webview, nsg-epa, nsg-x1, nsg-setclient, nsg-eula, nsg-tlogin, nsg-fullvpn, nsg-hidden, nsg-auth-failure, nsg-auth-success, nsg-epa-success, nsg-l20n, GoBack, nf-recaptcha, ns-dialogue, nf-gw-test, nf-poll, nsg_qrcode, nsg_manageotp, negotiate, nsg_push, nsg_push_otp, nf_sspr_remX-Requested-With: XMLHttpRequestX-Citrix-AM-LabelTypes: none, plain, heading, information, warning, error, confirmation, image, nsg-epa, nsg-epa-failure, nsg-login-label, tlogin-failure-msg, nsg-tlogin-heading, nsg-tlogin-single-res, nsg-tlogin-multi-res, nsg-tlogin, nsg-login-heading, nsg-fullvpn, nsg-l20n, nsg-l20n-error, certauth-failure-msg, dialogue-label, nsg-change-pass-assistive-text, nsg_confirmation, nsg_kba_registration_heading, nsg_email_registration_heading, nsg_kba_validation_question, nsg_sspr_success, nf-manage-otpUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Origin: https://emsonline.tritech.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/index.html HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/jquery.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/jquery-ui.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/jquery.ui.touch-punch.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/jquery-migrate.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/init.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/hammer.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/jquery.dotdotdot.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/velocity.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/slick.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/css/ctxs.large-ui.min.css HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/themes/Default/css/theme.css HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/custom/style.css HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/external/elliptic.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/ctxs.core.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/js/ctxs.webui.min.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/common/wspinner@2x.gif HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vpn/media/citrixgateway_logo_white.png HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/custom/script.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/custom/strings.en.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/actionSprite.png HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/folder_template.png HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/viewSprite.png HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/plugins/ns-gateway/nsg-epa.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/custom/strings.en.json HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveAccept: application/json, text/javascript, /; q=0.01X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36X-Citrix-IsUsingHTTPS: YesSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/plugins/ns-gateway/nsg-setclient.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/plugins/ns-gateway/ns-nfactor.js HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nf/auth/getECdetails HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveAccept: /X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36X-Citrix-IsUsingHTTPS: YesSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/common/icon_vpn.ico HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/common/ReceiverFullScreenBackground.jpg HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/common/wspinner@2x.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/folder_template.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/common/authspinner.gif HTTP/1.1Host: emsonline.tritech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /vpn/media/citrixgateway_logo_black.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /vpn/media/citrixgateway_logo_white.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/search_close.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/TasksIcon.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/bundle_white_overlay.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/bundle_arrow_button.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/img_favorites_empty.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/spinner.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/common/ReceiverFullScreenBackground.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/ico_close.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com
Source: global traffic	HTTP traffic detected: GET /logon/LogonPoint/receiver/images/1x/CitrixReceiver_WebScreen.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: emsonline.tritech.com

Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr, 5bda346b-693a-415b-82f8-d0aa0a9fcbac.tmp.2.dr	String found in binary or memory: https://dns.google
Source: History Provider Cache.1.dr	String found in binary or memory: https://emsonline.tritech.com/2
Source: History Provider Cache.1.dr	String found in binary or memory: https://emsonline.tritech.com/logon/LogonPoint/index.html2
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: manifest.json.1.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.google.com/
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	HTTPS traffic detected: 15.205.24.192:443 -> 192.168.2.6:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.205.24.192:443 -> 192.168.2.6:49818 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\b0d81eef-34e6-41e6-80c7-6ea91f55978c.tmp

Jump to behavior

Source: classification engine

Classification label: sus20.troj.win@21/72@5/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://emsonline.tritech.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,7003227980610139258,3128681342980020932,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,7003227980610139258,3128681342980020932,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6247997D-1838.pma

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	14 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://emsonline.tritech.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://emsonline.tritech.com/	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery-migrate.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/p/u/getAuthenticationRequirements.do	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/ico_close.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/img_favorites_empty.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/nf/auth/getECdetails	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/common/icon_vpn.ico	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/TasksIcon.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/ctxs.webui.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery.dotdotdot.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/ctxs.core.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/plugins/ns-gateway/nsg-setclient.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/common/wspinner@2x.gif	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/custom/strings.en.json	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/custom/style.css	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/css/ctxs.large-ui.min.css	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/bundle_white_overlay.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/plugins/ns-gateway/nsg-epa.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/actionSprite.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/spinner.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/velocity.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/elliptic.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/viewSprite.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/themes/Default/css/theme.css	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery.min.js	0%	Avira URL Cloud	safe
https://dns.google	0%	URL Reputation	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery-ui.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/folder_template.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/plugins/ns-gateway/ns-nfactor.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/vpn/media/citrixgateway_logo_white.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/cgi/GetAuthMethods	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/common/ReceiverFullScreenBackground.jpg	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/common/authspinner.gif	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery.ui.touch-punch.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/CitrixReceiver_WebScreen.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/hammer.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/search_close.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/vpn/media/citrixgateway_logo_black.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/init.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/Home/Configuration	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/slick.min.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/Resources/List	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/custom/script.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/2	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/bundle_arrow_button.png	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/custom/strings.en.js	0%	Avira URL Cloud	safe
https://emsonline.tritech.com/logon/LogonPoint/index.html2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.203.109	true	false	high
clients.l.google.com	216.58.215.238	true	false	high
emsonline.tritech.com	15.205.24.192	true	true	unknown
googlehosted.l.googleusercontent.com	172.217.168.33	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://emsonline.tritech.com/	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery-migrate.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/p/u/getAuthenticationRequirements.do	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/ico_close.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/img_favorites_empty.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/nf/auth/getECdetails	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/common/icon_vpn.ico	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/TasksIcon.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/ctxs.webui.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery.dotdotdot.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/ctxs.core.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/plugins/ns-gateway/nsg-setclient.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/common/wspinner@2x.gif	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/custom/strings.en.json	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false		high
https://emsonline.tritech.com/logon/LogonPoint/custom/style.css	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/css/ctxs.large-ui.min.css	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/bundle_white_overlay.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/plugins/ns-gateway/nsg-epa.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/actionSprite.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/spinner.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/velocity.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/elliptic.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/viewSprite.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/themes/Default/css/theme.css	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery-ui.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/folder_template.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/plugins/ns-gateway/ns-nfactor.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/vpn/media/citrixgateway_logo_white.png	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://emsonline.tritech.com/cgi/GetAuthMethods	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/common/ReceiverFullScreenBackground.jpg	false	Avira URL Cloud: safe	unknown
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/common/authspinner.gif	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/jquery.ui.touch-punch.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/index.html	true		unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/CitrixReceiver_WebScreen.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/hammer.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/index.html	false		unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/search_close.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/vpn/media/citrixgateway_logo_black.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/init.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/Home/Configuration	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/js/external/slick.min.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/Resources/List	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/custom/script.js	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/receiver/images/1x/bundle_arrow_button.png	false	Avira URL Cloud: safe	unknown
https://emsonline.tritech.com/logon/LogonPoint/custom/strings.en.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sandbox.google.com/payments/v4/js/integrator.js	manifest.json.1.dr	false		high
https://www.google.com	15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	false		high
https://accounts.google.com	15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	false		high
https://apis.google.com	15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	false		high
https://clients2.google.com	15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	false		high
https://dns.google	15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr, 5bda346b-693a-415b-82f8-d0aa0a9fcbac.tmp.2.dr	false	URL Reputation: safe	unknown
https://ogs.google.com	15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	manifest.json.1.dr	false		high
https://clients2.googleusercontent.com	15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp.2.dr	false		high
https://emsonline.tritech.com/2	History Provider Cache.1.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/	manifest.json.1.dr	false		high
https://emsonline.tritech.com/logon/LogonPoint/index.html2	History Provider Cache.1.dr	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx	manifest.json.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
15.205.24.192	emsonline.tritech.com	United States	71	HP-INTERNET-ASUS	true
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	601594
Start date and time:	2022-04-01 15:30:47 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://emsonline.tritech.com
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus20.troj.win@21/72@5/7
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.203.110, 173.194.182.102, 34.104.35.123, 142.250.203.99, 142.250.203.106, 80.67.82.235, 80.67.82.211
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, r1---sn-4g5ednld.gvt1.com, r1.sn-4g5ednld.gvt1.com, redirector.gvt1.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, clientservices.googleapis.com, img-prod-cms-rt-microsoft-com.akamaized.net, a1449.dscg2.akamai.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

C:\Users\user\AppData\Local\Google\Chrome\User Data\0eb8ed4a-e948-4c16-9f7b-87f779fe4cc4.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	402043
Entropy (8bit):	6.047472210451963
Encrypted:	false
SSDEEP:	6144:yHxY2brnisl5Ct8VZbU0d7cBzG0OP1eVxR+v+F7EFpfY4XB3iE7ZPXYGzLxin9:IY2/tCINLd7KGNPUZ+w7wJHyEtAWA
MD5:	704AB1F6E55C7822320C06938DA82115
SHA1:	A247FD5037264FE7D17F7ECF2102EEB19EC48BB7
SHA-256:	7CC88499A16A65A7B2BC26974E834D44321E7ACEA26AD602B0AFB1F9A27C71FA
SHA-512:	3116525EC510DB2B91A4B7E0F3A9CF1DD169DF6BACF94D76D743549045F439A5907A57C0FB134B4A926091AE9860E0B78E202AB49EC726CA8420CF2072CA46C8
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.648859520875681e+12,"network":1.648827122e+12,"ticks":173836368.0,"uncertainty":3719468.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACMBYze0bKMTIhZGR/AW4M5AAAAAAIAAAAAABBmAAAAAQAAIAAAACoSPhbyumSaNjLuAHEna2OUDn+rpXOk+H/ONjHe5ZwbAAAAAA6AAAAAAgAAIAAAADezR1ii2QiPYGPz0Jd0ZQiE5jKOKMttbbwwADHJYDpEMAAAACuIP4EJtfud3aEFZzvijkFSTP1RNwcy8fFg19xXfiV1Q9wriZb5iS+jYbOXKVX44kAAAAByJv8rXU2wt9ZoSemiGl7Rv1MeHwgrJRvbYcUfMpjLAz2bh77nWHOppVpZzR2K2uw89vs6aWrPXuiWeIEQQvEM"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245952488007586"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\8ed1a3df-9034-42e8-838d-a5191f116c81.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	402043
Entropy (8bit):	6.047472210451963
Encrypted:	false
SSDEEP:	6144:yHxY2brnisl5Ct8VZbU0d7cBzG0OP1eVxR+v+F7EFpfY4XB3iE7ZPXYGzLxin9:IY2/tCINLd7KGNPUZ+w7wJHyEtAWA
MD5:	704AB1F6E55C7822320C06938DA82115
SHA1:	A247FD5037264FE7D17F7ECF2102EEB19EC48BB7
SHA-256:	7CC88499A16A65A7B2BC26974E834D44321E7ACEA26AD602B0AFB1F9A27C71FA
SHA-512:	3116525EC510DB2B91A4B7E0F3A9CF1DD169DF6BACF94D76D743549045F439A5907A57C0FB134B4A926091AE9860E0B78E202AB49EC726CA8420CF2072CA46C8
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.648859520875681e+12,"network":1.648827122e+12,"ticks":173836368.0,"uncertainty":3719468.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACMBYze0bKMTIhZGR/AW4M5AAAAAAIAAAAAABBmAAAAAQAAIAAAACoSPhbyumSaNjLuAHEna2OUDn+rpXOk+H/ONjHe5ZwbAAAAAA6AAAAAAgAAIAAAADezR1ii2QiPYGPz0Jd0ZQiE5jKOKMttbbwwADHJYDpEMAAAACuIP4EJtfud3aEFZzvijkFSTP1RNwcy8fFg19xXfiV1Q9wriZb5iS+jYbOXKVX44kAAAAByJv8rXU2wt9ZoSemiGl7Rv1MeHwgrJRvbYcUfMpjLAz2bh77nWHOppVpZzR2K2uw89vs6aWrPXuiWeIEQQvEM"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245952488007586"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.3041625260016576
Encrypted:	false
SSDEEP:	3:FkXEwozZHn:+EwozZHn
MD5:	BEBB369FF4A565B19D5E0BC83CD176AE
SHA1:	A6F07666F8DDDF61E5AACE533129BFB541A8A769
SHA-256:	8018F98553432706436A31FFD1E743018C3B7F1AA8D34B2FA18F494A4CFCEB19
SHA-512:	5D2F9F6E9502517AFF4673C3157D57046D4E38D70B5E228F468FB820363E559087D1A2F2E4006B4589BF3F175A4507F1FA3D7BE5FC34F9FA39EB17757DAEC17F
Malicious:	false
Reputation:	low
Preview:	sdPC.......................y3..M.Y.NbD.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1413345e-0320-4ce6-a393-051837b79367.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	low
Preview:	.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2825
Entropy (8bit):	4.864734775786638
Encrypted:	false
SSDEEP:	48:YALtdpBeMsNMHK5sJDysACs37sHWsd5/sSYMHCKs/MHCzsSOMHwsSJtFsX3RLs9G:HQxGKWDS1i/5vYGmGqOGKJ03QshH
MD5:	4475D531A97CBC19BC6E1798BB10FF23
SHA1:	ACC646E47AFD877D4E7272A11BC34B3FE79E62FD
SHA-256:	89D7C4916871A486928BD9FA996D1FD613E6ADEDD2E10B1CAB2ADF20BBF47C33
SHA-512:	277EF14539AF646C3A5790B1BE427EA7A0900B5543611E5BA0CCE85D07216E0EF4FE747088E37C9185E18F4086EED4CBE7E3A31002D845E72B96E531D763C47D
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"broken_alternative_services":[{"broken_count":1,"host":"accounts.google.com","isolation":[],"port":443,"protocol_str":"quic"},{"broken_count":1,"host":"www.google.com","isolation":[],"port":443,"protocol_str":"quic"}],"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248544952675493","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":32613},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544952813644","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544952748754","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544952634896","port":443,"protocol_str":"quic"}],"isolation":[],"server"

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\20e0cc6d-d6f3-48ce-bb51-3ed9eb966ae0.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	17356
Entropy (8bit):	5.570652839530798
Encrypted:	false
SSDEEP:	384:fKstfLlFDXq1kXqKf/pUZNCgVLH2HfDarUhHZe4z:pLlpq1kXqKf/pUZNCgVLH2Hf2rU/eY
MD5:	1BF5A47D791405158D9832D6B2E3CB26
SHA1:	9D61D303FCCF18A5F93D1DCB656E4D8707578AEB
SHA-256:	E5BCF9F7C80965DB5A13C1E54E24F94A9BB80D6A70B04C1A279E98FA6D15AA5D
SHA-512:	57FBFF6FD0386AB77323F742DC143BCBFBBF734154321DD61A68B785611B6D56681F659B31D04A4F4FE153CFEAB767255E00B23BD855CD0BD64B13DF28AB55A0
Malicious:	false
Reputation:	low
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13293333118657116","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5b80cdf9-e0de-4a5b-ba02-1d96632a90b2.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5154
Entropy (8bit):	4.976544154130909
Encrypted:	false
SSDEEP:	96:nOXbpqqm1paAKILxk0JCKL82FkZ1f3zbOTQVuwn:nOXbnm1p9L4KxFkZB3H
MD5:	00E31D91B608656BD3380BBB6201A3C5
SHA1:	BC8968136AE40C7F0E7D874BA25EB67ECA99BFB5
SHA-256:	3DB5C7E0EF6B4F6EDEA1012A833F56E7CB7B8F40320D7174634C05F26C7B4D43
SHA-512:	38F02CC9C02157105847B37E250CEE0ABD91A6840A18AF80B5CCF79AF60917E84964D4643C4C69E8F0CB5CB59186A1EC179CEEE53F9BB211D18103DBD9B2F768
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13293333119508512","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245952891998324","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245952963463509","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1501624"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\75611d83-2b1f-4c03-bc9c-3def6b0ba12b.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	17530
Entropy (8bit):	5.573384754574223
Encrypted:	false
SSDEEP:	384:fKstGLlFDXq1kXqKf/pUZNCgVLH2HfDarU6Hte41:wLlpq1kXqKf/pUZNCgVLH2Hf2rUoeu
MD5:	21BB7CDEAFA55219D7B929FB1B2EE241
SHA1:	861DE8A917E68B5C0EEB7E7D0C7100B6CFEF344B
SHA-256:	1741D62D2D12CF9522D21622D4A63527916C34AEA766810DF61C1ABC6CD9E5EB
SHA-512:	0BB2040D5759A064AE8E413C55D218E8C95E9AA6DDFDE206938EB0171960CC8543D1ADE3C1E178FA374853497B3D75F5FAD9D1FF4DFBCA95C6F0C25D70C498CD
Malicious:	false
Reputation:	low
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13293333118657116","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7868da7d-9a77-4fdd-8358-344e1b840f80.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5169
Entropy (8bit):	4.978483032032621
Encrypted:	false
SSDEEP:	96:nOXbX/TG1paAKILxk0JCKL82FkZ1f3zbOTQVuwn:nOXbXq1p9L4KxFkZB3H
MD5:	3C9B6BAF6EEA0E13BC034954356353AA
SHA1:	545D0FB7ABDAA2CEADDE042FE78754CD56BBA9F1
SHA-256:	08F429D8ADC3A7BB3EE0C3C9A39456DFF9E48207175745DF0A6D627C276A94C5
SHA-512:	A2A78A9BEF6B1CE0E1BF43B298048597C8CD785D5860251C33B9FF2B3586326EEB1632BA6BC5043B3690B91EA588C88D29220EBA118A68B04AFC2343BCB2025B
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13293333119508512","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245952891998324","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245952963463509","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1501624"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	false
Reputation:	low
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	375
Entropy (8bit):	5.187728234707698
Encrypted:	false
SSDEEP:	6:6Uf+q2PN723iKKdK25+Xqx8chI+IFUtqVHUwz5ZmwYVHUwztVkwON723iKKdK25N:evVa5KkTXfchI3FUtyd/Av5Oa5KkTXfE
MD5:	F61CEB0D359C51E11431E4541048686E
SHA1:	FCA5B47E37784950C56B4C554166CCB47E0F8EFC
SHA-256:	AB244292B476290AB27E99A99621610FF3DF9815CC2950B8A5F5F820A057E372
SHA-512:	FB0D84407A34EA397B22BDDB7675FBCADBA7564465F017C67525EE55DEF9B4E632E5A6A0C2DC12A2722C464724AF47CDA4655B469635D0C7056FCF38EBC143C6
Malicious:	false
Reputation:	low
Preview:	2022/04/01-17:32:17.308 f28 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/04/01-17:32:17.310 f28 Recovering log #3.2022/04/01-17:32:17.310 f28 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	375
Entropy (8bit):	5.187728234707698
Encrypted:	false
SSDEEP:	6:6Uf+q2PN723iKKdK25+Xqx8chI+IFUtqVHUwz5ZmwYVHUwztVkwON723iKKdK25N:evVa5KkTXfchI3FUtyd/Av5Oa5KkTXfE
MD5:	F61CEB0D359C51E11431E4541048686E
SHA1:	FCA5B47E37784950C56B4C554166CCB47E0F8EFC
SHA-256:	AB244292B476290AB27E99A99621610FF3DF9815CC2950B8A5F5F820A057E372
SHA-512:	FB0D84407A34EA397B22BDDB7675FBCADBA7564465F017C67525EE55DEF9B4E632E5A6A0C2DC12A2722C464724AF47CDA4655B469635D0C7056FCF38EBC143C6
Malicious:	false
Reputation:	low
Preview:	2022/04/01-17:32:17.308 f28 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/04/01-17:32:17.310 f28 Recovering log #3.2022/04/01-17:32:17.310 f28 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	5.341635843102789
Encrypted:	false
SSDEEP:	12:OB21gEHK0+G3CaSIG3owgkJi1cC+2QpssUXS3YPNu23tVu/zVa/qMGSXEe7y/Iug:0OfVPG3RJ0cC+lps5XSkk2dtEe7ygu6H
MD5:	4A1F5DFA6B9DAC45B1D73AA7D5E98949
SHA1:	4335323670EFFF8837C44A74141AD6CB96B895F4
SHA-256:	9650454E624B1887FAE454C16ED912D980C0086DFD79EA2CA05C5EF9676956A8
SHA-512:	044E1FF6A0F01C17436ADB66E8B4D97961AA32B2D1CC4D5C753AD1AF8C19396E622720087DAC4CCF923F91C844ECC2F80064C3D45CACC19DC479308A4B13CF61
Malicious:	false
Reputation:	low
Preview:	............."S....citrix..com..emsonline..gateway..https..tritech..html..index..logon..logonpoint{......citrix......com......emsonline......gateway......html......https......index......logon......logonpoint......tritech..2.........a........c..........d........e...........g..........h..........i............l...........m..........n...........o...........p.........r.........s.........t.............w........x.........y...:b..................................................................................................B.....P...... .........https://emsonline.tritech.com/2.Citrix Gateway:.................p...... ........*9https://emsonline.tritech.com/logon/LogonPoint/index.html2.Citrix Gateway:.....................J"...........................$/5....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2825
Entropy (8bit):	4.864734775786638
Encrypted:	false
SSDEEP:	48:YALtdpBeMsNMHK5sJDysACs37sHWsd5/sSYMHCKs/MHCzsSOMHwsSJtFsX3RLs9G:HQxGKWDS1i/5vYGmGqOGKJ03QshH
MD5:	4475D531A97CBC19BC6E1798BB10FF23
SHA1:	ACC646E47AFD877D4E7272A11BC34B3FE79E62FD
SHA-256:	89D7C4916871A486928BD9FA996D1FD613E6ADEDD2E10B1CAB2ADF20BBF47C33
SHA-512:	277EF14539AF646C3A5790B1BE427EA7A0900B5543611E5BA0CCE85D07216E0EF4FE747088E37C9185E18F4086EED4CBE7E3A31002D845E72B96E531D763C47D
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"broken_alternative_services":[{"broken_count":1,"host":"accounts.google.com","isolation":[],"port":443,"protocol_str":"quic"},{"broken_count":1,"host":"www.google.com","isolation":[],"port":443,"protocol_str":"quic"}],"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248544952675493","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":32613},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544952813644","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544952748754","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248544952634896","port":443,"protocol_str":"quic"}],"isolation":[],"server"

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5169
Entropy (8bit):	4.978483032032621
Encrypted:	false
SSDEEP:	96:nOXbX/TG1paAKILxk0JCKL82FkZ1f3zbOTQVuwn:nOXbXq1p9L4KxFkZB3H
MD5:	3C9B6BAF6EEA0E13BC034954356353AA
SHA1:	545D0FB7ABDAA2CEADDE042FE78754CD56BBA9F1
SHA-256:	08F429D8ADC3A7BB3EE0C3C9A39456DFF9E48207175745DF0A6D627C276A94C5
SHA-512:	A2A78A9BEF6B1CE0E1BF43B298048597C8CD785D5860251C33B9FF2B3586326EEB1632BA6BC5043B3690B91EA588C88D29220EBA118A68B04AFC2343BCB2025B
Malicious:	false
Reputation:	low
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13293333119508512","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245952891998324","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245952963463509","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","1501624"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	17530
Entropy (8bit):	5.573384754574223
Encrypted:	false
SSDEEP:	384:fKstGLlFDXq1kXqKf/pUZNCgVLH2HfDarU6Hte41:wLlpq1kXqKf/pUZNCgVLH2Hf2rUoeu
MD5:	21BB7CDEAFA55219D7B929FB1B2EE241
SHA1:	861DE8A917E68B5C0EEB7E7D0C7100B6CFEF344B
SHA-256:	1741D62D2D12CF9522D21622D4A63527916C34AEA766810DF61C1ABC6CD9E5EB
SHA-512:	0BB2040D5759A064AE8E413C55D218E8C95E9AA6DDFDE206938EB0171960CC8543D1ADE3C1E178FA374853497B3D75F5FAD9D1FF4DFBCA95C6F0C25D70C498CD
Malicious:	false
Reputation:	low
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13293333118657116","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\5bda346b-693a-415b-82f8-d0aa0a9fcbac.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.957678621686452
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5kjxZsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRKXk1Yn:YHO8sdSZsBdLJlyH7E4f3K3X
MD5:	93D2E0EFF548FC5E2DA9EC4E630D565B
SHA1:	3D0F4AF0C9516FB2FFE8690E7E932062BF2F147B
SHA-256:	D0044287A77347B99FB2FE2D4DE94B11EDE6659696A45D5874CA31312D2239FF
SHA-512:	3D9F2000B6F8B9DD108BFE62790E2A9E4D2742AFA0819464F7FB0C4E77B9A3DA860F326B985A6E37087141F5AA8DE959DC4218DD05EA3F6F90F1899B632CF13D
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248544897343531","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.957678621686452
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5kjxZsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRKXk1Yn:YHO8sdSZsBdLJlyH7E4f3K3X
MD5:	93D2E0EFF548FC5E2DA9EC4E630D565B
SHA1:	3D0F4AF0C9516FB2FFE8690E7E932062BF2F147B
SHA-256:	D0044287A77347B99FB2FE2D4DE94B11EDE6659696A45D5874CA31312D2239FF
SHA-512:	3D9F2000B6F8B9DD108BFE62790E2A9E4D2742AFA0819464F7FB0C4E77B9A3DA860F326B985A6E37087141F5AA8DE959DC4218DD05EA3F6F90F1899B632CF13D
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248544897343531","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Rv:1qIFJ
MD5:	6752A1D65B201C13B62EA44016EB221F
SHA1:	58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
SHA-256:	0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
SHA-512:	9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
Malicious:	false
Reputation:	low
Preview:	MANIFEST-000004.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Rv:1qIFJ
MD5:	6752A1D65B201C13B62EA44016EB221F
SHA1:	58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
SHA-256:	0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
SHA-512:	9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
Malicious:	false
Reputation:	low
Preview:	MANIFEST-000004.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	3.138546519832722
Encrypted:	false
SSDEEP:	3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
MD5:	DE9EF0C5BCC012A3A1131988DEE272D8
SHA1:	FA9CCBDC969AC9E1474FCE773234B28D50951CD8
SHA-256:	3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
SHA-512:	CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
Malicious:	false
Reputation:	low
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:Yx7:4
MD5:	C422F72BA41F662A919ED0B70E5C3289
SHA1:	AAD27C14B27F56B6E7C744A8EC5B1A7D767D7632
SHA-256:	02E71EB4C587FEB7EE00CE8600F97411C2774C2FC34CB95B92D5538E7F30DA59
SHA-512:	86010ED2B2EEBDCC5A8A076B37703669C294C6D1BFAAEA963E26A9C94B81B4C53EC765D9425E5B616159C43923F800A891F9B903659575DF02F8845521F8DC46
Malicious:	false
Reputation:	low
Preview:	85.0.4183.121

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	402043
Entropy (8bit):	6.047471539136821
Encrypted:	false
SSDEEP:	6144:BHxY2brnisl5Ct8VZbU0d7cBzG0OP1eVxR+v+F7EFpfY4XB3iE7ZPXYGzLxin9:fY2/tCINLd7KGNPUZ+w7wJHyEtAWA
MD5:	675A610BC62A10651C9D34D29AEC4952
SHA1:	8ED0153D9D1D403DCBA8CCE1076575339B7BEAF0
SHA-256:	30EE4FB5E6A2001B4D7441D751AEF3D68884B486729ADE9181D6DF469EC65583
SHA-512:	21069C72326F9FC720FD1870CF2D4A701873869F8E8FBF997A9202BA2A380A1693A023F02F3308F2A5751171BD38CF257117F90F789B57E8E9DB55D3F6F3179B
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.648859520875681e+12,"network":1.648827122e+12,"ticks":173836368.0,"uncertainty":3719468.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACMBYze0bKMTIhZGR/AW4M5AAAAAAIAAAAAABBmAAAAAQAAIAAAACoSPhbyumSaNjLuAHEna2OUDn+rpXOk+H/ONjHe5ZwbAAAAAA6AAAAAAgAAIAAAADezR1ii2QiPYGPz0Jd0ZQiE5jKOKMttbbwwADHJYDpEMAAAACuIP4EJtfud3aEFZzvijkFSTP1RNwcy8fFg19xXfiV1Q9wriZb5iS+jYbOXKVX44kAAAAByJv8rXU2wt9ZoSemiGl7Rv1MeHwgrJRvbYcUfMpjLAz2bh77nWHOppVpZzR2K2uw89vs6aWrPXuiWeIEQQvEM"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291230364693921"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	92724
Entropy (8bit):	3.7443793229660995
Encrypted:	false
SSDEEP:	384:z7A/fliY5p+jqN7rQvXt3o3pIHRkG8brWBfnxQpFVUruTmeJCtT/zIOZZHNG1ri5:YK1VKVIQkejrlJUnreNKTNfhL
MD5:	66BC946EFD848E5C54BC8FEF16797FA0
SHA1:	4CCEFA2911864AA246E019DEC0BB740B35C1DB52
SHA-256:	7616468DE8FA856E0C63E6E431C14F52E83464407F90916AA0E76BD2CD044272
SHA-512:	652D6A73B66D8C4CD7172D5D087270B5843A3498C2FEEEEF6186AB607FC4858EC7A9FFAA7F3F47819557C0AE2289A4F2B14B57652D68C47486D75227CABAA9BA
Malicious:	false
Reputation:	low
Preview:	0j.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...0X8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\bb283942-986b-4ef9-83fa-8cef9521bfdf.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	92724
Entropy (8bit):	3.7443793229660995
Encrypted:	false
SSDEEP:	384:z7A/fliY5p+jqN7rQvXt3o3pIHRkG8brWBfnxQpFVUruTmeJCtT/zIOZZHNG1ri5:YK1VKVIQkejrlJUnreNKTNfhL
MD5:	66BC946EFD848E5C54BC8FEF16797FA0
SHA1:	4CCEFA2911864AA246E019DEC0BB740B35C1DB52
SHA-256:	7616468DE8FA856E0C63E6E431C14F52E83464407F90916AA0E76BD2CD044272
SHA-512:	652D6A73B66D8C4CD7172D5D087270B5843A3498C2FEEEEF6186AB607FC4858EC7A9FFAA7F3F47819557C0AE2289A4F2B14B57652D68C47486D75227CABAA9BA
Malicious:	false
Reputation:	low
Preview:	0j.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...0X8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\d6ba839b-a3b4-406e-a40f-d4b430a247b5.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	402043
Entropy (8bit):	6.047471539136821
Encrypted:	false
SSDEEP:	6144:BHxY2brnisl5Ct8VZbU0d7cBzG0OP1eVxR+v+F7EFpfY4XB3iE7ZPXYGzLxin9:fY2/tCINLd7KGNPUZ+w7wJHyEtAWA
MD5:	675A610BC62A10651C9D34D29AEC4952
SHA1:	8ED0153D9D1D403DCBA8CCE1076575339B7BEAF0
SHA-256:	30EE4FB5E6A2001B4D7441D751AEF3D68884B486729ADE9181D6DF469EC65583
SHA-512:	21069C72326F9FC720FD1870CF2D4A701873869F8E8FBF997A9202BA2A380A1693A023F02F3308F2A5751171BD38CF257117F90F789B57E8E9DB55D3F6F3179B
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.648859520875681e+12,"network":1.648827122e+12,"ticks":173836368.0,"uncertainty":3719468.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACMBYze0bKMTIhZGR/AW4M5AAAAAAIAAAAAABBmAAAAAQAAIAAAACoSPhbyumSaNjLuAHEna2OUDn+rpXOk+H/ONjHe5ZwbAAAAAA6AAAAAAgAAIAAAADezR1ii2QiPYGPz0Jd0ZQiE5jKOKMttbbwwADHJYDpEMAAAACuIP4EJtfud3aEFZzvijkFSTP1RNwcy8fFg19xXfiV1Q9wriZb5iS+jYbOXKVX44kAAAAByJv8rXU2wt9ZoSemiGl7Rv1MeHwgrJRvbYcUfMpjLAz2bh77nWHOppVpZzR2K2uw89vs6aWrPXuiWeIEQQvEM"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291230364693921"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Temp\007305f8-30c8-4fab-9a77-a9bc68b6ca1a.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	low
Preview:	.

C:\Users\user\AppData\Local\Temp\b0d81eef-34e6-41e6-80c7-6ea91f55978c.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Reputation:	low
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1293
Entropy (8bit):	4.132566655778463
Encrypted:	false
SSDEEP:	24:YHYpcyllEQVFc0Bh0GQVQQVEM0bRLzRd0bRLzRRpcyllNQVb26RQ0bR60L0ZWOFY:YHYpZaQLH1QKQ6xxzcxzvpZzQA6z2nhQ
MD5:	D7A97183BCBD5FB677AA84D464F0C564
SHA1:	CDBB279B864E2C0A51E0892B8714131802586506
SHA-256:	76EFAD74EB8256B942727C42261147EB9CCA48DA284DB3CDCE5DC6A3B4346F02
SHA-512:	36F0310DD06319E4A51F77E4C3D64F6276891CE6410FE2571324BB71F2FBCDA368EAC4267FF8268086BE6912E41787D0F70771755E3D49E3E8C26648EAC6EFC9
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u041f\u043e\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043d\u044f\u043c\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u0442\u043e."},"craw_connect_to_network":{"message":"\u041c\u043e\u043b\u044f, \u0441\u0432\u044a\u0440\u0436\u0435\u0442\u0435 \u0441\u0435 \u0441 \u043c\u0440\u0435\u0436\u0430."},"app_name":{"message":"\u041f\u043b\u0430\u0449\u0430\u043d\u0438\u044f \u0432 \u0443\u0435\u0431 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 \u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0449\u0430\u043d\u0438\u044f \u0432 \u0443\u0435\u0431 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 \u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043e\u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043d\u044f\u043c\u0430 \u0434\u043e\u0441\u0442\u044a\u043f \u0434\u043e \u0432\u0433\u0440\u0430\u0434\u0435\u043d\u0430\u0442\u0430 \

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	556
Entropy (8bit):	4.768628082639434
Encrypted:	false
SSDEEP:	12:YGGYp73YbYHOLBiGF14gevg7p6ixuYHOPBBVC9WO/NrnLAOK:YHYp73vuLBVV17pRunVC9WOFvAOK
MD5:	58BA5F65ED971591D1F9D81848EE31D0
SHA1:	BDA3C8B74653334FC8F060CAFBCEA58DF0113AB7
SHA-256:	CDD91587F5AF2C865776B36A5E9A07B10D21B9D911DE0B814B7A1E94B14AE885
SHA-512:	BA2A6BAA3011A54E6B07E29DFD133009D66B6CFFF525DEC0024BDE55A9BED463AD130307EE64BFB4A983A11FFD6B44BD53ED38EB144083A2CBEFA8D85C4D5D41
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Ara mateix aquesta aplicaci\u00f3 no est\u00e0 disponible."},"craw_connect_to_network":{"message":"Connecteu-vos a una xarxa."},"app_name":{"message":"Sistema de pagaments de Chrome Web Store"},"app_description":{"message":"Sistema de pagaments de Chrome Web Store"},"iap_unavailable":{"message":"La funci\u00f3 Pagaments a l'aplicaci\u00f3 no est\u00e0 disponible actualment."},"please_sign_in":{"message":"Inicieu la sessi\u00f3 a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	550
Entropy (8bit):	4.905634822460801
Encrypted:	false
SSDEEP:	12:YGGYpTPklW+g5Q7wvAvPJE7ZEWJE7ZRpmJEWN20GN5Q9O/NrnLAOK:YHYpbt5SwvGJE7ZfJE7ZRpmJEEGN5WOi
MD5:	43161EFFA28A0DBFC67B8F7DBE1B5184
SHA1:	FE0A9235A59B51B7F564F14FF564344927F035B8
SHA-256:	3A04421DF5218E8ABD3B0E2AFE11E8338D7BDCBCD1ADB122416944B102BC9696
SHA-512:	FC6A391A4B37FFEE2182F29C1590E32766A1820DC58D0A70A8DD96D7ABE74B47181B24AFFF8ADAE12686CCB1B898DCDDB882EFD205C3387B5B6F3CFBE6E5BA78
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Aplikace v sou\u010dasn\u00e9 dob\u011b nen\u00ed dostupn\u00e1."},"craw_connect_to_network":{"message":"P\u0159ipojte se pros\u00edm k s\u00edti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplikaci aktu\u00e1ln\u011b nejsou k dispozici."},"please_sign_in":{"message":"P\u0159ihlaste se do Chromu."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	505
Entropy (8bit):	4.795529861403324
Encrypted:	false
SSDEEP:	12:YGGYpB/wHlHE3qKWEMqKWRp8KW/wU0HWO/NrnLAOK:YHYpN4lGqKAqKgp8FiHWOFvAOK
MD5:	31264DDBF251A95DE82D0A67FA47DB3A
SHA1:	3A48DC7AF26A153594C7849E1D92AAC31296459B
SHA-256:	EDB51898A6C73D0090D6916B7B72EBAC71E964EABB5BA7CD68E21966024F0D23
SHA-512:	B97D61BD71E3F0A91FF1048D2ACAD4BC092CCAF157B7A96029B6AB5AF1812B01814E3153CD894307CB13DC132523EAC22B19CADA6B97F4B81B0D1132562317B5
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Appen er ikke tilg\u00e6ngelig i \u00f8jeblikket."},"craw_connect_to_network":{"message":"Opret forbindelse til et netv\u00e6rk."},"app_name":{"message":"Betalinger i Chrome Webshop"},"app_description":{"message":"Betalinger i Chrome Webshop"},"iap_unavailable":{"message":"Betaling i appen er ikke tilg\u00e6ngelig i \u00f8jeblikket."},"please_sign_in":{"message":"Log ind p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	516
Entropy (8bit):	4.809852395188501
Encrypted:	false
SSDEEP:	12:YGGYpyBCEl9ljMRE1RRpUT6+ZMUO/NrnLAOK:YHYpQDbPpUTvTOFvAOK
MD5:	7639B300B40DDAF95318D2177D3265F9
SHA1:	BF9EFDF073231CB3FCFCA5CCCA25B079ECFC45BD
SHA-256:	356A9D4ADFEC484DA824E7A72059B724B1686FC90082F4A4B667630436D593B0
SHA-512:	70593318C6626B5D25729E8D8109D5611B95283266621BE60ADD7E60C0DD5BC43848E956C767251B7B3CCDF5A0929922DE38F90CC8632CCD0C1CCFC7D6DEFE69
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Die App ist momentan nicht verf\u00fcgbar."},"craw_connect_to_network":{"message":"Bitte stellen Sie eine Verbindung zu einem Netzwerk her."},"app_name":{"message":"Chrome Web Store-Zahlungen"},"app_description":{"message":"Chrome Web Store-Zahlungen"},"iap_unavailable":{"message":"In-App-Zahlungen sind momentan nicht m\u00f6glich."},"please_sign_in":{"message":"Bitte melden Sie sich in Chrome an."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1236
Entropy (8bit):	4.338644812557597
Encrypted:	false
SSDEEP:	24:YHYpgFMjXrNW1DWgHle+T2dAplFcTpW1auWgtes9WOFvAOK:YHYpkMj7yxHw+CdAplFcifIs9nhQ
MD5:	3026E922B17DBEE2674FDAEE960DF584
SHA1:	76602B1E3449F1B67DE42FD31A581B0821BFEFF0
SHA-256:	876845B5A061FAB3CF2A1466E01015DC40DF8449F1CB4205F575CEBED8717BAD
SHA-512:	0C4DCB2589553F9F75534E6C702EBF9095665C93D213564265E39220A99B61BB112A3B20980CE0377C7E98878E3240EB87312B5ECE874382B7E9CA90A0016992
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u0397 \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae \u03c0\u03c1\u03bf\u03c2 \u03c4\u03bf \u03c0\u03b1\u03c1\u03cc\u03bd \u03b4\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03b9\u03b1\u03b8\u03ad\u03c3\u03b9\u03bc\u03b7."},"craw_connect_to_network":{"message":"\u03a3\u03c5\u03bd\u03b4\u03b5\u03b8\u03b5\u03af\u03c4\u03b5 \u03c3\u03b5 \u03ad\u03bd\u03b1 \u03b4\u03af\u03ba\u03c4\u03c5\u03bf."},"app_name":{"message":"\u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03c3\u03c4\u03bf Chrome Web Store"},"app_description":{"message":"\u03a0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03c3\u03c4\u03bf Chrome Web Store"},"iap_unavailable":{"message":"\u039f\u03b9 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ad\u03c2 \u03b5\u03bd\u03c4\u03cc\u03c2 \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ce\u03bd \u03b4\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b1\u03c5\u03c4\u03ae\u03bd \u03c4\u03b7 \u03c3\u03c4\u03b9\u03b3\u03bc\u03ae \u03b4\u03b9\u03b1\u03b8

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.679939707243892
Encrypted:	false
SSDEEP:	12:YGGYp4Fp0JAvpErBpUwEGFpfJAKWO/NrnLAOK:YHYpAp0J3pURKpfJzWOFvAOK
MD5:	DBEDF86FA9AFB3A23DBB126674F166D2
SHA1:	5628AFFBCF6F897B9D7FD9C17DEB9AA75036F1CC
SHA-256:	C0945DD5FDECAB40C45361BEC068D1996E6AE01196DCE524266D740808F753FE
SHA-512:	931D7BA6DA84D4BB073815540F35126F2F035A71BFE460F3CCAED25AD7C1B1792AB36CD7207B99FDDF5EAF8872250B54A8958CF5827608F0640E8AAFE11E0071
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"App currently unavailable."},"craw_connect_to_network":{"message":"Please connect to a network."},"app_name":{"message":"Chrome Web Store Payments"},"app_description":{"message":"Chrome Web Store Payments"},"iap_unavailable":{"message":"In-App Payments is currently unavailable."},"please_sign_in":{"message":"Please sign into Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.679939707243892
Encrypted:	false
SSDEEP:	12:YGGYp4Fp0JAvpErBpUwEGFpfJAKWO/NrnLAOK:YHYpAp0J3pURKpfJzWOFvAOK
MD5:	DBEDF86FA9AFB3A23DBB126674F166D2
SHA1:	5628AFFBCF6F897B9D7FD9C17DEB9AA75036F1CC
SHA-256:	C0945DD5FDECAB40C45361BEC068D1996E6AE01196DCE524266D740808F753FE
SHA-512:	931D7BA6DA84D4BB073815540F35126F2F035A71BFE460F3CCAED25AD7C1B1792AB36CD7207B99FDDF5EAF8872250B54A8958CF5827608F0640E8AAFE11E0071
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"App currently unavailable."},"craw_connect_to_network":{"message":"Please connect to a network."},"app_name":{"message":"Chrome Web Store Payments"},"app_description":{"message":"Chrome Web Store Payments"},"iap_unavailable":{"message":"In-App Payments is currently unavailable."},"please_sign_in":{"message":"Please sign into Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	542
Entropy (8bit):	4.704430479150276
Encrypted:	false
SSDEEP:	12:YGGYpDbKEzebFcjwWtp6FPbF3QVcqHWO/NrnLAOK:YHYpqEzoFmpQymaWOFvAOK
MD5:	3F4B0F56C2839839FC3E3270ED4CB7B6
SHA1:	0D74EA655EAE3990E95BD26F6E1467EDF3EB3478
SHA-256:	1912EA5E0A62BBC669DC14AB5A5BD5514B0502C483EE1F27C3F8834384187079
SHA-512:	4E6A828FE73FC4AB03F0EE966CE7BD8061575A059E90709F908D8D91C5F4EB6A8D25BBFA100E48AD7AC94E76D3BCD3547C277B4150D515222757CC9906AD20A2
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"Los pagos en la aplicaci\u00f3n no est\u00e1n disponibles en este momento."},"please_sign_in":{"message":"Inicia sesi\u00f3n en Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	510
Entropy (8bit):	4.719977015734499
Encrypted:	false
SSDEEP:	12:YGGYpDbKEzebFcjwWtpML4c9WO/NrnLAOK:YHYpqEzoFmpMLBWOFvAOK
MD5:	1FD5DAF46C4D7C4F571C263EC37B943B
SHA1:	A57EE5EF6861F88005C2230EA3D633A1B4CA105A
SHA-256:	BCC2CF06F66E9E3BB4B7887D0EE0AE4A72A6C49F4B2A578A7733B78208984417
SHA-512:	79C3104F1DC51B17B062803209029C8165DBD391FBE0B69BB406D7B4F92FE1898CAC30E20C2E5CFB65D643B978095626C68EAA0CFCA064354D52D52D16BF21A9
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"En este momento, Pagos En-Apps no est\u00e1 disponible."},"please_sign_in":{"message":"Accede a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	460
Entropy (8bit):	4.679279844668757
Encrypted:	false
SSDEEP:	6:YGGYpkeVeVfCb53Q67PZV6pPQpkjA5DeY68AoLRcZplNgCnGcPxYA8KoOK:YGGYpv2A77PrQPQpT/AoLRO/NrnLAOK
MD5:	0293A7BAE6EEE62C4067A80E262D6A2D
SHA1:	E76B07BD49FFBBFB6841B7335CBE7A9620714402
SHA-256:	D06F20D4D68D1DBB89EF7D8E405D9499CB2EB2560217CD5B4A51AB1DD50CAB44
SHA-512:	8BF97DA4038A9C4426A285D5FEF0953F4E7E6D0667091A39DE4D4C5B4C35FC7B6A804425DBB4B82356A93950738E4F0937DE1AD777AE75AAC9BFB97D63F771E0
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Rakendus pole praegu saadaval."},"craw_connect_to_network":{"message":"Looge \u00fchendus v\u00f5rguga."},"app_name":{"message":"Chrome'i veebipoe maksed"},"app_description":{"message":"Chrome'i veebipoe maksed"},"iap_unavailable":{"message":"Rakendusesisesed maksed ei ole praegu saadaval."},"please_sign_in":{"message":"Logige Chrome'i sisse."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	568
Entropy (8bit):	4.768364810051887
Encrypted:	false
SSDEEP:	12:YGGYpQTajDRdes6KUVJ8epQTNufIRdes6K27lO/NrnLAOK:YHYpQ67esNMpQJufI7esN27lOFvAOK
MD5:	E5BBE7DBBE75F45BDCD49DB8C797106E
SHA1:	0F069D7D19768180945F0D8B67DC71262FD586A2
SHA-256:	BFFB2248B4C66306133FA6ECBB1541F44B3BE22CC8D9A338D690E0B1D0C85532
SHA-512:	F6FE20B7A3B99BDBBF6F4737C8C63FE3098F060E6791BC40ED0E95FA5F93AA55C2643766EA2BE099E42EC378CB6E4B6FE7B5F2DA56C03A6A990B94A1F872B825
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Sovellus ei ole t\u00e4ll\u00e4 hetkell\u00e4 k\u00e4ytett\u00e4viss\u00e4."},"craw_connect_to_network":{"message":"Muodosta verkkoyhteys."},"app_name":{"message":"Chrome Web Storen maksut"},"app_description":{"message":"Chrome Web Storen maksut"},"iap_unavailable":{"message":"Sovelluksen sis\u00e4iset maksut eiv\u00e4t ole t\u00e4ll\u00e4 hetkell\u00e4 k\u00e4ytett\u00e4viss\u00e4."},"please_sign_in":{"message":"Kirjaudu sis\u00e4\u00e4n Chromeen."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.699741311937528
Encrypted:	false
SSDEEP:	12:YGGYpsiwZALE0Dw9DtpsjzAvX2xSWO/NrnLAOK:YHYpsBvpsiX2xSWOFvAOK
MD5:	658DAD2AF2DC3AC1567D84E8B95F68B0
SHA1:	EE1121215960EC5ED5F7B6BDB8E4680731EBF83D
SHA-256:	978BA6D814CF290016833BBAC22DC7C05C2C575B1D6429B9BB14F8C2156BCF29
SHA-512:	F2FB93245D80E2CB2CA1BB2B0654FE92AD9041A558850D78AF4031CB83D2AD3BF5ABCFE6BC32160D028CA3914FA69A64784858A34FA56389C08D52B316346A05
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Kasalukuyang hindi available ang app."},"craw_connect_to_network":{"message":"Mangyaring kumonekta sa isang network."},"app_name":{"message":"Mga Pagbabayad sa Chrome Web Store"},"app_description":{"message":"Mga Pagbabayad sa Chrome Web Store"},"iap_unavailable":{"message":"Kasalukuyang hindi available ang Mga Pagbabayad na In-App."},"please_sign_in":{"message":"Mangyaring mag-sign in sa Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.717150188929866
Encrypted:	false
SSDEEP:	12:YGGYpKdgbfUSPcLf0E1UDWcLf0E1Uop6oTQpGnbgWWO/NrnLAOK:YHYpagI26Qq6QopRTQwnFWOFvAOK
MD5:	1E32A78526E3AC8108E73D384F17450B
SHA1:	BFE2E47D888BA530A27DD1BDE25C46433C2A545C
SHA-256:	80F6EE69F1E022812BCCC1DE1CDC53772CDF90F4E93224161B23FA607D45136A
SHA-512:	5504F6D440779BC96571863D60B1E175EEDDC2E65B1ABBCFCFD19123F329F2E025FBA4D49BD23E33B77FFB6061BA6645132E04D4A7DEDE77F514B2151CDDF896
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Application indisponible pour le moment."},"craw_connect_to_network":{"message":"Veuillez vous connecter \u00e0 un r\u00e9seau."},"app_name":{"message":"Paiements via le Chrome\u00a0Web\u00a0Store"},"app_description":{"message":"Paiements via le Chrome\u00a0Web\u00a0Store"},"iap_unavailable":{"message":"Les paiements via l'application ne sont pas disponibles pour le moment."},"please_sign_in":{"message":"Veuillez vous connecter \u00e0 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	4.454461505283053
Encrypted:	false
SSDEEP:	24:YHYpINcVc0KgcNZvCjK7jK6pVi8/pBKgcNkQVcRynX6XjOFvAOK:YHYpIcQvCjIjRpVVBXPsqihQ
MD5:	B739E3B798D3EEB8AFB3E368455A8E97
SHA1:	56E206DD0AC7EB7B179911BE3F7DD78059CBD4F3
SHA-256:	BA7A53A1398168719F2ACD58CC5FE06AB0B769ECA896D70E7208B18085B42FFA
SHA-512:	181A3B1275D1D17BD48EAA77805981A96E22589A38990214AF3ED029C4A37C2F05ECF747D8FCF816C2AAED6EF82403757F234D67C360A3A6E5DB6C3F59CA1A0C
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u0910\u092a\u094d\u0932\u093f\u0915\u0947\u0936\u0928 \u0907\u0938 \u0938\u092e\u092f \u0909\u092a\u0932\u092c\u094d\u0927 \u0928\u0939\u0940\u0902 \u0939\u0948."},"craw_connect_to_network":{"message":"\u0915\u0943\u092a\u092f\u093e \u0928\u0947\u091f\u0935\u0930\u094d\u0915 \u0938\u0947 \u0915\u0928\u0947\u0915\u094d\u091f \u0915\u0930\u0947\u0902."},"app_name":{"message":"Chrome \u0935\u0947\u092c \u0938\u094d\u091f\u094b\u0930 \u092d\u0941\u0917\u0924\u093e\u0928"},"app_description":{"message":"Chrome \u0935\u0947\u092c \u0938\u094d\u091f\u094b\u0930 \u092d\u0941\u0917\u0924\u093e\u0928"},"iap_unavailable":{"message":"\u0907\u0928-\u0910\u092a \u092d\u0941\u0917\u0924\u093e\u0928 \u0905\u092d\u0940 \u0909\u092a\u0932\u092c\u094d\u0927 \u0928\u0939\u0940\u0902 \u0939\u0948."},"please_sign_in":{"message":"\u0915\u0943\u092a\u092f\u093e Chrome \u092e\u0947\u0902 \u0938\u093e\u0907\u0928 \u0907\u0928 \u0915\u0930\u0947\u0902."},"jwt_retrieve_failed":

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.819520019697578
Encrypted:	false
SSDEEP:	12:YGGYpTOEu5TfIJPFJEPJEsxmfEWJEsxmfRpmJEzrMrQp5TfnHV5/WIWO/NrnLAOK:YHYpq7EJPkJExfJExRpmJE/LXzHV5/ji
MD5:	9CF848209FF50DBF68F5292B3421831C
SHA1:	D29880B7B15102469123D8747BF645706CE8595B
SHA-256:	EA1744C3CFBAA684A31A00067E8493ED114EFF3E878C797C9C55A7B122D855CD
SHA-512:	B784AEE4926F850F30072ABDA85E2E2E3966285F14BDF647BD2A41C5C06CAB04BC962584830E4E913896010396EAD02D90528235B9D9EDA1BDEFBFBB5333EDF5
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Aplikacija trenuta\u010dno nije dostupna."},"craw_connect_to_network":{"message":"Pove\u017eite se s mre\u017eom."},"app_name":{"message":"Pla\u0107anja u web-trgovini Chrome"},"app_description":{"message":"Pla\u0107anja u web-trgovini Chrome"},"iap_unavailable":{"message":"Pla\u0107anje u aplikaciji trenuta\u010dno nije dostupno."},"please_sign_in":{"message":"Prijavite se na Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.865151680865773
Encrypted:	false
SSDEEP:	12:YGGYpiKQhMDCJNYygdGs61gdGs3piKQChMDZAYRO/NrnLAOK:YHYpzQhsiPgdG1gdGcpzQChsZAYOFvAD
MD5:	4AD92AFDE3408FBBE43B0C3C71677650
SHA1:	3488901077F336A3196F9AE116E36DF1674E1ACA
SHA-256:	61258FE04C23AE14FDC99EE846CEA71CC703990CC0F80C3934299646E86C475E
SHA-512:	EB945FA455DEB9D70033DC0A8AA55D1F47AA00214B70AD34D5419A54F9C05B267F96F9785139F452BEE6972376DDF13EE51C681845A2B0818172FB75BA1FD093
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Az alkalmaz\u00e1s jelenleg nem \u00e9rhet\u0151 el."},"craw_connect_to_network":{"message":"K\u00e9rj\u00fck, csatlakozzon egy h\u00e1l\u00f3zathoz."},"app_name":{"message":"Chrome Internetes \u00e1ruh\u00e1z Fizet\u00e9si rendszere"},"app_description":{"message":"Chrome Internetes \u00e1ruh\u00e1z Fizet\u00e9si rendszere"},"iap_unavailable":{"message":"Az alkalmaz\u00e1son bel\u00fcli fizet\u00e9s jelenleg nem \u00e9rhet\u0151 el."},"please_sign_in":{"message":"Jelentkezzen be a Chrome-ba."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	461
Entropy (8bit):	4.642271834875684
Encrypted:	false
SSDEEP:	12:YGGYpDBHAeSnLPo2sWo25pmo22C/SzFAAh+M9WO/NrnLAOK:YHYplHcFTpmzOptWOFvAOK
MD5:	9008516AA1D8F8C2B8ECE70B7E4963AD
SHA1:	EA7AD4BE77A80A4B9FB1E59A340010830E494747
SHA-256:	89CAB0AF2B53C6ABEB93C8C628DDCBDD286A7A2672FE03440411BB654E3A0675
SHA-512:	46534829417CAD54310BA90AD4545918A2E934508E0CC3467E367944E52315B1BC6500119214EABD40D641DD167C077935436135AF1C0DB1D1007AE98E6175FC
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Aplikasi tidak tersedia saat ini."},"craw_connect_to_network":{"message":"Sambungkan ke jaringan."},"app_name":{"message":"Pembayaran Chrome Webstore"},"app_description":{"message":"Pembayaran Chrome Webstore"},"iap_unavailable":{"message":"Pembayaran Dalam Aplikasi saat ini tidak tersedia."},"please_sign_in":{"message":"Harap masuk ke Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.701550173628233
Encrypted:	false
SSDEEP:	12:YGGYpmXXHEva6PIqd6WIqd3p6PqTX2zaWO/NrnLAOK:YHYpmnkvNtdRtd3pX6+WOFvAOK
MD5:	BB9C32BA62DDA02F9471C64B5F9CF916
SHA1:	9825037D5D9185C58456CDD887C77B10A41D8C84
SHA-256:	43A0B113D3773BA78F82BB9E42DDC46F6892D0FBBB351F94A7C105E4A146E9C1
SHA-512:	4D3DB91A6251F2DD9CBF97D29805A7AC23F49988966E9B686D486B4A8CEBEA33F5502E3891D5231674061127C282C745FB87FDA7467A6172851BF6925506C8CA
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"App al momento non disponibile."},"craw_connect_to_network":{"message":"Collegati a una rete."},"app_name":{"message":"Pagamenti Chrome Web Store"},"app_description":{"message":"Pagamenti Chrome Web Store"},"iap_unavailable":{"message":"La funzione Pagamenti In-App non \u00e8 al momento disponibile."},"please_sign_in":{"message":"Accedi a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.671841695172103
Encrypted:	false
SSDEEP:	12:YGGYpqbrR5IYstMNcXh82q8b0kOoZ46ToZ43pqbtVD2CR5IYstR0O8b0KhO/Nrnk:YHYpcFiLRMACqNpctVPieOAhOFvAOK
MD5:	96C8CBD161D3CE9CB1A46CB2CD0C6583
SHA1:	78BBFCF035B5B620E353C8E520653ADD3F4E7DB8
SHA-256:	81D8F1D9F72B3139BC5D9845BCF82990308FB6175D07514D8238B1E6D5D02E8A
SHA-512:	692468B7B44D961D8248BBC30CC11DE9F3F7E89D01A609E6CB71CAF653D8212C15DFA834C5FB6E8261FD21A25E9616861C0A3FC01DB27CBBE79C3FDE2C6549DD
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u30a2\u30d7\u30ea\u306f\u73fe\u5728\u3054\u5229\u7528\u3044\u305f\u3060\u3051\u307e\u305b\u3093\u3002"},"craw_connect_to_network":{"message":"\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306b\u63a5\u7d9a\u3057\u3066\u304f\u3060\u3055\u3044\u3002"},"app_name":{"message":"Chrome \u30a6\u30a7\u30d6\u30b9\u30c8\u30a2\u6c7a\u6e08"},"app_description":{"message":"Chrome \u30a6\u30a7\u30d6\u30b9\u30c8\u30a2\u6c7a\u6e08"},"iap_unavailable":{"message":"\u30a2\u30d7\u30ea\u5185\u30da\u30a4\u30e1\u30f3\u30c8\u306f\u73fe\u5728\u3054\u5229\u7528\u3044\u305f\u3060\u3051\u307e\u305b\u3093\u3002"},"please_sign_in":{"message":"Chrome \u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u304f\u3060\u3055\u3044\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	656
Entropy (8bit):	4.88216622785951
Encrypted:	false
SSDEEP:	12:YGGYpqHZMskkrcaw6cT/pb8pqHkrskeQV7wUO/NrnLAOK:YHYpsrkYcawwps5kdwUOFvAOK
MD5:	3CAF23A8EA2332D78B725B6C99EC3202
SHA1:	95C3504F55A929449EF2E3AB92014562AACD39AD
SHA-256:	BFE72BBC492B9018A599CB6575366696E431E6A38400E4B2ED06EAE3340D3AE5
SHA-512:	C000FCCB567D3590D4C401005E78C539961455BB13686296EC4FF7018BB0A4DAB2DA96FBDAA33D999C1409B5796932370219B3FF8490B671586DEBD6145519D6
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\ud604\uc7ac \uc571\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4."},"craw_connect_to_network":{"message":"\ub124\ud2b8\uc6cc\ud06c\uc5d0 \uc5f0\uacb0\ud558\uc138\uc694."},"app_name":{"message":"Chrome \uc6f9 \uc2a4\ud1a0\uc5b4 \uacb0\uc81c"},"app_description":{"message":"Chrome \uc6f9 \uc2a4\ud1a0\uc5b4 \uacb0\uc81c"},"iap_unavailable":{"message":"\ud604\uc7ac \uc778\uc571 \uacb0\uc81c\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4."},"please_sign_in":{"message":"Chrome\uc5d0 \ub85c\uadf8\uc778\ud558\uc138\uc694."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	576
Entropy (8bit):	4.846810495221701
Encrypted:	false
SSDEEP:	12:YGGYpmEOnxwkD9AMoAYQa9AMoAYNpALveYAyO/NrnLAOK:YHYpmznayAMHcAMHQpAzeYAyOFvAOK
MD5:	41F2D63952202E528DBBB683B480F99C
SHA1:	9DD998542DBE6609299D4A5A25364A32FA7D7865
SHA-256:	FF7C083CD1E6134DD8263C634336EB852274BAD1BFAD18762814C42BC65309D8
SHA-512:	7BD2E2D4264C6BD62DF2584F3C1D3A910C5C5A28F4532F1E8F0C2235E93714EDD6074EA24960D4DEB4F9125DA81CA813F06330EFF66FA8DF1552D1DAC686441E
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Programa \u0161iuo metu negalima."},"craw_connect_to_network":{"message":"Prisijunkite prie tinklo."},"app_name":{"message":"\u201eChrome\u201c internetin\u0117s parduotuv\u0117s mok\u0117jimo sistema"},"app_description":{"message":"\u201eChrome\u201c internetin\u0117s parduotuv\u0117s mok\u0117jimo sistema"},"iap_unavailable":{"message":"Mok\u0117jimai programoje \u0161iuo metu negalimi."},"please_sign_in":{"message":"Prisijunkite prie \u201eChrome\u201c."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.856464171821628
Encrypted:	false
SSDEEP:	12:YGGYp6nQ11155y9k5hInf6whInf3pRKbqk0R5VR8WO/NrnLAOK:YHYpp11dy9iIdIvpc2ZgWOFvAOK
MD5:	1D21ED2D46338636E24401F6E56E326F
SHA1:	24497EDB25724BC4A57823C5CD06F50DB9647DD4
SHA-256:	434A375C32B8A21C435511C551F740FD4D170EC528A8F4EFC3D798EA4A07B606
SHA-512:	10A870718CC6281EE09DE01900D303B06589D9281C5849D6105C6FCF58BFFA3855F29C6ECA3689FFE6EF304BABCF41C5700EE2D8AFE711D57CB711194366FA6A
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Lietotne pagaid\u0101m nav pieejama."},"craw_connect_to_network":{"message":"L\u016bdzu, izveidojiet savienojumu ar t\u012bklu."},"app_name":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"app_description":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"iap_unavailable":{"message":"Maks\u0101jumi lietotn\u0113s pa\u0161laik nav pieejami."},"please_sign_in":{"message":"L\u016bdzu, pierakstieties p\u0101rl\u016bk\u0101 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\nb\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.804937629013952
Encrypted:	false
SSDEEP:	12:YGGYpB928UZjdyE9iDCiop8682fURHWO/NrnLAOK:YHYpXK/iOiop8NFHWOFvAOK
MD5:	8F0168B9A546D5A99FD8A262C975C80E
SHA1:	B0718071BD0B7251D4459E9C87DF50C14622FBD6
SHA-256:	F03FA7384DF79EBA6E0274D570996030F595A3BF6B781929DD9DB6593262E41F
SHA-512:	A1191CDC496DDD7470BDCFAF186BB9488767159E0CA6A6242D195FA3351704DC8F8BBD03DBEE57D37BBD897C9E8D14B7325FB37D58AC80DEC0F972FF893758B8
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Appen er utilgjengelig for \u00f8yeblikket."},"craw_connect_to_network":{"message":"Du m\u00e5 koble til et nettverk."},"app_name":{"message":"Chrome Nettmarked-betalinger"},"app_description":{"message":"Chrome Nettmarked-betalinger"},"iap_unavailable":{"message":"Betaling i app er ikke tilgjengelig for \u00f8yeblikket."},"please_sign_in":{"message":"Du m\u00e5 logge p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	472
Entropy (8bit):	4.651254944398292
Encrypted:	false
SSDEEP:	12:YGGYpqK5XUoE32GFM2GapUEn7v0WO/NrnLAOK:YHYp/XaLeLapUEgWOFvAOK
MD5:	E7F74DCE7B6411E4E0D95E9252CF74FA
SHA1:	33CC6C73C5F8D0144C0260C2E5A9BD0DB3EF6477
SHA-256:	3564AEF46C01602B19CC29FD8A79676C543427EDE98206D0C91B33AF0CCF3977
SHA-512:	B0987002F8BC4F0B0AC41A87E90BA729464BF2F34D1CC413DD3837019F5F37FD46EB9E9FDABB97F5BDCB50768ABF808AF6E7C531CD7BCA477C71990D2F13335B
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"App momenteel niet beschikbaar."},"craw_connect_to_network":{"message":"Maak verbinding met een netwerk."},"app_name":{"message":"Betalingen via Chrome Web Store"},"app_description":{"message":"Betalingen via Chrome Web Store"},"iap_unavailable":{"message":"In-app-betalingen is momenteel niet beschikbaar."},"please_sign_in":{"message":"Log in bij Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	549
Entropy (8bit):	4.978056737225237
Encrypted:	false
SSDEEP:	12:YGGYpTHlBqHdqcUP5Qp0mAW5Qp0mdpm5Qp0p9JqD2WO/NrnLAOK:YHYpRMdO5bmj5bmdpm5bLJBWOFvAOK
MD5:	E16649D87E4CA6462192CF78EBE543EC
SHA1:	53097D592B13F3C1370366B25024EA72208B136A
SHA-256:	EB435F7460A63576CA1ECB51948E7A3AD5168D2F175AE2B5836D469672923D84
SHA-512:	6EC702CEC6E312CAC6F33109A57F7D83A3F073F2F9A9BD42DB0F91A36F87D800EEB978C69023B6A0E00B86ECE3E1024C269F89D038F0926619F40D075F6689DD
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Aplikacja jest obecnie niedost\u0119pna."},"craw_connect_to_network":{"message":"Po\u0142\u0105cz si\u0119 z sieci\u0105."},"app_name":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"app_description":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"iap_unavailable":{"message":"P\u0142atno\u015bci w ramach aplikacji s\u0105 teraz niedost\u0119pne."},"please_sign_in":{"message":"Zaloguj si\u0119 w Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.734605177119403
Encrypted:	false
SSDEEP:	12:YGGYpGAV9hv3/1PIc6WIc3paIBMMAV+KcIWO/NrnLAOK:YHYpGwLvt5R53pacHw1pWOFvAOK
MD5:	1F4BC8A5EFD59D61127ABEECD4B6CAE3
SHA1:	8647B4D2D643AE4F784ABDDC50D87A39AD02971A
SHA-256:	E1950CBBF056F068EA56160DDB318F3E6232BFBBE096D221C7CA6FCAACE2A8B9
SHA-512:	B58A95BBBC0A16B06826684198B481D2E15A7C760956721C3B538C62C902873A7856F328506457EE66311E45D7A16A4AAAC85B12853AA7EF09780189D28EB3DE
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Aplicativo indispon\u00edvel no momento."},"craw_connect_to_network":{"message":"Conecte-se a uma rede."},"app_name":{"message":"Pagamentos da Chrome Web Store"},"app_description":{"message":"Pagamentos da Chrome Web Store"},"iap_unavailable":{"message":"No momento, os Pagamentos no aplicativo n\u00e3o est\u00e3o dispon\u00edveis."},"please_sign_in":{"message":"Fa\u00e7a login no Google Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.742240430473613
Encrypted:	false
SSDEEP:	12:YGGYpmvMAV9BKx1PIZUFWIZUapITEpBqMAVCWWO/NrnLAOK:YHYpmvMwOxtEUIEUapIITqMwCWWOFvAD
MD5:	D80ECE7E4B3741CD9CD29B89D006B864
SHA1:	8F0D587B78E36861ED00524ABF886FA20E14CAE4
SHA-256:	C8FF9ACAEA1D3B6F8483339CB40F66BC563CCA8DD87F2337F813C492B20F451B
SHA-512:	8A53D9618BBD1A62CD48501E5620932631C1B045612082D99429628D2BF4409AEE3FA695107E82037B5CB332111C456CF3A74235C66B61380CF1E382914F1088
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Aplica\u00e7\u00e3o atualmente indispon\u00edvel."},"craw_connect_to_network":{"message":"Ligue-se a uma rede."},"app_name":{"message":"Pagamentos via Chrome Web Store"},"app_description":{"message":"Pagamentos via Chrome Web Store"},"iap_unavailable":{"message":"Os Pagamentos na app est\u00e3o atualmente indispon\u00edveis."},"please_sign_in":{"message":"Inicie sess\u00e3o no Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.8596885592394505
Encrypted:	false
SSDEEP:	12:YGGYpqOHHEG7PMeH8EPJWb2r9EWJWb2r9RpmJW9FjkUhI3C7PMdWO/NrnLAOK:YHYpbnEG7PjlJBfJBRpmJmBh57PEWOFY
MD5:	D63E66B94A4EA2085D80E76209582FB1
SHA1:	4ECAC3EB64DD6253310A0776E6D42257FC290D77
SHA-256:	91A5AAD210C3E0241106E8821B3897EDEFEC9D85033C94DB2324FF3A5FDE5AC7
SHA-512:	09AC34CF286FD0730EED4F6DB3E2FD00A026D0F42DCC75AE49B045DDAD38DFA38B0FB7823ECAC8B0A9BC2A89F4EAF4BCE081779F2ECDF6CC39286045577DC5C9
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u00cen prezent, aplica\u021bia nu este disponibil\u0103."},"craw_connect_to_network":{"message":"Conecteaz\u0103-te la o re\u021bea."},"app_name":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"app_description":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"iap_unavailable":{"message":"Pl\u0103\u021bile \u00een aplica\u021bie nu sunt disponibile momentan."},"please_sign_in":{"message":"Conecteaz\u0103-te la Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1165
Entropy (8bit):	4.224419823550506
Encrypted:	false
SSDEEP:	24:YHYpNQVFc0BHlbZ0JRiKUG0L6RqQV9zJd0L6RqQV9zJRp00EQVqaQVFc0BRTlPzU:YHYpNQLHFQYKA6wQTz+6wQTz3paQAaQ8
MD5:	22F9E62ABAD82C2190A839851245A495
SHA1:	E7F79BD875918F0D0799DB5F45FAC6297FB66AF7
SHA-256:	9FC1167626C97BCBFDAFF23C6033A44252F89A501AF1DF41C43CB3A994FEB09F
SHA-512:	F577F2F0C344C4E4050AF025A9FB9AC78CADF7FE177F63AB9863826A9808B7FBF5D3363E3B61D7A6DB083EF5EBAC5474D710347B701640AB9C229A3E5D1F0A48
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e."},"craw_connect_to_network":{"message":"\u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u0441\u044c \u043a \u0441\u0435\u0442\u0438."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b."},"

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.850036636276313
Encrypted:	false
SSDEEP:	12:YGGYprMpsgCmIkPJE7ZEWJE7ZRpmJEtMxfAVADJ4ZAvIWO/NrnLAOK:YHYprMFCmvJE7ZfJE7ZRpmJEtMSVGKZo
MD5:	4BBAA10FD00AADBBA3EF6E805E8E1A62
SHA1:	1991901BD6A20C4A7977F09DF30C0CFF0524C504
SHA-256:	906C4F7FDDE15DE4C841E7910BBF14D9175E894BCB244B56E8447A5ADFA5B7AB
SHA-512:	3490F8826E3DB0C8B4FE7B1866DA27F6585ADF52E74392A592A60A916E8A784FF7B92B3DE8985084546D663588369D9BB03FCB25196B7F9C6DF607BEB7DEF010
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Aplik\u00e1cia moment\u00e1lne nie je dostupn\u00e1."},"craw_connect_to_network":{"message":"Pripojte sa k sieti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplik\u00e1cii moment\u00e1lne nie s\u00fa k dispoz\u00edcii."},"please_sign_in":{"message":"Prihl\u00e1ste sa do prehliada\u010da Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	494
Entropy (8bit):	4.7695148367588285
Encrypted:	false
SSDEEP:	12:YGGYpTOEtyPFTEPJEsvmfEWJEsvmfRpmJEiArERfH5/4WO/NrnLAOK:YHYpqoyPRAJEs4fJEs4RpmJEi6AfH5/x
MD5:	F45DE58765A37FD095319D7DEB0F2FB6
SHA1:	B585A485C9BC1982EDF7AE0B9AC73A8E91D41CB5
SHA-256:	8366774AA582035BC7D949F4E28FAEC371C305D01404DF56FFF5A78B4F6ECDB7
SHA-512:	F86334E6E6F90961AD9C8E7DD1A4E923476249469180AC69D9DE59746FE26FAECB585898FC50310380F20CEB0971CA1EB7B55046DA75276840AEA6BAFF574E66
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Aplikacija trenutno ni na voljo."},"craw_connect_to_network":{"message":"Pove\u017eite se z omre\u017ejem."},"app_name":{"message":"Pla\u010dila v spletni trgovini Chrome"},"app_description":{"message":"Pla\u010dila v spletni trgovini Chrome"},"iap_unavailable":{"message":"Pla\u010dila v aplikacijah trenutno niso na voljo."},"please_sign_in":{"message":"Prijavite se v Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.2078334514915685
Encrypted:	false
SSDEEP:	24:YHYpY0f7BxQVnRl5LRO1QV1J0V8aQVEeORbo0V8aQVEeORbIp00V4i0f7BXR2QVj:YHYpV9xQVP5LyQHQQc/QcGpcH9XR2QVj
MD5:	92C1FAC62EB7F92EC3794D4A141BEF32
SHA1:	2AFA41BF51BF9A1089B0B92A9D2DC74299B79813
SHA-256:	9DF154C93B02695AF1CC39F085D9D178EC6AF131A62C2AFC65F125F8F9A5B7AC
SHA-512:	D0709E4F586EAC03548A47D72156CF48D9B4EB9AF9ED8335DF75F541AE1B4172541647EC8BA081965647A9EAE10DB342F87558977BE6075B2D3CC5C3995ED6EE
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u0410\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0458\u0430 \u0458\u0435 \u0442\u0440\u0435\u043d\u0443\u0442\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"craw_connect_to_network":{"message":"\u041f\u043e\u0432\u0435\u0436\u0438\u0442\u0435 \u0441\u0430 \u043c\u0440\u0435\u0436\u043e\u043c."},"app_name":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 Chrome \u0432\u0435\u0431-\u043f\u0440\u043e\u0434\u0430\u0432\u043d\u0438\u0446\u0438"},"app_description":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 Chrome \u0432\u0435\u0431-\u043f\u0440\u043e\u0434\u0430\u0432\u043d\u0438\u0446\u0438"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 \u0430\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0458\u0438 \u0441\u0443 \u0442\u0440\u0435\u043d\u0443\u0442\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"please_sign_in":{"message":"\u041f\u04

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.788896709100935
Encrypted:	false
SSDEEP:	12:YGGYpg6hVGZE3aFMaap8Sp5b6hwUwrdIWO/NrnLAOK:YHYpg6hPaeaap8Sr6hwXIWOFvAOK
MD5:	6E1BE9CEE29818E54E3D1C7D483DD6F7
SHA1:	B9DD926B60E225C5BE8A1DBB7EF3ACE422A204A9
SHA-256:	E348583D8C53F4A5DEC4551DA93785C17108466E427E06F84708AA383EA0E326
SHA-512:	3ADB32C0F098E064B774E7E7F615F54C44ADFB3BFC554B06A17048C6077C5885D42BD89F6733D64D65EA1785033B36B386EF0B6661FD539855484EA5A2900BB7
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Appen \u00e4r inte tillg\u00e4nglig f\u00f6r tillf\u00e4llet."},"craw_connect_to_network":{"message":"Anslut till ett n\u00e4tverk."},"app_name":{"message":"Betalning via Chrome Web Store"},"app_description":{"message":"Betalning via Chrome Web Store"},"iap_unavailable":{"message":"Betalning i appen \u00e4r inte tillg\u00e4ngligt f\u00f6r n\u00e4rvarande."},"please_sign_in":{"message":"Logga in i Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	4.09652661599029
Encrypted:	false
SSDEEP:	24:YHYpqQV8k6Nvgnd0BQV3d0BQV5pWdPiWdBy7MIoWOFvAOK:YHYpqQ+k6NUaBQlaBQXpW3dBUMIehQ
MD5:	283D5177FB2FC7082967988E2683EC7C
SHA1:	DEDE43967F3CEF9D9325F140872A63BFCE2AA8C5
SHA-256:	E8D5820BDE31B66A7641068FDEDD1A5F20C1A783460B98887A670F38422099CF
SHA-512:	74413C00C58B7136038D4C41D5C7C79EC02A9830779ABB719D72536B74C5E338B1548A20290559FB3F4E2A938B728CF99041050DD1970848EE9A6590EB0AB3E4
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u0e44\u0e21\u0e48\u0e2a\u0e32\u0e21\u0e32\u0e23\u0e16\u0e43\u0e0a\u0e49\u0e07\u0e32\u0e19\u0e41\u0e2d\u0e1b\u0e44\u0e14\u0e49\u0e43\u0e19\u0e02\u0e13\u0e30\u0e19\u0e35\u0e49"},"craw_connect_to_network":{"message":"\u0e42\u0e1b\u0e23\u0e14\u0e40\u0e0a\u0e37\u0e48\u0e2d\u0e21\u0e15\u0e48\u0e2d\u0e01\u0e31\u0e1a\u0e40\u0e04\u0e23\u0e37\u0e2d\u0e02\u0e48\u0e32\u0e22"},"app_name":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e02\u0e2d\u0e07 Chrome \u0e40\u0e27\u0e47\u0e1a\u0e2a\u0e42\u0e15\u0e23\u0e4c"},"app_description":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e02\u0e2d\u0e07 Chrome \u0e40\u0e27\u0e47\u0e1a\u0e2a\u0e42\u0e15\u0e23\u0e4c"},"iap_unavailable":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e43\u0e19\u0e41\u0e2d\u0e1b\u0e1e\u0e25\u0e34\u0e40\u0e04\u0e0a\u0e31\u0e19\u0e44\u0e21\u0e48\u0e1e\u0e23\u0e49\u0e2d\u0e21\u0e4

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	572
Entropy (8bit):	4.93347615778905
Encrypted:	false
SSDEEP:	12:YGGYpFh852XmYG45SfVVh5SX8pFBkw452kK/O/NrnLAOK:YHYpFhJ2Y95AJ5I8pFhlkwOFvAOK
MD5:	1BF2AA4BB904B406C9C2B7DF769BB540
SHA1:	8D29C4B7A79AB0657747CA194D1934292A46D2A8
SHA-256:	0F2E8285BA3E2BDBA6B16435FB941B07159AACFAC80196AD5941B79AB52B712A
SHA-512:	0DF48AE0A518A940489E91D8A0D6E7E47A3153747358E06CD792BFA3D826F47FA1502268F602E7D7EDFC1C111AEB3FAF0E67F845986DDA77E2FC4B3336BCF46C
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"Uygulama \u015fu anda kullan\u0131lam\u0131yor."},"craw_connect_to_network":{"message":"L\u00fctfen bir a\u011fa ba\u011flan\u0131n."},"app_name":{"message":"Chrome Web Ma\u011fazas\u0131 \u00d6demeleri"},"app_description":{"message":"Chrome Web Ma\u011fazas\u0131 \u00d6demeleri"},"iap_unavailable":{"message":"Uygulama \u0130\u00e7i \u00d6demeler \u015fu anda kullan\u0131lamaz."},"please_sign_in":{"message":"L\u00fctfen Chrome'da oturum a\u00e7\u0131n."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	4.268588181103308
Encrypted:	false
SSDEEP:	24:YHYpNQVVQVrll5eN7jAQVF0Zz0id0Zz0iRp00AQVqaQVVQVSMQVvjlkYHA1RnWOi:YHYpNQPQZ75exkQAz0/z00p2QAaQPQQN
MD5:	FD1C9890679036E1AD914218753B1E8E
SHA1:	58160F7A0FC94110A2876223E406A517C8E2660B
SHA-256:	39D19CC3387FFCE13A8F11DAD72E2FCBB7CD1A4367EC699AD7C40D6F52ECE717
SHA-512:	03E81C398EE6A5DC65A40CA07E1A4CBEC2662D2C151A76C9ECB813587D672AC71311C39C5C5DA8A1AE78A3A6CE3938609D1365F7819424FC34289C7743DF00D2
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u0430 \u0442\u0438\u043c\u0447\u0430\u0441\u043e\u0432\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"craw_connect_to_network":{"message":"\u041f\u0456\u0434\u2019\u0454\u0434\u043d\u0430\u0439\u0442\u0435\u0441\u044f \u0434\u043e \u043c\u0435\u0440\u0435\u0436\u0456."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0412\u0435\u0431-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0443 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0412\u0435\u0431-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0443 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u0443 \u0437\u0430\u0440\u0430\u0437 \u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0456."},"please_sign_in":{"message":"\u0423\u0432\u0456\u0439\u0434\u0456\u0442\u044c \u0443

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.846531831162704
Encrypted:	false
SSDEEP:	12:YGGYpqp80NORWLNiNI2k8yypSNiNI2k8yy+piNiNI2miI80NO5WO/NrnLAOK:YHYpmvNcCgWgUpudiIvN6WOFvAOK
MD5:	7D52E9357AB847B4CC8DBC8CC4DA93F5
SHA1:	AF877F3992D8056C8F08462BD575595BF79FE5B0
SHA-256:	313F71F3FFDCEFC76FC746FF2029FBF8FBE38BD83DCF952FC3DDCD8AA96D5CFB
SHA-512:	E66E7FACDF35A0F72AC61DEAAEC43A2DAC976CADEA146EBE3E90E739178F173E32ADCF909F05F2657F2AD66E2ECB6015F6733CEA4B9E42337246469F89D3A12F
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u1ee8ng d\u1ee5ng hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng."},"craw_connect_to_network":{"message":"Vui l\u00f2ng k\u1ebft n\u1ed1i v\u1edbi m\u1ea1ng."},"app_name":{"message":"Thanh to\u00e1n tr\u00ean c\u1eeda h\u00e0ng Chrome tr\u1ef1c tuy\u1ebfn"},"app_description":{"message":"Thanh to\u00e1n tr\u00ean c\u1eeda h\u00e0ng Chrome tr\u1ef1c tuy\u1ebfn"},"iap_unavailable":{"message":"Thanh to\u00e1n trong \u1ee9ng d\u1ee5ng hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng."},"please_sign_in":{"message":"Vui l\u00f2ng \u0111\u0103ng nh\u1eadp v\u00e0o Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	602
Entropy (8bit):	4.917339139635893
Encrypted:	false
SSDEEP:	12:YGGYpqrL0MdI1i1kovbdKD/vbdKopqIQfvJ19KhO/NrnLAOK:YHYpMLfjvsTvsop3QPAOFvAOK
MD5:	393680A09DEE0CB9046A62BDC0750B74
SHA1:	54E7F8215061A4AB241B87AE4E81C8F860EB2C2B
SHA-256:	D5FB52C2897FD5C294784DB63C933AC77C609D10AC91431CCB295D87452CBEE6
SHA-512:	14C214CAEFC69B085E918F492C75E2A48BC6A9C2D347D29403B26E69A474825E302A3E106710E5C04E047BD57EE684A67846A5DE956705FFBF41BB0614B8CEB2
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u5e94\u7528\u76ee\u524d\u65e0\u6cd5\u4f7f\u7528\u3002"},"craw_connect_to_network":{"message":"\u8bf7\u8fde\u63a5\u5230\u7f51\u7edc\u3002"},"app_name":{"message":"Chrome \u7f51\u4e0a\u5e94\u7528\u5e97\u4ed8\u6b3e\u7cfb\u7edf"},"app_description":{"message":"Chrome \u7f51\u4e0a\u5e94\u7528\u5e97\u4ed8\u6b3e\u7cfb\u7edf"},"iap_unavailable":{"message":"\u76ee\u524d\u65e0\u6cd5\u4f7f\u7528\u5e94\u7528\u5185\u4ed8\u6b3e\u3002"},"please_sign_in":{"message":"\u8bf7\u767b\u5f55 Chrome\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	680
Entropy (8bit):	4.916281462386558
Encrypted:	false
SSDEEP:	12:YGGYpqI8ROuDWMg0kP2uD/vbd8Em2uD/vbd8RpqI8RauDRsXwvC/KhO/NrnLAOK:YHYp38suDUSuD/v2OuD/v2Rp38cuDGbq
MD5:	CD30D132A7213FC1B7E03C6D0A49CCF7
SHA1:	1141DED39023B821FE9BB4682E0D1EB5469DAF76
SHA-256:	5717F13D10E63255947F750C79CBB6BD04A6D97A08261E8D5764AF5EB0561A28
SHA-512:	0DCD3CEB93AB58655551B00D7AD4FE4A6F1F6B24EDD31244FF9B57AE529BF1A9E0220A6258C64790F9CC9F026AB9DA3AEE1575809CC94DC4F8754194C958FD19
Malicious:	false
Reputation:	low
Preview:	{"craw_app_unavailable":{"message":"\u76ee\u524d\u7121\u6cd5\u4f7f\u7528\u9019\u500b\u61c9\u7528\u7a0b\u5f0f\u3002"},"craw_connect_to_network":{"message":"\u8acb\u9023\u4e0a\u7db2\u8def\u3002"},"app_name":{"message":"Chrome \u7dda\u4e0a\u61c9\u7528\u7a0b\u5f0f\u5546\u5e97\u4ed8\u6b3e\u7cfb\u7d71"},"app_description":{"message":"Chrome \u7dda\u4e0a\u61c9\u7528\u7a0b\u5f0f\u5546\u5e97\u4ed8\u6b3e\u7cfb\u7d71"},"iap_unavailable":{"message":"\u76ee\u524d\u7121\u6cd5\u4f7f\u7528\u61c9\u7528\u7a0b\u5f0f\u5167\u4ed8\u6b3e\u529f\u80fd\u3002"},"please_sign_in":{"message":"\u8acb\u767b\u5165 Chrome\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.919185521409901
Encrypted:	false
SSDEEP:	24:BeVvlH141v5GFqeq7x7S4dudxNfN3IFKrGQZDN4:QVNVgvLecJSR1Y8r5ZW
MD5:	6CA25F3EF585B63F01BCDF8635120704
SHA1:	00C063811E31EA5F9A00F175A71EA25E7821F621
SHA-256:	49D9DE983F7436BA786E6E04A5A20C10F41687AE06B266B1B6553F696719563D
SHA-512:	566BFD9BADBD8951EE52E5911EB68B51E86286989096D32DE6E32A2523761B0E0AFCA251EF3BEA36B5D51FB8354A5FCA567772A02C3F3B9D8DFE529609FA0430
Malicious:	false
Reputation:	low
Preview:	{."update_url": "https://clients2.google.com/service/update2/crx",.. "name": "__MSG_APP_NAME__",. "description": "__MSG_APP_DESCRIPTION__",. "manifest_version": 2,. "version": "1.0.0.6",. "minimum_chrome_version": "29",. "default_locale": "en",. "app": {. "background": {. "scripts": [. "craw_background.js". ]. }. },. "permissions": [. "identity",. "webview",. "https://www.google.com/",. "https://www.googleapis.com/*",. "https://payments.google.com/payments/v4/js/integrator.js",. "https://sandbox.google.com/payments/v4/js/integrator.js". ],. "oauth2": {. "auto_approve": true,. "scopes": [. "https://www.googleapis.com/auth/sierra",. "https://www.googleapis.com/auth/sierrasandbox",. "https://www.googleapis.com/auth/chromewebstore",. "https://www.googleapis.com/auth/chromewebstore.readonly". ],. "client_id": "203784468217.apps.googleusercontent.com". },. "icons": {. "16": "images/icon_16.png",. "128

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\b0d81eef-34e6-41e6-80c7-6ea91f55978c.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Reputation:	low
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

Timestamp	Protocol	SID	Message	Source IP	Dest IP
04/01/22-17:31:49.921853	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:31:53.922311	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:31:57.937847	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:01.908838	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:05.909057	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:09.909604	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:15.936682	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:20.101944	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:23.929340	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:27.982241	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:31.927598	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:35.953839	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:40.038226	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:43.921126	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:47.923080	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:51.918546	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254
04/01/22-17:32:55.945909	ICMP	384	ICMP PING	192.168.2.6	8.248.131.254

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 1, 2022 17:32:01.089381933 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.089415073 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.089510918 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.097479105 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.097520113 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.097721100 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.098432064 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.098459959 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.100384951 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.100414991 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.115976095 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.116027117 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.116158009 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.116821051 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.116842985 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.117341042 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.117372036 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.117448092 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.117726088 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.117743969 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.155973911 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.157409906 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.157444954 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.157807112 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.157897949 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.158827066 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.159023046 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.163333893 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.203704119 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.212120056 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.212136030 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.214405060 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.214471102 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.214514017 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.254756927 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.468144894 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.468358040 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.468416929 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.468440056 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.468452930 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.468580008 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.468677998 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.468704939 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.502739906 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.502852917 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.502882957 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.502911091 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.502983093 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.504426956 CEST	49770	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:01.504455090 CEST	443	49770	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:01.508631945 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.508661032 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.523371935 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.523561001 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.525211096 CEST	49771	443	192.168.2.6	142.250.203.109
Apr 1, 2022 17:32:01.525243044 CEST	443	49771	142.250.203.109	192.168.2.6
Apr 1, 2022 17:32:01.695306063 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.696367979 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.696571112 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.696599960 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.697758913 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.697772026 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.697817087 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.697843075 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.699074030 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.699168921 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.700658083 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.700759888 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.700934887 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.700952053 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.701122046 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.701242924 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.742796898 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.742835999 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:01.782998085 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:01.794219017 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.069041014 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.069224119 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.069298029 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.096637964 CEST	49772	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.096681118 CEST	443	49772	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.099076986 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.142193079 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.289227009 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.289256096 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.289263010 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.289318085 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.289335966 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.289345980 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.289515972 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.289565086 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.289589882 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.290150881 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.422796011 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.422859907 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.423104048 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.423367977 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.423393965 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.424151897 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.424190998 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.424304962 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.424524069 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.424551010 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.425451994 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.425503016 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.425596952 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.425997972 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.426028013 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.426668882 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.426697969 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.426852942 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.427391052 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.427427053 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.427711964 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.427737951 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.427906036 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.427938938 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.427947998 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.478523016 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.478554010 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.478630066 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.478720903 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.478750944 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.478758097 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.478769064 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.478806019 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.478837013 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.478859901 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.479018927 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.479032040 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.479114056 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.479173899 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.519543886 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.519629002 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.519746065 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.519831896 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.520323038 CEST	49773	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.520380020 CEST	443	49773	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.520982981 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.521023035 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.521327019 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.521714926 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:02.521728992 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:02.997270107 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.000422955 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.001708984 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.004159927 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.005604982 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.029330969 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.029361010 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.029541016 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.029587984 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.029948950 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.030670881 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.030687094 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.030752897 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.044655085 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.046200037 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.048952103 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.049016953 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.049139023 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.049160004 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.049345016 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.049359083 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.049613953 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.050384045 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.050875902 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.050982952 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.051021099 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.051163912 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.051307917 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.051749945 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.053000927 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.053056955 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.053265095 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.058595896 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.058751106 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.060281992 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.060475111 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.060972929 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.061074972 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.061103106 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.061105967 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.061171055 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.061290979 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.061377048 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.061393023 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.061590910 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.061606884 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.100492954 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.102199078 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.102211952 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.104403019 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.131460905 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.131488085 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.133672953 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.133706093 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.133816957 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.135168076 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.135349989 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.135382891 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.179979086 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.180000067 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.194643974 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.195486069 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.221693039 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.377784014 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.377847910 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.377867937 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.377913952 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.377955914 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.377978086 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.378024101 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.378045082 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.378055096 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.378106117 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.390928030 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.390952110 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.390969992 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.391041040 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.391200066 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.391233921 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.393959045 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394057035 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394081116 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394088984 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394103050 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394129992 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394227028 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.394265890 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394279003 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.394315004 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.394629002 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394640923 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394665956 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394711018 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394718885 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394777060 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.394800901 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394835949 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394841909 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.394881964 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.394890070 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.394908905 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.394979954 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.395049095 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.423724890 CEST	49778	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.423763990 CEST	443	49778	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.424175024 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.424237013 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.424379110 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.425499916 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.425533056 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.434650898 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.437721014 CEST	49780	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.437756062 CEST	443	49780	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.438617945 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.438673973 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.438803911 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.439543009 CEST	49781	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.439575911 CEST	443	49781	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.440196037 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.440222025 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.440360069 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.453375101 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.453423977 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.454371929 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.454395056 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.486583948 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.486624956 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.486639977 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.486705065 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.486727953 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.486738920 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.486747980 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.486778021 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.486846924 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.486860037 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.567681074 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567707062 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567758083 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567796946 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567814112 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567815065 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.567847967 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567854881 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.567868948 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567881107 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.567888975 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567903996 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567913055 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.567923069 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567934036 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.567946911 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.567981005 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.587913036 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.587930918 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.587980032 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588035107 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588042974 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588082075 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588138103 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.588175058 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.588192940 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588284016 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588293076 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588335037 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588474035 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588481903 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588521004 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.588536978 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588562965 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.588570118 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.588821888 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.678296089 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.678308964 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.678426981 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.678483963 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.678495884 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.678500891 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.716140985 CEST	49782	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.716197968 CEST	443	49782	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.718286991 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.718369961 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.718795061 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.718843937 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.718858957 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758519888 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758548975 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758567095 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758646965 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.758655071 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758733988 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.758765936 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758826971 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758838892 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.758850098 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758903027 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.758913040 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758936882 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.758944988 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758972883 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.758987904 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.759008884 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.759023905 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.759032011 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.759068012 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.759129047 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.759155035 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.759171963 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.759190083 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.759243011 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.759258986 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.780654907 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.780834913 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.780877113 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.780944109 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.781239986 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.781371117 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.781383038 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.781502962 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.781786919 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.781910896 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.781974077 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.782064915 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.782242060 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.782340050 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.782459021 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.782543898 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.782645941 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.782726049 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.948260069 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.948354959 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.948426008 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.948437929 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.948462009 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.948503017 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.948575974 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.948657036 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.951406002 CEST	49779	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.951450109 CEST	443	49779	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.973977089 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.974078894 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.974091053 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.974107981 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.974170923 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.974217892 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.974570990 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.974697113 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.976412058 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.976497889 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.976511002 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.976525068 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.976567984 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.976629019 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.976691008 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.976710081 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.976722002 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.976767063 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.976773977 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.976826906 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.976835966 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.976840973 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.976891041 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977180958 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.977288008 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977322102 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.977437973 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.977469921 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977483034 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.977509975 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977540970 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977596045 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.977684021 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977690935 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.977704048 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.977770090 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977797031 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977874041 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.977955103 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:03.977991104 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:03.978076935 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.009536028 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.018652916 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.018682003 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.019598007 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.020267010 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.020453930 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.021155119 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.022201061 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.022628069 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.022675991 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.023361921 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.025646925 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.025821924 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.025823116 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.036457062 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.036962986 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.036978960 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.039135933 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.039257050 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.045963049 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.046183109 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.046322107 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.066205978 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167119980 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167273998 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167310953 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.167330980 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167403936 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167726040 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.167747974 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167767048 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167840958 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.167853117 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167900085 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.167920113 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.167985916 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.168015003 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.168119907 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.175870895 CEST	49777	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.175904989 CEST	443	49777	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.194375038 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.194391012 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.199532986 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.199548960 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.262186050 CEST	49791	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.262232065 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.262531996 CEST	49791	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.276664972 CEST	49791	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.276690006 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.277021885 CEST	49792	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.277080059 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.277267933 CEST	49792	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.277532101 CEST	49792	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.277566910 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.294090033 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.302320957 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.302768946 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.302794933 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.304614067 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.304781914 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.305310011 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.305434942 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.305469036 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.350191116 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.397147894 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.397185087 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.397906065 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.397942066 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.397952080 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.398034096 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.398597002 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.398623943 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.398632050 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.398644924 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.398751974 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.398782969 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.398833990 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.398859024 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.399082899 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.399101973 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.399178028 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.399208069 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.399228096 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.399261951 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.422504902 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.422566891 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.422581911 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.422611952 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.422642946 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.422651052 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.422661066 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.422696114 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.422724009 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.422732115 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.422770023 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.426120996 CEST	49785	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.426181078 CEST	443	49785	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.426793098 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.426835060 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.426919937 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.427648067 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.427664995 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.497201920 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.497257948 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.587244987 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587263107 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587332964 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587342024 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587393999 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587428093 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.587430954 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587485075 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.587487936 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587532043 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.587548971 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587589979 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.587609053 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.587644100 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.598020077 CEST	49786	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.598059893 CEST	443	49786	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.615961075 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.615986109 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616025925 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616087914 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.616112947 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616142988 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616159916 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.616169930 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616184950 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616185904 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.616203070 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.616247892 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.616274118 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616301060 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616313934 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616343021 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.616440058 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.616467953 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.616497040 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.619785070 CEST	49787	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.619807959 CEST	443	49787	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.689671040 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.689711094 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.689722061 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.689801931 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.689830065 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.689861059 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.689873934 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.689891100 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.689899921 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.689903975 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.689925909 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.690011024 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.847760916 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.849431038 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.850693941 CEST	49791	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.850719929 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.850860119 CEST	49792	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.850892067 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.851114988 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.851315975 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.851943016 CEST	49791	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.852021933 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.853111982 CEST	49792	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.853244066 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.853310108 CEST	49791	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.853374958 CEST	49792	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.883167982 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.883191109 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.883236885 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.883266926 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.883284092 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.883297920 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.883342028 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.883367062 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.883382082 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.883441925 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.894186974 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.894207954 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.927275896 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.927298069 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.927361965 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.927452087 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.927464008 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.992959976 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.996834993 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.996861935 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.997335911 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.997935057 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:04.998045921 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:04.998115063 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.038183928 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076142073 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076164961 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076343060 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076356888 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076431036 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.076440096 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076447010 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.076448917 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.076456070 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076493025 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076509953 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.076651096 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.076724052 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.076735973 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.076746941 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.094182968 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.120594978 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.120671988 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.120780945 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.120790958 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.121007919 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.121346951 CEST	49790	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.121387959 CEST	443	49790	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.229058027 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.229166985 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.229275942 CEST	49792	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.237617016 CEST	49792	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.237653971 CEST	443	49792	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.386959076 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.386990070 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.387001991 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.387034893 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.387056112 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.387068033 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.387120962 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.387150049 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.387164116 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.387193918 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.574668884 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574688911 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574729919 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574769020 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574784994 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574795961 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574839115 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574843884 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.574851990 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574892998 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574935913 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.574950933 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.574976921 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.694639921 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.731976032 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.732058048 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.732399940 CEST	49791	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.734426022 CEST	49791	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.734450102 CEST	443	49791	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.742501020 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.742543936 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.743187904 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.743520975 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.743534088 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762463093 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762495995 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762566090 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762603998 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762626886 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.762643099 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762650013 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.762687922 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.762689114 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762723923 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762732983 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.762753010 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762772083 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762785912 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.762855053 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762865067 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.762875080 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762890100 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762969971 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.762979984 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.763006926 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.763019085 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.763046026 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.763051987 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.763082027 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.763082981 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.763103008 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.763113976 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.763170004 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.763175964 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.763236046 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.949748039 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.949841022 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.949981928 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950004101 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950025082 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950397968 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950453997 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950458050 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950474977 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950490952 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950520039 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950531006 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950546980 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950555086 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950575113 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950587988 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950639963 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950653076 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950680017 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.950705051 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.950732946 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.953246117 CEST	49793	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.953273058 CEST	443	49793	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.958760977 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.958808899 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.958944082 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.959294081 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.959314108 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.968033075 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.968072891 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.968152046 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.968381882 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.968394995 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.989121914 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:05.989162922 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:05.989249945 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.000432968 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.000466108 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.322005987 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.322720051 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.322743893 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.323103905 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.323901892 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.324002028 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.324065924 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.370188951 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.394682884 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.534348965 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.534887075 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.534929991 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.535351992 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.535944939 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.536066055 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.536096096 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.538144112 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.539144993 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.539170027 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.542561054 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.542704105 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.543337107 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.543504953 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.543521881 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.543553114 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.582195044 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.585597992 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.592278004 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.592309952 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.595572948 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.595714092 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.596654892 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.596829891 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.596839905 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.598071098 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.598077059 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.598093033 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.638202906 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.694736004 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.694756031 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.697873116 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.707472086 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.707529068 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.707539082 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.707581043 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.707602978 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.707613945 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.707658052 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.707674026 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.707686901 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.707731009 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.794711113 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.898968935 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.898987055 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.899030924 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.899101973 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.899133921 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.914993048 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.915019035 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.915024996 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.915062904 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.915081024 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.915088892 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.915138006 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.915159941 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.915338993 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.916177988 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.916223049 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.916342020 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.916343927 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.916435957 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.928359985 CEST	49796	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.928396940 CEST	443	49796	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.970751047 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.970808983 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.970932961 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:06.970941067 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:06.971009016 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.088541031 CEST	49797	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.088579893 CEST	443	49797	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.090401888 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.090425014 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.090476036 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.090488911 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.090527058 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.090593100 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.090604067 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.090658903 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.105190992 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.105205059 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.105370045 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.105385065 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.105386972 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.105417967 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.105437040 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.105470896 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.105479956 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.105484009 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.105513096 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.105530977 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.105571985 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.148426056 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.148451090 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.148561954 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.148611069 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.281975031 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.281996012 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.282058001 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.282149076 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.282181025 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.282283068 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.282305956 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.282352924 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.282360077 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.282370090 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.282408953 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.282442093 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.282531023 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.295593977 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.295766115 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.295820951 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.295856953 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.295877934 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.295932055 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.296050072 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.296171904 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.296340942 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.296477079 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.296602011 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.296739101 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.296925068 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.297035933 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.297163963 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.297270060 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.325866938 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.326080084 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.474158049 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.474287033 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.474345922 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.474365950 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.474391937 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.474411964 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.474457026 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.474529028 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.474668980 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.474706888 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.474740028 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.474752903 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.474793911 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.474843025 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.474900961 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.487339973 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.487467051 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.487494946 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.487515926 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.487555981 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.487586021 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.487662077 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.487755060 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.487935066 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488076925 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488080025 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488106966 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488148928 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488193035 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488261938 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488281965 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488351107 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488353014 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488365889 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488426924 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488455057 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488512039 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488559961 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488598108 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488883018 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.488984108 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.488996029 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.489017963 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.489125013 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.489142895 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.489211082 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.489226103 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.489263058 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.489335060 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.489346981 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.489372015 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.489434958 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.489448071 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.489634037 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.534794092 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.534975052 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.551757097 CEST	49794	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.551784039 CEST	443	49794	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.677495003 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.677637100 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.677696943 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.677725077 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.677831888 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.677843094 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.678000927 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.678077936 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.678091049 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.678106070 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.678167105 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.678303957 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.678400993 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.678411961 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.678658962 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.678747892 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.678759098 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.678852081 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.678966045 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.678980112 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.679230928 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.679315090 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.679351091 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.679371119 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.679438114 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.679505110 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.679589987 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.683406115 CEST	49795	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.683453083 CEST	443	49795	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.786475897 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.786530972 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.786622047 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.786988020 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.787017107 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.788594961 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.788630962 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.788722992 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.789052010 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.789077997 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.842135906 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.842217922 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.842798948 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.842840910 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.842854023 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.850128889 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.850159883 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.850255013 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.850858927 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.850886106 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.851016998 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.851033926 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.851149082 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.851278067 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.851290941 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.852108002 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.852135897 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:07.852237940 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.852859020 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:07.852875948 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.364248037 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.364656925 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.364686966 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.365032911 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.365613937 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.365742922 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.365849972 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.367000103 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.367364883 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.367387056 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.367659092 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.368572950 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.368662119 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.368735075 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.408780098 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.410186052 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.410193920 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.421104908 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.421699047 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.421720982 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.425379992 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.425522089 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.426743984 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.427057028 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.427920103 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.428042889 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.428415060 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.428428888 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.431082964 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.431376934 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.431401014 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.431813955 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.432080030 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.432502985 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.432512999 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.432579994 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.432585001 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.432684898 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.432960987 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.433003902 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.434559107 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.434659004 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.435307026 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.435415030 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.435527086 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.435702085 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.436428070 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.436569929 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.436634064 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.436657906 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.436738014 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.436765909 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.476880074 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.499463081 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.499480009 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.499547005 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.499634027 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.499644995 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.599240065 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.600948095 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.741436005 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.741472006 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.741586924 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.741605997 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.746697903 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.746822119 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.746944904 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.755454063 CEST	49802	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.755479097 CEST	443	49802	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.763484955 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.763513088 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.764215946 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.764245033 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.764343977 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.764616966 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.764631033 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.802687883 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.802788973 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.802882910 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.804629087 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.804666996 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.804766893 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.804785013 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.805023909 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.812179089 CEST	49804	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.812213898 CEST	443	49804	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.813249111 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.813277960 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.813360929 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.813386917 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.813544035 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.820482969 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.820590019 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.820693016 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.829169035 CEST	49807	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.829209089 CEST	443	49807	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.831974030 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.831999063 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.832072973 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.832355976 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.832369089 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.834796906 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.834830046 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.834959984 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.835886955 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.835896015 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.836848974 CEST	49808	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.836882114 CEST	443	49808	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.838198900 CEST	49806	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.838227987 CEST	443	49806	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.953660011 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.953738928 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.953773022 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.953782082 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.953804970 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.953843117 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:08.953851938 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:08.954037905 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.142781973 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.142846107 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.142913103 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.142916918 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.142940044 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.142960072 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.142992973 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.143018007 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.152744055 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.152764082 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.343386889 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.347920895 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.348366022 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.348404884 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.349597931 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.350677013 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.350883961 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.350972891 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.351037025 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.351520061 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.394196987 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.416639090 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.418453932 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.426820040 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.426862001 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.427176952 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.427215099 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.428349018 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.428908110 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.429095984 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.429732084 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.429842949 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.430721998 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.430891991 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.470254898 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.540999889 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.541182041 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.541215897 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.541340113 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.541347980 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.541379929 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.541450024 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.541493893 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.541549921 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.541676998 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.541825056 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.541939020 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.541985035 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.542088032 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.542100906 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.542123079 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.542201042 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.542222977 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.599508047 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.599540949 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.729964972 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.730079889 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.730451107 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.730474949 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.730650902 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.731057882 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.731070042 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.731301069 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.734832048 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.734877110 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.734944105 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.734977961 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.734997034 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.735008001 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.735047102 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.757486105 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.757517099 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.799648046 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.928190947 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.928277016 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.928363085 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.928385973 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.928401947 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.928425074 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.928447008 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.928453922 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.928488016 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.928582907 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.928633928 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.929989100 CEST	49809	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.930011988 CEST	443	49809	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.944515944 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.946754932 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.956965923 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:09.956990957 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:09.986186981 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.138724089 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.155389071 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.155402899 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.155498028 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.155565977 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.155582905 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.155589104 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.155642986 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.156362057 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.156467915 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.156537056 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.156610012 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.156620026 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.180783987 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.180814981 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.190334082 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.190368891 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.198246002 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.520133972 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.520190954 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.520307064 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.520411968 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.520462036 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.520550966 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.523170948 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.523241043 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.523247004 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.523272038 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.643028975 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.680865049 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.680897951 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.882764101 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.883829117 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.883958101 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.888382912 CEST	49810	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.888410091 CEST	443	49810	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:10.975568056 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:10.975610971 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.108644962 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.108757019 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.127890110 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.128062963 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.165879965 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.165910006 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166054964 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166090012 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166100979 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166138887 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166162014 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166187048 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166203022 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166219950 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166277885 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166297913 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166328907 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166337013 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166344881 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166420937 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166429043 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166451931 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166486025 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166532993 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166555882 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166610003 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.166789055 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:11.166807890 CEST	443	49803	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:11.167143106 CEST	49803	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:15.860501051 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:15.860551119 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:15.861356020 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:15.861512899 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:15.918833971 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:15.966231108 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.060355902 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.060389042 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.061049938 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.061148882 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.068033934 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.071181059 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.110196114 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.114198923 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.117048025 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.117072105 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.117131948 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.117197990 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.117248058 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.198558092 CEST	49818	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.198596954 CEST	443	49818	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.207140923 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.207191944 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.207281113 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.250314951 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.250366926 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.259999990 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.260071039 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.260143042 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.260190010 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.263076067 CEST	49819	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.263097048 CEST	443	49819	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.263499022 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.263559103 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.263653994 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.263916969 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.263942957 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.269690037 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.269823074 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.269963980 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.273150921 CEST	49811	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.273174047 CEST	443	49811	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.835635900 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.835717916 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.836337090 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.836360931 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.836774111 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.836878061 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.838181973 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.838219881 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.842196941 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.842206001 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:16.843647003 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:16.843657017 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.220133066 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.220164061 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.220238924 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.220242977 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.220261097 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.220309019 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.222436905 CEST	49821	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.222467899 CEST	443	49821	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.223278999 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.223303080 CEST	443	49822	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.223373890 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.223587990 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.223598003 CEST	443	49822	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.241509914 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.241548061 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.241602898 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.241626978 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.241632938 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.241637945 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.241869926 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.244194984 CEST	49820	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.244216919 CEST	443	49820	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.245579004 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.245608091 CEST	443	49823	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.246005058 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.246030092 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.246037960 CEST	443	49823	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.513087988 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.513171911 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.513266087 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.513839960 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.513876915 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.572639942 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.573120117 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.573148966 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.573504925 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.573590994 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.574490070 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.574615955 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.588956118 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.589092016 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.589205027 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.589222908 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.608920097 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.608999968 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.609015942 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.609039068 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.609082937 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.609534979 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.610634089 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.610708952 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.610743046 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.610758066 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.610810995 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.611701012 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.612845898 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.612917900 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.612931013 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.612943888 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.612989902 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.613936901 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.615017891 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.615082979 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.615134954 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.615147114 CEST	443	49824	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:17.615201950 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.618000984 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.618036032 CEST	49824	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:17.792813063 CEST	443	49822	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.792960882 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.831044912 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.831064939 CEST	443	49822	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.832942963 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.832954884 CEST	443	49822	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.836795092 CEST	443	49823	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.836877108 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.896862984 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.896887064 CEST	443	49823	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:17.898549080 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:17.898575068 CEST	443	49823	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.173538923 CEST	443	49822	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.173654079 CEST	443	49822	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.173734903 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.173796892 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.176305056 CEST	49822	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.176350117 CEST	443	49822	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.176706076 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.176757097 CEST	443	49826	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.176882982 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.177632093 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.177660942 CEST	443	49826	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.230051994 CEST	443	49823	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.230123043 CEST	443	49823	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.230197906 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.230422974 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.232734919 CEST	49823	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.232773066 CEST	443	49823	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.233149052 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.233196974 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.233282089 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.233494997 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.233516932 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.771836996 CEST	443	49826	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.772211075 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.774215937 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.774230957 CEST	443	49826	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.775917053 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.775928020 CEST	443	49826	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.821388006 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.821475983 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.821975946 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.821985006 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:18.823975086 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:18.823987961 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.160897970 CEST	443	49826	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.160990000 CEST	443	49826	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.161197901 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.161214113 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.202204943 CEST	49826	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.202239037 CEST	443	49826	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.203391075 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.203427076 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.203556061 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.203789949 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.203807116 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.233381033 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.233413935 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.233481884 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.233491898 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.233514071 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.233563900 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.235645056 CEST	49828	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.235661983 CEST	443	49828	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.236767054 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.236799955 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.237281084 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.238178968 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.238207102 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.789315939 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.789395094 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.811044931 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.811053991 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.819761038 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.819772005 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.836347103 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.836477041 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.847028017 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.847047091 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:19.848817110 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:19.848834038 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.183460951 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.183492899 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.183562040 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.183594942 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.183628082 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.191740036 CEST	49831	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.191788912 CEST	443	49831	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.192419052 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.192466021 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.192553997 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.192878962 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.192893982 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.229342937 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.229381084 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.229470968 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.229492903 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.229538918 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.304022074 CEST	49832	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.304049015 CEST	443	49832	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.304389000 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.304438114 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.304514885 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.304694891 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.304708958 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.768198967 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.768414974 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.817069054 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.817090988 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.819093943 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.819113970 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.882935047 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.883136034 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.915429115 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.915456057 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:20.917253017 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:20.917274952 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.206794024 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.206835032 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.206902027 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.206999063 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.207046032 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.207057953 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.207128048 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.278733969 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.278853893 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.278882027 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.278927088 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.278980970 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.279007912 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.290472031 CEST	49834	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.290505886 CEST	443	49834	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.292272091 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.292340040 CEST	443	49835	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.292418957 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.293452978 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.293487072 CEST	443	49835	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.395608902 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.395713091 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.395795107 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.395829916 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.395853996 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.395919085 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.446376085 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.446607113 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.592267036 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.592360020 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.592441082 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.592464924 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.604046106 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.604079962 CEST	443	49833	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.604106903 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.604136944 CEST	49833	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.872627020 CEST	443	49835	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.872803926 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.893539906 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.893567085 CEST	443	49835	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:21.895648003 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:21.895668030 CEST	443	49835	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:22.265193939 CEST	443	49835	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:22.265213966 CEST	443	49835	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:22.265269995 CEST	443	49835	15.205.24.192	192.168.2.6
Apr 1, 2022 17:32:22.265330076 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:22.265378952 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:22.288781881 CEST	49835	443	192.168.2.6	15.205.24.192
Apr 1, 2022 17:32:22.288814068 CEST	443	49835	15.205.24.192	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 1, 2022 17:32:00.925370932 CEST	56550	53	192.168.2.6	8.8.8.8
Apr 1, 2022 17:32:00.950618982 CEST	53	56550	8.8.8.8	192.168.2.6
Apr 1, 2022 17:32:01.027064085 CEST	50029	53	192.168.2.6	8.8.8.8
Apr 1, 2022 17:32:01.040647984 CEST	59871	53	192.168.2.6	8.8.8.8
Apr 1, 2022 17:32:01.045953035 CEST	53	50029	8.8.8.8	192.168.2.6
Apr 1, 2022 17:32:01.058851004 CEST	53	59871	8.8.8.8	192.168.2.6
Apr 1, 2022 17:32:10.499572992 CEST	61901	53	192.168.2.6	8.8.8.8
Apr 1, 2022 17:32:10.516385078 CEST	53	61901	8.8.8.8	192.168.2.6
Apr 1, 2022 17:32:16.062870979 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:16.091598034 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.195736885 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:16.223139048 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.223200083 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.223241091 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.223280907 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.248768091 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:16.250829935 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:16.280153990 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:16.280476093 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:16.320204973 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.321094990 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:16.335984945 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.336011887 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.336025953 CEST	443	61904	216.58.215.238	192.168.2.6
Apr 1, 2022 17:32:16.343337059 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:16.369335890 CEST	61904	443	192.168.2.6	216.58.215.238
Apr 1, 2022 17:32:17.493396044 CEST	58689	53	192.168.2.6	8.8.8.8
Apr 1, 2022 17:32:17.511842012 CEST	53	58689	8.8.8.8	192.168.2.6
Apr 1, 2022 17:32:19.709897041 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:19.738981009 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.787928104 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:19.816241026 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.816282988 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.816308022 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.816329002 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.820684910 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:19.849035025 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:19.849833965 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:19.850155115 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:19.879240990 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883050919 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883080959 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883111000 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883135080 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883157969 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883189917 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883223057 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883245945 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883271933 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.883296013 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.884409904 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.886076927 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.887953043 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.889125109 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.891331911 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.892698050 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.894814014 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.897016048 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.898870945 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.900391102 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.902299881 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.905668020 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.908152103 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.909368992 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.910660028 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.911617041 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.913482904 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.917963982 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.917989969 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.920335054 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.920380116 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.923006058 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.925168991 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.927048922 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.929702044 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.929733992 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.932589054 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.934987068 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.936204910 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:19.961724043 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:20.098514080 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.098731041 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.098798990 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.098860979 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.098933935 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.098990917 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099060059 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099121094 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099185944 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099252939 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099325895 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099379063 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099450111 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099507093 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099572897 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099637032 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.099703074 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.100703955 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.100838900 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.100905895 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.100965977 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.101056099 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.114995003 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:20.115801096 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:20.115837097 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:20.116045952 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:20.117187023 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:20.117418051 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.025779963 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.044267893 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044312954 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044331074 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044348955 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044365883 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044382095 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044398069 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044414043 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044430017 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044446945 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.044464111 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.045012951 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.045075893 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.045156002 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.045157909 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.045248032 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.045326948 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.045408964 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.046830893 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.048315048 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.048360109 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.051832914 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.051884890 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.052651882 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.052731037 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.055947065 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.055983067 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.060194016 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.060225964 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.064587116 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:24.067951918 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.068135023 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:24.094491005 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.461575031 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.480310917 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480345964 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480370045 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480396032 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480420113 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480443001 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480467081 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480490923 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480515003 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480540991 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480565071 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.480587959 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.481359959 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.481396914 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.481419086 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.481443882 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.481465101 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.481692076 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.481746912 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.481842995 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.481935024 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.482028961 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.482243061 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.482351065 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.483306885 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.483342886 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.483366966 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.483392954 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.483844042 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.484050989 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.484148026 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.485559940 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.485598087 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.485622883 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.485650063 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.485819101 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.485871077 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.487715960 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.487751961 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.487778902 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.487802982 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.489329100 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.489357948 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.489378929 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.489401102 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.491417885 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.491451979 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.491472960 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.491494894 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.492177010 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.492208004 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.493421078 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.493446112 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.493467093 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.493489027 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.493598938 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.495423079 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.495976925 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.496001959 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.496025085 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.497828960 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.497853041 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.497874022 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.497895956 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.498049974 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.498815060 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.498837948 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.500253916 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.555582047 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:31.559820890 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:31.560269117 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.716167927 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.734611034 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734652996 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734687090 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734711885 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734735012 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734755039 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734777927 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734798908 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734821081 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734843016 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734863997 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734884977 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734906912 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.734926939 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.735255957 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.735735893 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.736010075 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.736042976 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.736066103 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.736088037 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.736110926 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.736131907 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.737828970 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.737862110 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.737890005 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.737920046 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.737943888 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.737966061 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.737988949 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.738015890 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.738178968 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.739353895 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.739393950 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.739418030 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.739449978 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.739483118 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.739516020 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.739630938 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.741151094 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.741190910 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.741216898 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.741244078 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.741267920 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.741292953 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.742722988 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.742763042 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.742789984 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.742814064 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.742839098 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.742863894 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.742942095 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.744278908 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.744321108 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.744348049 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.744371891 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.744398117 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.744422913 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.745748043 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.745795012 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.745806932 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.745834112 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.745858908 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.745884895 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.745999098 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.747343063 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.747395992 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.747436047 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.747479916 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.748272896 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.748326063 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.748332977 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.748347044 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.748373032 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.748398066 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.748579979 CEST	58691	443	192.168.2.6	172.217.168.33
Apr 1, 2022 17:32:47.751462936 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.751488924 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.751507044 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.751523972 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.752154112 CEST	443	58691	172.217.168.33	192.168.2.6
Apr 1, 2022 17:32:47.754547119 CEST	58691	443	192.168.2.6	172.217.168.33

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 1, 2022 17:32:00.925370932 CEST	192.168.2.6	8.8.8.8	0x826b	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Apr 1, 2022 17:32:01.027064085 CEST	192.168.2.6	8.8.8.8	0x5aca	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Apr 1, 2022 17:32:01.040647984 CEST	192.168.2.6	8.8.8.8	0x3f44	Standard query (0)	emsonline.tritech.com	A (IP address)	IN (0x0001)
Apr 1, 2022 17:32:10.499572992 CEST	192.168.2.6	8.8.8.8	0x739	Standard query (0)	emsonline.tritech.com	A (IP address)	IN (0x0001)
Apr 1, 2022 17:32:17.493396044 CEST	192.168.2.6	8.8.8.8	0x8745	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 1, 2022 17:32:00.950618982 CEST	8.8.8.8	192.168.2.6	0x826b	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Apr 1, 2022 17:32:00.950618982 CEST	8.8.8.8	192.168.2.6	0x826b	No error (0)	clients.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
Apr 1, 2022 17:32:01.045953035 CEST	8.8.8.8	192.168.2.6	0x5aca	No error (0)	accounts.google.com		142.250.203.109	A (IP address)	IN (0x0001)
Apr 1, 2022 17:32:01.058851004 CEST	8.8.8.8	192.168.2.6	0x3f44	No error (0)	emsonline.tritech.com		15.205.24.192	A (IP address)	IN (0x0001)
Apr 1, 2022 17:32:10.516385078 CEST	8.8.8.8	192.168.2.6	0x739	No error (0)	emsonline.tritech.com		15.205.24.192	A (IP address)	IN (0x0001)
Apr 1, 2022 17:32:17.511842012 CEST	8.8.8.8	192.168.2.6	0x8745	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Apr 1, 2022 17:32:17.511842012 CEST	8.8.8.8	192.168.2.6	0x8745	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

emsonline.tritech.com

clients2.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49771	142.250.203.109	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:01 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:01 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-04-01 15:32:01 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Apr 2022 15:32:01 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-fraDR/8s01PGYaBVU6w9Mw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-fraDR/8s01PGYaBVU6w9Mw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-01 15:32:01 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-04-01 15:32:01 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49770	216.58.215.238	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:01 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:01 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-qlFiGSAIkSpVaYlM/pqFdg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 01 Apr 2022 15:32:01 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5569 X-Daystart: 30721 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-04-01 15:32:01 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 36 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 30 37 32 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5569" elapsed_seconds="30721"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-04-01 15:32:01 UTC	2	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-04-01 15:32:01 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49785	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:04 UTC	401	OUT	GET /logon/LogonPoint/receiver/js/external/jquery.dotdotdot.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:04 UTC	440	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:52 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:34:52 GMT ETag: "1954-5c7402ab6a300" Accept-Ranges: bytes Content-Length: 6484 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:04 UTC	441	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 64 2c 77 29 7b 66 75 6e 63 74 69 6f 6e 20 78 28 61 2c 62 2c 66 2c 63 2c 68 29 7b 76 61 72 20 67 3d 21 31 3b 61 2e 63 6f 6e 74 65 6e 74 73 28 29 2e 64 65 74 61 63 68 28 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 64 28 74 68 69 73 29 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 74 68 69 73 29 72 65 74 75 72 6e 21 30 3b 69 66 28 65 2e 69 73 28 22 73 63 72 69 70 74 2c 20 2e 64 6f 74 64 6f 74 64 6f 74 2d 6b 65 65 70 22 29 29 61 2e 61 70 70 65 6e 64 28 65 29 3b 65 6c 73 65 7b 69 66 28 67 29 72 65 74 75 72 6e 21 30 3b 61 2e 61 70 70 65 6e 64 28 65 29 3b 69 66 28 68 26 26 21 65 2e 69 73 28 63 2e 61 66 74 65 72 29 26 26 21 65 2e 66 69 6e 64 28 63 2e 61 66 74 65 72 29 2e 6c 65 6e Data Ascii: (function(d,w){function x(a,b,f,c,h){var g=!1;a.contents().detach().each(function(){var e=d(this);if("undefined"==typeof this)return!0;if(e.is("script, .dotdotdot-keep"))a.append(e);else{if(g)return!0;a.append(e);if(h&&!e.is(c.after)&&!e.find(c.after).len

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49786	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:04 UTC	401	OUT	GET /logon/LogonPoint/receiver/js/external/velocity.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:04 UTC	447	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:52 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:34:59 GMT ETag: "85a2-5c7402b2172c0" Accept-Ranges: bytes Content-Length: 34210 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:04 UTC	448	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 7a 29 7b 66 75 6e 63 74 69 6f 6e 20 79 28 68 29 7b 76 61 72 20 64 3d 68 2e 6c 65 6e 67 74 68 2c 67 3d 6b 2e 74 79 70 65 28 68 29 3b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 67 7c 7c 6b 2e 69 73 57 69 6e 64 6f 77 28 68 29 3f 21 31 3a 31 3d 3d 3d 68 2e 6e 6f 64 65 54 79 70 65 26 26 64 3f 21 30 3a 22 61 72 72 61 79 22 3d 3d 3d 67 7c 7c 30 3d 3d 3d 64 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 30 3c 64 26 26 64 2d 31 20 69 6e 20 68 7d 69 66 28 21 7a 2e 6a 51 75 65 72 79 29 7b 76 61 72 20 6b 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 64 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 6b 2e 66 6e 2e 69 6e 69 74 28 68 2c 64 29 7d 3b 6b 2e 69 73 57 69 6e 64 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 Data Ascii: (function(z){function y(h){var d=h.length,g=k.type(h);return"function"===g\|\|k.isWindow(h)?!1:1===h.nodeType&&d?!0:"array"===g\|\|0===d\|\|"number"===typeof d&&0<d&&d-1 in h}if(!z.jQuery){var k=function(h,d){return new k.fn.init(h,d)};k.isWindow=function(h){re
2022-04-01 15:32:04 UTC	455	IN	Data Raw: 72 74 79 56 61 6c 75 65 43 61 63 68 65 3d 7b 7d 3b 76 61 72 20 6c 3d 21 31 3b 6e 2e 65 61 63 68 28 66 2e 4c 69 73 74 73 2e 74 72 61 6e 73 66 6f 72 6d 73 33 44 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 2f 5e 73 63 61 6c 65 2f 2e 74 65 73 74 28 62 29 3f 31 3a 30 2c 66 3d 64 28 68 29 2e 74 72 61 6e 73 66 6f 72 6d 43 61 63 68 65 5b 62 5d 3b 0a 64 28 68 29 2e 74 72 61 6e 73 66 6f 72 6d 43 61 63 68 65 5b 62 5d 21 3d 3d 67 26 26 28 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 28 22 2b 63 2b 22 5b 5e 2e 5d 22 29 29 2e 74 65 73 74 28 66 29 26 26 28 6c 3d 21 30 2c 64 65 6c 65 74 65 20 64 28 68 29 2e 74 72 61 6e 73 66 6f 72 6d 43 61 63 68 65 5b 62 5d 29 7d 29 3b 41 2e 6d 6f 62 69 6c 65 48 41 26 26 28 6c 3d 21 30 2c 64 65 6c 65 74 65 20 64 28 68 Data Ascii: rtyValueCache={};var l=!1;n.each(f.Lists.transforms3D,function(a,b){var c=/^scale/.test(b)?1:0,f=d(h).transformCache[b];d(h).transformCache[b]!==g&&(new RegExp("^\\("+c+"[^.]")).test(f)&&(l=!0,delete d(h).transformCache[b])});A.mobileHA&&(l=!0,delete d(h
2022-04-01 15:32:04 UTC	478	IN	Data Raw: 74 79 22 3b 63 61 73 65 20 22 65 78 74 72 61 63 74 22 3a 72 65 74 75 72 6e 20 62 3b 0a 63 61 73 65 20 22 69 6e 6a 65 63 74 22 3a 72 65 74 75 72 6e 20 62 7d 7d 7d 2c 72 65 67 69 73 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 39 3e 3d 70 7c 7c 65 2e 53 74 61 74 65 2e 69 73 47 69 6e 67 65 72 62 72 65 61 64 7c 7c 28 66 2e 4c 69 73 74 73 2e 74 72 61 6e 73 66 6f 72 6d 73 42 61 73 65 3d 66 2e 4c 69 73 74 73 2e 74 72 61 6e 73 66 6f 72 6d 73 42 61 73 65 2e 63 6f 6e 63 61 74 28 66 2e 4c 69 73 74 73 2e 74 72 61 6e 73 66 6f 72 6d 73 33 44 29 29 3b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 66 2e 4c 69 73 74 73 2e 74 72 61 6e 73 66 6f 72 6d 73 42 61 73 65 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 3d 66 2e 4c 69 73 74 73 2e Data Ascii: ty";case "extract":return b;case "inject":return b}}},register:function(){9>=p\|\|e.State.isGingerbread\|\|(f.Lists.transformsBase=f.Lists.transformsBase.concat(f.Lists.transforms3D));for(var a=0;a<f.Lists.transformsBase.length;a++)(function(){var c=f.Lists.
2022-04-01 15:32:04 UTC	486	IN	Data Raw: 63 2e 63 6f 6e 74 61 69 6e 65 72 2c 43 3d 63 2e 63 6f 6e 74 61 69 6e 65 72 5b 22 73 63 72 6f 6c 6c 22 2b 44 5d 2c 41 3d 43 2b 6e 28 62 29 2e 70 6f 73 69 74 69 6f 6e 28 29 5b 44 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 2b 42 29 3a 63 2e 63 6f 6e 74 61 69 6e 65 72 3d 6e 75 6c 6c 3a 28 43 3d 65 2e 53 74 61 74 65 2e 73 63 72 6f 6c 6c 41 6e 63 68 6f 72 5b 65 2e 53 74 61 74 65 5b 22 73 63 72 6f 6c 6c 50 72 6f 70 65 72 74 79 22 2b 44 5d 5d 2c 46 3d 65 2e 53 74 61 74 65 2e 73 63 72 6f 6c 6c 41 6e 63 68 6f 72 5b 65 2e 53 74 61 74 65 5b 22 73 63 72 6f 6c 6c 50 72 6f 70 65 72 74 79 22 2b 28 22 4c 65 66 74 22 3d 3d 3d 44 3f 22 54 6f 70 22 3a 22 4c 65 66 74 22 29 5d 5d 2c 41 3d 6e 28 62 29 2e 6f 66 66 73 65 74 28 29 5b 44 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 Data Ascii: c.container,C=c.container["scroll"+D],A=C+n(b).position()[D.toLowerCase()]+B):c.container=null:(C=e.State.scrollAnchor[e.State["scrollProperty"+D]],F=e.State.scrollAnchor[e.State["scrollProperty"+("Left"===D?"Top":"Left")]],A=n(b).offset()[D.toLowerCase()
2022-04-01 15:32:04 UTC	493	IN	Data Raw: 7c 7c 28 6e 2e 65 61 63 68 28 6e 2e 71 75 65 75 65 28 62 2c 6c 2e 69 73 53 74 72 69 6e 67 28 75 29 3f 75 3a 22 22 29 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 6c 2e 69 73 46 75 6e 63 74 69 6f 6e 28 62 29 26 26 62 28 29 7d 29 2c 6e 2e 71 75 65 75 65 28 62 2c 6c 2e 69 73 53 74 72 69 6e 67 28 75 29 3f 0a 75 3a 22 22 2c 5b 5d 29 29 7d 29 3b 76 61 72 20 4c 3d 5b 5d 3b 6e 2e 65 61 63 68 28 65 2e 53 74 61 74 65 2e 63 61 6c 6c 73 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 26 26 6e 2e 65 61 63 68 28 62 5b 31 5d 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 65 29 7b 76 61 72 20 66 3d 75 3d 3d 3d 67 3f 22 22 3a 75 3b 69 66 28 21 30 21 3d 3d 66 26 26 62 5b 32 5d 2e 71 75 65 75 65 21 3d 3d 66 26 26 28 75 21 3d 3d 67 7c 7c 21 31 21 3d 3d 62 5b 32 5d 2e 71 75 65 75 65 29 Data Ascii: \|\|(n.each(n.queue(b,l.isString(u)?u:""),function(a,b){l.isFunction(b)&&b()}),n.queue(b,l.isString(u)?u:"",[]))});var L=[];n.each(e.State.calls,function(a,b){b&&n.each(b[1],function(c,e){var f=u===g?"":u;if(!0!==f&&b[2].queue!==f&&(u!==g\|\|!1!==b[2].queue)
2022-04-01 15:32:04 UTC	495	IN	Data Raw: 20 61 63 74 69 6f 6e 2c 20 6f 72 20 61 20 72 65 67 69 73 74 65 72 65 64 20 72 65 64 69 72 65 63 74 2e 20 41 62 6f 72 74 69 6e 67 2e 22 2c 45 2e 70 72 6f 6d 69 73 65 3f 45 2e 72 65 6a 65 63 74 65 72 28 45 72 72 6f 72 28 63 29 29 3a 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 63 29 3b 72 65 74 75 72 6e 20 62 3f 45 2e 70 72 6f 6d 69 73 65 7c 7c 6e 75 6c 6c 3a 70 7d 7d 76 61 72 20 78 3d 7b 6c 61 73 74 50 61 72 65 6e 74 3a 6e 75 6c 6c 2c 6c 61 73 74 50 6f 73 69 74 69 6f 6e 3a 6e 75 6c 6c 2c 6c 61 73 74 46 6f 6e 74 53 69 7a 65 3a 6e 75 6c 6c 2c 6c 61 73 74 50 65 72 63 65 6e 74 54 6f 50 78 57 69 64 74 68 3a 6e 75 6c 6c 2c 6c 61 73 74 50 65 72 63 65 6e 74 54 6f 50 78 48 65 69 67 68 74 3a 6e 75 6c 6c 2c 6c 61 73 74 45 6d 54 6f 50 78 3a 6e 75 6c 6c 2c 72 65 6d 54 6f 50 78 Data Ascii: action, or a registered redirect. Aborting.",E.promise?E.rejecter(Error(c)):console.log(c);return b?E.promise\|\|null:p}}var x={lastParent:null,lastPosition:null,lastFontSize:null,lastPercentToPxWidth:null,lastPercentToPxHeight:null,lastEmToPx:null,remToPx

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49787	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:04 UTC	401	OUT	GET /logon/LogonPoint/receiver/js/external/slick.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:04 UTC	462	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:52 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:35:05 GMT ETag: "96b8-5c7402b7d0040" Accept-Ranges: bytes Content-Length: 38584 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:04 UTC	463	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 66 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 66 29 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 66 28 72 65 71 75 69 72 65 28 22 6a 71 75 65 72 79 22 29 29 3a 66 28 6a 51 75 65 72 79 29 7d 29 28 66 75 6e 63 74 69 6f 6e 28 66 29 7b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2e 53 6c 69 63 6b 7c 7c 7b 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 2c 64 29 7b 76 61 72 20 63 3d 74 68 69 73 2c 65 2c 68 3b 63 2e 64 65 66 61 75 6c 74 73 3d 7b 61 Data Ascii: (function(f){"function"===typeof define&&define.amd?define(["jquery"],f):"undefined"!==typeof exports?module.exports=f(require("jquery")):f(jQuery)})(function(f){var e=window.Slick\|\|{},e=function(){var a=0;return function(b,d){var c=this,e,h;c.defaults={a
2022-04-01 15:32:04 UTC	470	IN	Data Raw: 70 70 65 6e 64 54 6f 28 74 68 69 73 2e 24 73 6c 69 64 65 72 29 3a 74 68 69 73 2e 24 73 6c 69 64 65 73 2e 77 72 61 70 41 6c 6c 28 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6c 69 63 6b 2d 74 72 61 63 6b 22 2f 3e 27 29 2e 70 61 72 65 6e 74 28 29 3b 74 68 69 73 2e 24 6c 69 73 74 3d 74 68 69 73 2e 24 73 6c 69 64 65 54 72 61 63 6b 2e 77 72 61 70 28 27 3c 64 69 76 20 61 72 69 61 2d 6c 69 76 65 3d 22 70 6f 6c 69 74 65 22 20 63 6c 61 73 73 3d 22 73 6c 69 63 6b 2d 6c 69 73 74 22 2f 3e 27 29 2e 70 61 72 65 6e 74 28 29 3b 74 68 69 73 2e 24 73 6c 69 64 65 54 72 61 63 6b 2e 63 73 73 28 22 6f 70 61 63 69 74 79 22 2c 30 29 3b 69 66 28 21 30 3d 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 63 65 6e 74 65 72 4d 6f 64 65 7c 7c 21 30 3d 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e Data Ascii: ppendTo(this.$slider):this.$slides.wrapAll('<div class="slick-track"/>').parent();this.$list=this.$slideTrack.wrap('<div aria-live="polite" class="slick-list"/>').parent();this.$slideTrack.css("opacity",0);if(!0===this.options.centerMode\|\|!0===this.option
2022-04-01 15:32:04 UTC	496	IN	Data Raw: 73 2e 66 69 72 73 74 28 29 2e 6f 75 74 65 72 48 65 69 67 68 74 28 29 3b 21 30 3d 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 69 6e 66 69 6e 69 74 65 3f 28 74 68 69 73 2e 73 6c 69 64 65 43 6f 75 6e 74 3e 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 26 26 28 74 68 69 73 2e 73 6c 69 64 65 4f 66 66 73 65 74 3d 74 68 69 73 2e 73 6c 69 64 65 57 69 64 74 68 2a 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 2a 2d 31 2c 64 3d 62 2a 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 2a 0a 2d 31 29 2c 30 21 3d 3d 74 68 69 73 2e 73 6c 69 64 65 43 6f 75 6e 74 25 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 63 72 6f 6c 6c 26 26 61 2b 74 68 69 73 2e 6f 70 74 69 6f 6e Data Ascii: s.first().outerHeight();!0===this.options.infinite?(this.slideCount>this.options.slidesToShow&&(this.slideOffset=this.slideWidththis.options.slidesToShow-1,d=bthis.options.slidesToShow-1),0!==this.slideCount%this.options.slidesToScroll&&a+this.option
2022-04-01 15:32:04 UTC	504	IN	Data Raw: 29 3b 61 2e 70 72 6f 67 72 65 73 73 69 76 65 4c 61 7a 79 4c 6f 61 64 28 29 7d 29 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 66 72 65 73 68 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 74 68 69 73 2e 63 75 72 72 65 6e 74 53 6c 69 64 65 3b 0a 74 68 69 73 2e 64 65 73 74 72 6f 79 28 21 30 29 3b 66 2e 65 78 74 65 6e 64 28 74 68 69 73 2c 74 68 69 73 2e 69 6e 69 74 69 61 6c 73 2c 7b 63 75 72 72 65 6e 74 53 6c 69 64 65 3a 62 7d 29 3b 74 68 69 73 2e 69 6e 69 74 28 29 3b 61 7c 7c 74 68 69 73 2e 63 68 61 6e 67 65 53 6c 69 64 65 28 7b 64 61 74 61 3a 7b 6d 65 73 73 61 67 65 3a 22 69 6e 64 65 78 22 2c 69 6e 64 65 78 3a 62 7d 7d 2c 21 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 69 6e 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e Data Ascii: );a.progressiveLazyLoad()}))};e.prototype.refresh=function(a){var b=this.currentSlide;this.destroy(!0);f.extend(this,this.initials,{currentSlide:b});this.init();a\|\|this.changeSlide({data:{message:"index",index:b}},!1)};e.prototype.reinit=function(){this.
2022-04-01 15:32:04 UTC	512	IN	Data Raw: 3d 30 29 3b 74 68 69 73 2e 73 6c 69 64 65 43 6f 75 6e 74 3c 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 65 73 54 6f 53 68 6f 77 3f 28 74 68 69 73 2e 73 65 74 53 6c 69 64 65 43 6c 61 73 73 65 73 28 61 29 2c 74 68 69 73 2e 61 73 4e 61 76 46 6f 72 28 61 29 29 3a 74 68 69 73 2e 73 6c 69 64 65 48 61 6e 64 6c 65 72 28 61 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 64 65 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 29 7b 76 61 72 20 63 2c 65 2c 66 3d 6e 75 6c 6c 2c 67 3d 74 68 69 73 3b 21 30 3d 3d 3d 67 2e 61 6e 69 6d 61 74 69 6e 67 26 26 21 30 3d 3d 3d 67 2e 6f 70 74 69 6f 6e 73 2e 77 61 69 74 46 6f 72 41 6e 69 6d 61 74 65 7c 7c 21 30 3d 3d 3d 67 2e 6f 70 74 69 6f 6e 73 2e 66 61 64 65 26 26 67 2e 63 75 72 72 65 6e 74 53 Data Ascii: =0);this.slideCount<=this.options.slidesToShow?(this.setSlideClasses(a),this.asNavFor(a)):this.slideHandler(a)};e.prototype.slideHandler=function(a,b,d){var c,e,f=null,g=this;!0===g.animating&&!0===g.options.waitForAnimate\|\|!0===g.options.fade&&g.currentS

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49790	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:04 UTC	440	OUT	GET /logon/LogonPoint/receiver/css/ctxs.large-ui.min.css HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:04 UTC	519	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:52 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:46 GMT ETag: "136c4-5c74026c78e80" Accept-Ranges: bytes Content-Length: 79556 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate Content-Type: text/css; charset=utf-8 Connection: close
2022-04-01 15:32:04 UTC	520	IN	Data Raw: 2e 73 6c 69 63 6b 2d 73 6c 69 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 73 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 6f 75 63 68 2d 63 61 6c 6c 6f 75 74 3a 6e 6f 6e 65 3b 2d 6b 68 74 6d 6c 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 73 2d 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 70 61 6e 2d 79 3b 74 Data Ascii: .slick-slider{position:relative;display:block;-moz-box-sizing:border-box;box-sizing:border-box;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;-webkit-touch-callout:none;-khtml-user-select:none;-ms-touch-action:pan-y;t
2022-04-01 15:32:04 UTC	527	IN	Data Raw: 7b 63 6f 6e 74 65 6e 74 3a 75 72 6c 28 27 27 29 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 39 70 78 7d 2e 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 20 2e 73 65 61 72 63 68 2d 63 6f 6e 74 61 69 6e 65 72 2e 77 69 74 68 2d 74 65 78 74 20 2e 73 65 61 72 63 68 43 6c 65 61 72 42 75 74 74 6f 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 75 72 6c 28 22 2e 2e 2f 69 6d 61 67 65 73 2f 31 78 2f 73 65 61 72 63 68 5f 63 6c 6f 73 65 2e 70 6e 67 22 29 7d 2e 73 65 61 72 63 68 2d 63 6f 6e 74 61 69 6e 65 72 2e 77 69 74 68 2d 74 65 78 74 20 2e 73 65 61 72 63 68 43 6c 65 61 72 42 75 74 74 6f 6e 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 61 2c 61 3a 76 69 73 69 74 Data Ascii: {content:url('');position:absolute;margin-top:8px;margin-left:9px}.high-contrast .search-container.with-text .searchClearButton:before{content:url("../images/1x/search_close.png")}.search-container.with-text .searchClearButton{visibility:visible}a,a:visit
2022-04-01 15:32:04 UTC	535	IN	Data Raw: 7d 2e 73 74 6f 72 65 61 70 70 2d 6c 6f 61 64 69 6e 67 2d 6f 76 65 72 6c 61 79 2c 2e 73 74 6f 72 65 61 70 70 2d 72 65 61 64 79 2d 6f 76 65 72 6c 61 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 33 38 2c 32 33 38 2c 32 33 38 2c 30 2e 39 35 29 7d 2e 73 74 6f 72 65 61 70 70 2d 6c 6f 61 64 69 6e 67 2d 73 70 69 6e 6e 65 72 2c 2e 73 74 6f 72 65 61 70 70 2d 72 65 61 64 79 2d 6f 76 65 72 6c 61 79 3a 62 65 66 6f 72 65 7b 6d 61 72 67 69 6e 3a 2d 31 31 70 78 20 30 20 30 20 2d 31 31 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 7d 2e 73 74 6f 72 65 61 70 70 2d 72 65 61 64 Data Ascii: }.storeapp-loading-overlay,.storeapp-ready-overlay{display:none;background-color:#eee;background-color:rgba(238,238,238,0.95)}.storeapp-loading-spinner,.storeapp-ready-overlay:before{margin:-11px 0 0 -11px;position:absolute;top:50%;left:50%}.storeapp-read
2022-04-01 15:32:04 UTC	543	IN	Data Raw: 7d 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 66 69 65 6c 64 20 2e 63 65 6e 74 65 72 4c 61 79 6f 75 74 20 2e 6c 61 62 65 6c 2e 65 72 72 6f 72 2e 6e 6f 4d 61 72 67 69 6e 2c 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 66 69 65 6c 64 20 2e 63 65 6e 74 65 72 4c 61 79 6f 75 74 20 2e 6c 61 62 65 6c 2e 77 61 72 6e 69 6e 67 2e 6e 6f 4d 61 72 67 69 6e 2c 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 66 69 65 6c 64 20 2e 63 65 6e 74 65 72 4c 61 79 6f 75 74 20 2e 6c 61 62 65 6c 2e 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 6e 6f 4d 61 72 67 69 6e 2c 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 66 69 65 6c 64 20 2e 63 65 6e 74 65 72 4c 61 79 6f 75 74 20 2e 6c 61 62 65 6c 2e 69 6e 70 72 6f 67 72 65 73 73 2e 6e 6f 4d 61 72 67 69 6e 2c 2e 63 72 65 64 Data Ascii: }.credentialform .field .centerLayout .label.error.noMargin,.credentialform .field .centerLayout .label.warning.noMargin,.credentialform .field .centerLayout .label.information.noMargin,.credentialform .field .centerLayout .label.inprogress.noMargin,.cred
2022-04-01 15:32:04 UTC	551	IN	Data Raw: 6c 66 6f 72 6d 20 2e 69 6e 66 6f 72 6d 61 74 69 6f 6e 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2e 2e 2f 69 6d 61 67 65 73 2f 32 78 2f 69 63 6f 5f 69 6e 66 6f 40 32 78 2e 70 6e 67 29 7d 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 65 72 72 6f 72 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2e 2e 2f 69 6d 61 67 65 73 2f 32 78 2f 69 63 6f 5f 65 72 72 6f 72 40 32 78 2e 70 6e 67 29 7d 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2e 2e 2f 69 6d 61 67 65 73 2f 32 78 2f 69 63 6f 5f 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 40 32 78 2e 70 6e 67 29 7d Data Ascii: lform .information:before{background-image:url(../images/2x/ico_info@2x.png)}.credentialform .error:before{background-image:url(../images/2x/ico_error@2x.png)}.credentialform .confirmation:before{background-image:url(../images/2x/ico_confirmation@2x.png)}
2022-04-01 15:32:05 UTC	559	IN	Data Raw: 72 6d 20 2e 77 61 72 6e 69 6e 67 2c 2e 73 76 20 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 2e 73 76 20 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 2c 2e 64 61 20 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 65 72 72 6f 72 2c 2e 64 61 20 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 77 61 72 6e 69 6e 67 2c 2e 64 61 20 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 2e 64 61 20 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 2c 2e 64 65 20 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 65 72 72 6f 72 2c 2e 64 65 20 2e 63 72 65 64 65 6e 74 69 61 6c 66 6f 72 6d 20 2e 77 61 72 6e 69 Data Ascii: rm .warning,.sv .credentialform .information,.sv .credentialform .confirmation,.da .credentialform .error,.da .credentialform .warning,.da .credentialform .information,.da .credentialform .confirmation,.de .credentialform .error,.de .credentialform .warni
2022-04-01 15:32:05 UTC	567	IN	Data Raw: 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6c 61 72 67 65 20 2e 73 65 74 74 69 6e 67 73 2d 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 38 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 32 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 7d 2e 6c 61 72 67 65 20 2e 73 65 74 74 69 6e 67 73 2d 62 75 74 74 6f 6e 2d 61 72 72 6f 77 7b 77 69 64 74 68 3a 38 2e 35 70 78 3b 68 65 69 67 68 74 3a 36 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 36 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c Data Ascii: ontainer{display:inline-block;position:relative}.large .settings-button{display:block;margin-top:18px;margin-right:12px;padding:0 5px}.large .settings-button-arrow{width:8.5px;height:6px;margin-left:7px;margin-top:16px;vertical-align:top;display:inline-bl
2022-04-01 15:32:05 UTC	574	IN	Data Raw: 72 67 65 54 69 6c 65 73 20 23 61 70 70 49 6e 66 6f 52 65 71 75 65 73 74 42 75 74 74 6f 6e 2e 73 68 6f 77 2c 2e 6c 61 72 67 65 54 69 6c 65 73 20 23 61 70 70 49 6e 66 6f 41 64 64 42 75 74 74 6f 6e 2e 73 68 6f 77 2c 2e 6c 61 72 67 65 54 69 6c 65 73 20 23 61 70 70 49 6e 66 6f 52 65 6d 6f 76 65 42 74 6e 2e 73 68 6f 77 2c 2e 6c 61 72 67 65 54 69 6c 65 73 20 23 61 70 70 49 6e 66 6f 52 65 73 74 61 72 74 42 74 6e 2e 73 68 6f 77 2c 2e 6c 61 72 67 65 54 69 6c 65 73 20 23 61 70 70 49 6e 66 6f 43 61 6e 63 65 6c 52 65 71 75 65 73 74 42 75 74 74 6f 6e 2e 73 68 6f 77 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 7d 2e 6c 61 72 67 65 54 69 6c 65 73 20 2e 61 70 70 2d 64 65 73 63 72 69 70 74 69 6f 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 39 70 78 7d 2e 6c 61 72 67 65 54 69 Data Ascii: rgeTiles #appInfoRequestButton.show,.largeTiles #appInfoAddButton.show,.largeTiles #appInfoRemoveBtn.show,.largeTiles #appInfoRestartBtn.show,.largeTiles #appInfoCancelRequestButton.show{display:inline}.largeTiles .app-description{padding-top:9px}.largeTi
2022-04-01 15:32:05 UTC	582	IN	Data Raw: 70 6c 61 79 2d 6e 61 6d 65 2c 2e 6c 61 72 67 65 20 2e 6a 61 20 2e 75 73 65 72 2d 64 69 73 70 6c 61 79 2d 6e 61 6d 65 2c 2e 6c 61 72 67 65 20 2e 6e 6c 20 2e 75 73 65 72 2d 64 69 73 70 6c 61 79 2d 6e 61 6d 65 2c 2e 6c 61 72 67 65 20 2e 66 72 20 2e 75 73 65 72 2d 64 69 73 70 6c 61 79 2d 6e 61 6d 65 2c 2e 6c 61 72 67 65 20 2e 6b 6f 20 2e 75 73 65 72 2d 64 69 73 70 6c 61 79 2d 6e 61 6d 65 7b 6d 61 78 2d 77 69 64 74 68 3a 31 33 30 70 78 7d 2e 6c 61 72 67 65 20 2e 65 73 20 2e 6c 6f 67 6f 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 6c 61 72 67 65 20 2e 6a 61 20 2e 6c 6f 67 6f 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 6c 61 72 67 65 20 2e 6e 6c 20 2e 6c 6f 67 6f 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 6c 61 72 67 65 20 2e 66 72 20 2e 6c 6f 67 6f 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e Data Ascii: play-name,.large .ja .user-display-name,.large .nl .user-display-name,.large .fr .user-display-name,.large .ko .user-display-name{max-width:130px}.large .es .logo-container,.large .ja .logo-container,.large .nl .logo-container,.large .fr .logo-container,.
2022-04-01 15:32:05 UTC	590	IN	Data Raw: 20 23 61 70 70 49 6e 66 6f 44 65 6c 65 74 65 42 74 6e 2e 73 68 6f 77 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 7d 2e 6c 61 72 67 65 54 69 6c 65 73 20 23 61 70 70 49 6e 66 6f 44 65 6c 65 74 65 42 74 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 6d 61 6c 6c 54 69 6c 65 73 20 23 61 70 70 49 6e 66 6f 44 65 6c 65 74 65 42 74 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 6d 61 6c 6c 54 69 6c 65 73 20 23 61 70 70 49 6e 66 6f 44 65 6c 65 74 65 42 74 6e 2e 73 68 6f 77 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 63 6c 65 61 72 66 69 78 3a 62 65 66 6f 72 65 2c 2e 63 6c 65 61 72 66 69 78 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 68 65 69 67 68 Data Ascii: #appInfoDeleteBtn.show{display:inline}.largeTiles #appInfoDeleteBtn{display:none}.smallTiles #appInfoDeleteBtn{display:none}.smallTiles #appInfoDeleteBtn.show{display:block}.clearfix:before,.clearfix:after{content:"";display:block;visibility:hidden;heigh
2022-04-01 15:32:05 UTC	597	IN	Data Raw: 68 3a 34 30 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 74 70 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 2e 6f 74 70 2d 64 69 73 61 62 6c 65 64 7b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 7d 23 61 64 64 2d 6f 74 70 2e 6f 74 70 2d 64 69 73 61 62 6c 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 65 35 39 36 32 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 2c 31 36 31 2c 31 39 33 2c 30 2e 32 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 74 70 2d 74 65 73 74 2d 64 65 6c 65 74 65 2e 6f 74 70 2d 64 69 73 61 62 6c 65 64 7b 62 6f 72 64 65 72 3a 23 33 65 35 39 36 32 20 31 70 78 20 73 6f 6c 69 64 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 33 65 35 39 36 Data Ascii: h:400px!important}.otp-bold{font-weight:bold}.otp-disabled{cursor:default}#add-otp.otp-disabled{background-color:#3e5962!important;background-color:rgba(2,161,193,0.2)!important}.otp-test-delete.otp-disabled{border:#3e5962 1px solid!important;color:#3e596

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49791	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:04 UTC	535	OUT	GET /logon/themes/Default/css/theme.css HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:05 UTC	638	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:53 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 15:47:41 GMT ETag: "13-5c73f81f90140" Accept-Ranges: bytes Content-Length: 19 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate Content-Type: text/css; charset=utf-8 Connection: close
2022-04-01 15:32:05 UTC	639	IN	Data Raw: 2e 74 65 73 74 5f 64 69 76 5f 64 75 6d 6d 79 0a 7b 0a 7d Data Ascii: .test_div_dummy{}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49792	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:04 UTC	535	OUT	GET /logon/LogonPoint/custom/style.css HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:05 UTC	599	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:53 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "2e2-5c74025d36a80" Accept-Ranges: bytes Content-Length: 738 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate Content-Type: text/css; charset=utf-8 Connection: close
2022-04-01 15:32:05 UTC	599	IN	Data Raw: ef bb bf 2f 2a 20 45 64 69 74 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 63 75 73 74 6f 6d 69 7a 65 20 74 68 65 20 55 73 65 72 20 49 6e 74 65 72 66 61 63 65 20 62 79 20 6f 76 65 72 72 69 64 69 6e 67 20 74 68 65 20 65 78 69 73 74 69 6e 67 20 43 53 53 20 53 74 79 6c 65 73 2e 20 0a 20 2a 20 59 6f 75 20 63 61 6e 20 75 73 65 20 62 72 6f 77 73 65 72 20 64 65 76 65 6c 6f 70 6d 65 6e 74 20 74 6f 6f 6c 73 20 74 6f 20 69 64 65 6e 74 69 66 79 20 74 68 65 20 43 53 53 20 63 6c 61 73 73 65 73 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 63 75 73 74 6f 6d 69 7a 65 2e 0a 20 2a 2f 0a 0a 2f 2a 20 57 68 65 6e 20 75 73 69 6e 67 20 74 68 65 20 53 74 6f 72 65 46 72 6f 6e 74 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 53 44 4b 20 74 6f 20 72 65 74 75 72 6e 20 63 75 73 74 6f 6d 20 Data Ascii: /* Edit this file to customize the User Interface by overriding the existing CSS Styles. * You can use browser development tools to identify the CSS classes you want to customize. // When using the StoreFront Authentication SDK to return custom

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49793	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:04 UTC	559	OUT	GET /logon/LogonPoint/receiver/js/external/elliptic.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:05 UTC	600	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:53 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:35:16 GMT ETag: "206a7-5c7402c24d900" Accept-Ranges: bytes Content-Length: 132775 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:05 UTC	600	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 6b 61 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 6b 61 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 6b 61 29 3a 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3f 67 6c 6f 62 61 6c 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 65 6c 6c 69 70 Data Ascii: (function(ka){"object"===typeof exports&&"undefined"!==typeof module?module.exports=ka():"function"===typeof define&&define.amd?define([],ka):("undefined"!==typeof window?window:"undefined"!==typeof global?global:"undefined"!==typeof self?self:this).ellip
2022-04-01 15:32:05 UTC	607	IN	Data Raw: 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 69 6e 74 46 72 6f 6d 59 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 68 29 7b 61 3d 6e 65 77 20 66 28 61 2c 31 36 29 3b 61 2e 72 65 64 7c 7c 28 61 3d 61 2e 74 6f 52 65 64 28 74 68 69 73 2e 72 65 64 29 29 3b 76 61 72 20 64 3d 61 2e 72 65 64 53 71 72 28 29 2c 6c 3d 64 2e 72 65 64 53 75 62 28 74 68 69 73 2e 63 32 29 2c 64 3d 64 2e 72 65 64 4d 75 6c 28 74 68 69 73 2e 64 29 2e 72 65 64 4d 75 6c 28 74 68 69 73 2e 63 32 29 2e 72 65 64 53 75 62 28 74 68 69 73 2e 61 29 2c 6c 3d 6c 2e 72 65 64 4d 75 6c 28 64 2e 72 65 64 49 6e 76 6d 28 29 29 3b 69 66 28 30 3d 3d 3d 6c 2e 63 6d 70 28 74 68 69 73 2e 7a 65 72 6f 29 29 7b 69 66 28 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 20 70 6f 69 6e 74 22 29 3b 72 65 74 75 Data Ascii: ;g.prototype.pointFromY=function(a,h){a=new f(a,16);a.red\|\|(a=a.toRed(this.red));var d=a.redSqr(),l=d.redSub(this.c2),d=d.redMul(this.d).redMul(this.c2).redSub(this.a),l=l.redMul(d.redInvm());if(0===l.cmp(this.zero)){if(h)throw Error("invalid point");retu
2022-04-01 15:32:05 UTC	615	IN	Data Raw: 73 2e 79 2e 72 65 64 7c 7c 28 74 68 69 73 2e 79 3d 74 68 69 73 2e 79 2e 74 6f 52 65 64 28 74 68 69 73 2e 63 75 72 76 65 2e 72 65 64 29 29 2c 74 68 69 73 2e 69 6e 66 3d 21 31 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 68 2c 64 2c 6c 2c 63 29 7b 62 2e 42 61 73 65 50 6f 69 6e 74 2e 63 61 6c 6c 28 74 68 69 73 2c 68 2c 22 6a 61 63 6f 62 69 61 6e 22 29 3b 6e 75 6c 6c 3d 3d 3d 64 26 26 6e 75 6c 6c 3d 3d 3d 6c 26 26 6e 75 6c 6c 3d 3d 3d 63 3f 28 74 68 69 73 2e 79 3d 74 68 69 73 2e 78 3d 0a 74 68 69 73 2e 63 75 72 76 65 2e 6f 6e 65 2c 74 68 69 73 2e 7a 3d 6e 65 77 20 61 28 30 29 29 3a 28 74 68 69 73 2e 78 3d 6e 65 77 20 61 28 64 2c 31 36 29 2c 74 68 69 73 2e 79 3d 6e 65 77 20 61 28 6c 2c 31 36 29 2c 74 68 69 73 2e 7a 3d 6e 65 77 20 61 28 63 2c 31 36 29 29 3b 74 68 69 Data Ascii: s.y.red\|\|(this.y=this.y.toRed(this.curve.red)),this.inf=!1)}function c(h,d,l,c){b.BasePoint.call(this,h,"jacobian");null===d&&null===l&&null===c?(this.y=this.x=this.curve.one,this.z=new a(0)):(this.x=new a(d,16),this.y=new a(l,16),this.z=new a(c,16));thi
2022-04-01 15:32:05 UTC	623	IN	Data Raw: 3d 74 68 69 73 2e 63 75 72 76 65 2e 74 69 6e 76 2c 66 3d 74 68 69 73 2e 78 2c 62 3d 74 68 69 73 2e 79 2c 71 3d 74 68 69 73 2e 7a 2c 67 3d 71 2e 72 65 64 53 71 72 28 29 2e 72 65 64 53 71 72 28 29 2c 6b 3d 62 2e 72 65 64 41 64 64 28 62 29 2c 62 3d 30 3b 62 3c 61 3b 62 2b 2b 29 7b 76 61 72 20 70 3d 66 2e 72 65 64 53 71 72 28 29 2c 6e 3d 6b 2e 72 65 64 53 71 72 28 29 2c 72 3d 6e 2e 72 65 64 53 71 72 28 29 2c 70 3d 70 2e 72 65 64 41 64 64 28 70 29 2e 72 65 64 49 41 64 64 28 70 29 2e 72 65 64 49 41 64 64 28 64 2e 72 65 64 4d 75 6c 28 67 29 29 2c 6e 3d 66 2e 72 65 64 4d 75 6c 28 6e 29 2c 66 3d 70 2e 72 65 64 53 71 72 28 29 2e 72 65 64 49 53 75 62 28 6e 2e 72 65 64 41 64 64 28 6e 29 29 2c 6e 3d 6e 2e 72 65 64 49 53 75 62 28 66 29 2c 70 3d 70 2e 72 65 64 4d 75 6c Data Ascii: =this.curve.tinv,f=this.x,b=this.y,q=this.z,g=q.redSqr().redSqr(),k=b.redAdd(b),b=0;b<a;b++){var p=f.redSqr(),n=k.redSqr(),r=n.redSqr(),p=p.redAdd(p).redIAdd(p).redIAdd(d.redMul(g)),n=f.redMul(n),f=p.redSqr().redISub(n.redAdd(n)),n=n.redISub(f),p=p.redMul
2022-04-01 15:32:05 UTC	631	IN	Data Raw: 73 68 61 32 35 36 2c 67 52 65 64 3a 21 31 2c 67 3a 5b 22 39 22 5d 7d 29 3b 6b 28 22 65 64 32 35 35 31 39 22 2c 7b 74 79 70 65 3a 22 65 64 77 61 72 64 73 22 2c 70 72 69 6d 65 3a 22 70 32 35 35 31 39 22 2c 70 3a 22 37 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 20 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 20 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 20 66 66 66 66 66 66 66 66 66 66 66 66 66 66 65 64 22 2c 0a 61 3a 22 2d 31 22 2c 63 3a 22 31 22 2c 64 3a 22 35 32 30 33 36 63 65 65 32 62 36 66 66 65 37 33 20 38 63 63 37 34 30 37 39 37 37 37 39 65 38 39 38 20 30 30 37 30 30 61 34 64 34 31 34 31 64 38 61 62 20 37 35 65 62 34 64 63 61 31 33 35 39 37 38 61 33 22 2c 6e 3a 22 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 20 30 30 30 30 30 30 30 30 30 Data Ascii: sha256,gRed:!1,g:["9"]});k("ed25519",{type:"edwards",prime:"p25519",p:"7fffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffed",a:"-1",c:"1",d:"52036cee2b6ffe73 8cc740797779e898 00700a4d4141d8ab 75eb4dca135978a3",n:"1000000000000000 000000000
2022-04-01 15:32:05 UTC	639	IN	Data Raw: 69 6c 28 64 2e 6e 2e 62 69 74 4c 65 6e 67 74 68 28 29 2f 38 29 3b 74 68 69 73 2e 68 61 73 68 3d 6b 2e 73 68 61 35 31 32 7d 76 61 72 20 6b 3d 70 28 22 68 61 73 68 2e 6a 73 22 29 2c 63 3d 70 28 22 2e 2e 2f 2e 2e 2f 65 6c 6c 69 70 74 69 63 22 29 2c 66 3d 63 2e 75 74 69 6c 73 2c 61 3d 66 2e 61 73 73 65 72 74 2c 62 3d 66 2e 70 61 72 73 65 42 79 74 65 73 2c 71 3d 70 28 22 2e 2f 6b 65 79 22 29 2c 68 3d 70 28 22 2e 2f 73 69 67 6e 61 74 75 72 65 22 29 3b 72 2e 65 78 70 6f 72 74 73 3d 67 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 69 67 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 63 29 7b 61 3d 62 28 61 29 3b 76 61 72 20 66 3d 74 68 69 73 2e 6b 65 79 46 72 6f 6d 53 65 63 72 65 74 28 63 29 2c 68 3d 74 68 69 73 2e 68 61 73 68 49 6e 74 28 66 2e 6d 65 73 73 61 67 65 50 72 65 Data Ascii: il(d.n.bitLength()/8);this.hash=k.sha512}var k=p("hash.js"),c=p("../../elliptic"),f=c.utils,a=f.assert,b=f.parseBytes,q=p("./key"),h=p("./signature");r.exports=g;g.prototype.sign=function(a,c){a=b(a);var f=this.keyFromSecret(c),h=this.hashInt(f.messagePre
2022-04-01 15:32:05 UTC	646	IN	Data Raw: 33 31 33 62 61 34 38 65 35 31 64 35 36 37 35 34 33 66 32 61 31 38 32 30 33 31 65 66 64 36 39 31 35 64 64 63 30 37 62 62 63 63 34 65 31 36 30 37 30 22 2c 0a 22 37 33 37 30 66 39 31 63 66 62 36 37 65 34 66 35 30 38 31 38 30 39 66 61 32 35 64 34 30 66 39 62 31 37 33 35 64 62 66 37 63 30 61 31 31 61 31 33 30 63 30 64 31 61 30 34 31 65 31 37 37 65 61 31 22 5d 2c 5b 22 39 30 61 64 38 35 62 33 38 39 64 36 62 39 33 36 34 36 33 66 39 64 30 35 31 32 36 37 38 64 65 32 30 38 63 63 33 33 30 62 31 31 33 30 37 66 66 66 61 62 37 61 63 36 33 65 33 66 62 30 34 65 64 34 22 2c 22 65 35 30 37 61 33 36 32 30 61 33 38 32 36 31 61 66 66 64 63 62 64 39 34 32 37 32 32 32 62 38 33 39 61 65 66 61 62 65 31 35 38 32 38 39 34 64 39 39 31 64 34 64 34 38 63 62 36 65 66 31 35 30 22 5d 2c Data Ascii: 313ba48e51d567543f2a182031efd6915ddc07bbcc4e16070","7370f91cfb67e4f5081809fa25d40f9b1735dbf7c0a11a130c0d1a041e177ea1"],["90ad85b389d6b936463f9d0512678de208cc330b11307fffab7ac63e3fb04ed4","e507a3620a38261affdcbd9427222b839aefabe1582894d991d4d48cb6ef150"],
2022-04-01 15:32:05 UTC	654	IN	Data Raw: 31 32 39 34 39 63 39 61 22 5d 2c 5b 22 37 37 66 32 33 30 39 33 36 65 65 38 38 63 62 62 64 37 33 64 66 39 33 30 64 36 34 37 30 32 65 66 38 38 31 64 38 31 31 65 30 65 31 34 39 38 65 32 66 31 63 31 33 65 62 31 66 63 33 34 35 64 37 34 22 2c 22 39 35 38 65 66 34 32 61 37 38 38 36 62 36 34 30 30 61 30 38 32 36 36 65 39 62 61 31 62 33 37 38 39 36 63 39 35 33 33 30 64 39 37 30 37 37 63 62 62 65 38 65 62 33 63 37 36 37 31 63 36 30 64 36 22 5d 2c 5b 22 66 32 64 61 63 39 39 31 63 63 34 63 65 34 62 39 65 61 34 34 38 38 37 65 35 63 37 63 30 62 63 65 35 38 63 38 30 30 37 34 61 62 39 64 34 64 62 61 65 62 32 38 35 33 31 62 37 37 33 39 66 35 33 30 22 2c 22 65 30 64 65 64 63 39 62 33 62 32 66 38 64 61 64 34 64 61 31 66 33 32 64 65 63 32 35 33 31 64 66 39 65 62 35 66 62 65 Data Ascii: 12949c9a"],["77f230936ee88cbbd73df930d64702ef881d811e0e1498e2f1c13eb1fc345d74","958ef42a7886b6400a08266e9ba1b37896c95330d97077cbbe8eb3c7671c60d6"],["f2dac991cc4ce4b9ea44887e5c7c0bce58c80074ab9d4dbaeb28531b7739f530","e0dedc9b3b2f8dad4da1f32dec2531df9eb5fbe
2022-04-01 15:32:05 UTC	662	IN	Data Raw: 62 37 34 65 33 61 63 31 66 31 62 31 33 22 5d 2c 5b 22 63 35 33 33 65 34 66 37 65 61 38 35 35 35 61 61 63 64 39 37 37 37 61 63 35 63 61 64 32 39 62 39 37 64 64 34 64 65 66 63 63 63 35 33 65 65 37 65 61 32 30 34 31 31 39 62 32 38 38 39 62 31 39 37 22 2c 0a 22 36 66 30 61 32 35 36 62 63 35 65 66 64 66 34 32 39 61 32 66 62 36 32 34 32 66 31 61 34 33 61 32 64 39 62 39 32 35 62 62 34 61 34 62 33 61 32 36 62 62 38 65 30 66 34 35 65 62 35 39 36 30 39 36 22 5d 2c 5b 22 63 31 34 66 38 66 32 63 63 62 32 37 64 36 66 31 30 39 66 36 64 30 38 64 30 33 63 63 39 36 61 36 39 62 61 38 63 33 34 65 65 63 30 37 62 62 63 66 35 36 36 64 34 38 65 33 33 64 61 36 35 39 33 22 2c 22 63 33 35 39 64 36 39 32 33 62 62 33 39 38 66 37 66 64 34 34 37 33 65 31 36 66 65 31 63 32 38 34 37 35 Data Ascii: b74e3ac1f1b13"],["c533e4f7ea8555aacd9777ac5cad29b97dd4defccc53ee7ea204119b2889b197","6f0a256bc5efdf429a2fb6242f1a43a2d9b925bb4a4b3a26bb8e0f45eb596096"],["c14f8f2ccb27d6f109f6d08d03cc96a69ba8c34eec07bbcf566d48e33da6593","c359d6923bb398f7fd4473e16fe1c28475
2022-04-01 15:32:05 UTC	670	IN	Data Raw: 69 66 28 6e 75 6c 6c 21 3d 3d 65 29 7b 69 66 28 22 6c 65 22 3d 3d 3d 57 7c 7c 22 62 65 22 3d 3d 3d 57 29 62 3d 57 2c 57 3d 31 30 3b 74 68 69 73 2e 5f 69 6e 69 74 28 65 7c 7c 30 2c 57 7c 7c 31 30 2c 62 7c 7c 22 62 65 22 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 61 2c 62 29 7b 76 61 72 20 64 3d 30 3b 66 6f 72 28 62 3d 4d 61 74 68 2e 6d 69 6e 28 65 2e 6c 65 6e 67 74 68 2c 62 29 3b 61 3c 62 3b 61 2b 2b 29 76 61 72 20 63 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 61 29 2d 34 38 2c 64 3d 64 3c 3c 34 2c 64 3d 34 39 3c 3d 63 26 26 35 34 3e 3d 63 3f 64 7c 63 2d 34 39 2b 31 30 3a 31 37 3c 3d 63 26 26 32 32 3e 3d 63 3f 64 7c 0a 63 2d 31 37 2b 31 30 3a 64 7c 63 26 31 35 3b 72 65 74 75 72 6e 20 64 7d 66 75 6e 63 74 69 6f 6e 20 71 28 65 2c 61 2c 62 2c 64 29 7b 76 Data Ascii: if(null!==e){if("le"===W\|\|"be"===W)b=W,W=10;this._init(e\|\|0,W\|\|10,b\|\|"be")}}function b(e,a,b){var d=0;for(b=Math.min(e.length,b);a<b;a++)var c=e.charCodeAt(a)-48,d=d<<4,d=49<=c&&54>=c?d\|c-49+10:17<=c&&22>=c?d\|c-17+10:d\|c&15;return d}function q(e,a,b,d){v
2022-04-01 15:32:05 UTC	677	IN	Data Raw: 61 2e 70 72 6f 74 6f 74 79 70 65 2e 62 79 74 65 4c 65 6e 67 74 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4d 61 74 68 2e 63 65 69 6c 28 74 68 69 73 2e 62 69 74 4c 65 6e 67 74 68 28 29 2f 38 29 7d 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 54 77 6f 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 30 21 3d 3d 74 68 69 73 2e 6e 65 67 61 74 69 76 65 3f 74 68 69 73 2e 61 62 73 28 29 2e 69 6e 6f 74 6e 28 65 29 2e 69 61 64 64 6e 28 31 29 3a 74 68 69 73 2e 63 6c 6f 6e 65 28 29 7d 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 66 72 6f 6d 54 77 6f 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 65 73 74 6e 28 65 2d 31 29 3f 74 68 69 73 2e 6e 6f 74 6e 28 65 29 2e 69 61 64 64 6e 28 31 29 2e 69 6e 65 67 28 29 Data Ascii: a.prototype.byteLength=function(){return Math.ceil(this.bitLength()/8)};a.prototype.toTwos=function(e){return 0!==this.negative?this.abs().inotn(e).iaddn(1):this.clone()};a.prototype.fromTwos=function(e){return this.testn(e-1)?this.notn(e).iaddn(1).ineg()
2022-04-01 15:32:05 UTC	685	IN	Data Raw: 74 68 2e 69 6d 75 6c 28 67 2c 52 29 7c 30 3b 65 3d 65 2b 4d 61 74 68 2e 69 6d 75 6c 28 67 2c 61 61 29 7c 30 3b 65 3d 65 2b 4d 61 74 68 2e 69 6d 75 6c 28 70 2c 52 29 7c 30 3b 61 3d 61 2b 4d 61 74 68 2e 69 6d 75 6c 28 70 2c 61 61 29 7c 30 3b 6d 3d 6d 2b 4d 61 74 68 2e 69 6d 75 6c 28 71 2c 53 29 7c 30 3b 65 3d 65 2b 4d 61 74 68 2e 69 6d 75 6c 28 71 2c 62 61 29 7c 30 3b 65 3d 65 2b 4d 61 74 68 2e 69 6d 75 6c 28 6c 2c 53 29 7c 30 3b 61 3d 61 2b 4d 61 74 68 2e 69 6d 75 6c 28 6c 2c 62 61 29 7c 30 3b 76 61 72 20 69 61 3d 28 68 2b 6d 7c 30 29 2b 28 28 65 26 38 31 39 31 29 3c 3c 31 33 29 7c 30 2c 68 3d 28 61 2b 28 65 3e 3e 3e 31 33 29 7c 30 29 2b 28 69 61 3e 3e 3e 0a 32 36 29 7c 30 2c 69 61 3d 69 61 26 36 37 31 30 38 38 36 33 3b 6d 3d 4d 61 74 68 2e 69 6d 75 6c 28 Data Ascii: th.imul(g,R)\|0;e=e+Math.imul(g,aa)\|0;e=e+Math.imul(p,R)\|0;a=a+Math.imul(p,aa)\|0;m=m+Math.imul(q,S)\|0;e=e+Math.imul(q,ba)\|0;e=e+Math.imul(l,S)\|0;a=a+Math.imul(l,ba)\|0;var ia=(h+m\|0)+((e&8191)<<13)\|0,h=(a+(e>>>13)\|0)+(ia>>>26)\|0,ia=ia&67108863;m=Math.imul(
2022-04-01 15:32:05 UTC	693	IN	Data Raw: 74 69 6f 6e 28 61 2c 62 2c 64 29 7b 69 66 28 21 28 31 3e 3d 64 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 64 2f 32 3b 63 2b 2b 29 7b 76 61 72 20 66 3d 61 5b 63 5d 3b 61 5b 63 5d 3d 61 5b 64 2d 63 2d 31 5d 3b 61 5b 64 2d 63 2d 31 5d 3d 66 3b 66 3d 62 5b 63 5d 3b 62 5b 63 5d 3d 2d 62 5b 64 2d 63 2d 31 5d 3b 62 5b 64 2d 63 2d 31 5d 3d 2d 66 7d 7d 3b 64 2e 70 72 6f 74 6f 74 79 70 65 2e 6e 6f 72 6d 61 6c 69 7a 65 31 33 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 6f 72 28 76 61 72 20 64 3d 30 2c 63 3d 30 3b 63 3c 62 2f 32 3b 63 2b 2b 29 64 3d 38 31 39 32 2a 4d 61 74 68 2e 72 6f 75 6e 64 28 61 5b 32 2a 63 2b 31 5d 2f 62 29 2b 4d 61 74 68 2e 72 6f 75 6e 64 28 61 5b 32 2a 63 5d 2f 62 29 2b 64 2c 61 5b 63 5d 3d 64 26 36 37 31 30 38 38 36 33 2c 64 3d 36 Data Ascii: tion(a,b,d){if(!(1>=d))for(var c=0;c<d/2;c++){var f=a[c];a[c]=a[d-c-1];a[d-c-1]=f;f=b[c];b[c]=-b[d-c-1];b[d-c-1]=-f}};d.prototype.normalize13b=function(a,b){for(var d=0,c=0;c<b/2;c++)d=8192Math.round(a[2c+1]/b)+Math.round(a[2*c]/b)+d,a[c]=d&67108863,d=6
2022-04-01 15:32:05 UTC	700	IN	Data Raw: 2e 70 72 6f 74 6f 74 79 70 65 2e 65 67 63 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 28 30 3d 3d 3d 65 2e 6e 65 67 61 74 69 76 65 29 3b 63 28 21 65 2e 69 73 5a 65 72 6f 28 29 29 3b 76 61 72 20 62 3d 74 68 69 73 2c 64 3d 65 2e 63 6c 6f 6e 65 28 29 2c 62 3d 30 21 3d 3d 62 2e 6e 65 67 61 74 69 76 65 3f 62 2e 75 6d 6f 64 28 65 29 3a 62 2e 63 6c 6f 6e 65 28 29 3b 65 3d 6e 65 77 20 61 28 31 29 3b 66 6f 72 28 76 61 72 20 66 3d 6e 65 77 20 61 28 30 29 2c 68 3d 6e 65 77 20 61 28 30 29 2c 67 3d 6e 65 77 20 61 28 31 29 2c 71 3d 30 3b 62 2e 69 73 45 76 65 6e 28 29 26 26 64 2e 69 73 45 76 65 6e 28 29 3b 29 62 2e 69 75 73 68 72 6e 28 31 29 2c 0a 64 2e 69 75 73 68 72 6e 28 31 29 2c 2b 2b 71 3b 66 6f 72 28 76 61 72 20 6d 3d 64 2e 63 6c 6f 6e 65 28 29 2c 6c 3d 62 2e 63 Data Ascii: .prototype.egcd=function(e){c(0===e.negative);c(!e.isZero());var b=this,d=e.clone(),b=0!==b.negative?b.umod(e):b.clone();e=new a(1);for(var f=new a(0),h=new a(0),g=new a(1),q=0;b.isEven()&&d.isEven();)b.iushrn(1),d.iushrn(1),++q;for(var m=d.clone(),l=b.c
2022-04-01 15:32:05 UTC	708	IN	Data Raw: 75 62 28 62 29 3b 30 3e 64 2e 63 6d 70 6e 28 30 29 26 26 64 2e 69 61 64 64 28 74 68 69 73 2e 6d 29 3b 72 65 74 75 72 6e 20 64 7d 3b 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 68 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 74 68 69 73 2e 5f 76 65 72 69 66 79 31 28 61 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 6d 6f 64 28 61 2e 75 73 68 6c 6e 28 62 29 29 7d 3b 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6d 75 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 74 68 69 73 2e 5f 76 65 72 69 66 79 32 28 61 2c 62 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 6d 6f 64 28 61 2e 69 6d 75 6c 28 62 29 29 7d 3b 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 75 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 74 68 69 73 2e 5f 76 65 72 69 66 79 32 28 61 2c 62 29 3b 72 65 74 75 72 6e Data Ascii: ub(b);0>d.cmpn(0)&&d.iadd(this.m);return d};t.prototype.shl=function(a,b){this._verify1(a);return this.imod(a.ushln(b))};t.prototype.imul=function(a,b){this._verify2(a,b);return this.imod(a.imul(b))};t.prototype.mul=function(a,b){this._verify2(a,b);return
2022-04-01 15:32:05 UTC	716	IN	Data Raw: 31 5d 7d 2c 7b 22 2e 2e 2f 68 61 73 68 22 3a 31 39 7d 5d 2c 32 33 3a 5b 66 75 6e 63 74 69 6f 6e 28 70 2c 72 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 67 28 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 67 29 29 72 65 74 75 72 6e 20 6e 65 77 20 67 3b 57 2e 63 61 6c 6c 28 74 68 69 73 29 3b 74 68 69 73 2e 68 3d 5b 31 37 37 39 30 33 33 37 30 33 2c 33 31 34 34 31 33 34 32 37 37 2c 31 30 31 33 39 30 34 32 34 32 2c 32 37 37 33 34 38 30 37 36 32 2c 31 33 35 39 38 39 33 31 31 39 2c 32 36 30 30 38 32 32 39 32 34 2c 35 32 38 37 33 34 36 33 35 2c 31 35 34 31 34 35 39 32 32 35 5d 3b 74 68 69 73 2e 6b 3d 58 3b 74 68 69 73 2e 57 3d 41 72 72 61 79 28 36 34 29 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 Data Ascii: 1]},{"../hash":19}],23:[function(p,r,n){function g(){if(!(this instanceof g))return new g;W.call(this);this.h=[1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225];this.k=X;this.W=Array(64)}function k(){if(!(this instanc
2022-04-01 15:32:05 UTC	723	IN	Data Raw: 22 30 22 2b 61 3a 36 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 22 30 30 22 2b 61 3a 35 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 22 30 30 30 22 2b 61 3a 34 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 22 30 30 30 30 22 2b 61 3a 33 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 22 30 30 30 30 30 22 2b 61 3a 32 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 22 30 30 30 30 30 30 22 2b 61 3a 31 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 22 30 30 30 30 30 30 30 22 2b 61 3a 61 7d 66 75 6e 63 74 69 6f 6e 20 66 28 61 2c 62 29 7b 69 66 28 21 61 29 74 68 72 6f 77 20 45 72 72 6f 72 28 62 7c 7c 22 41 73 73 65 72 74 69 6f 6e 20 66 61 69 6c 65 64 22 29 3b 7d 70 3d 70 28 22 69 6e 68 65 72 69 74 73 22 29 3b 6e 2e 74 6f 41 72 72 61 79 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 Data Ascii: "0"+a:6===a.length?"00"+a:5===a.length?"000"+a:4===a.length?"0000"+a:3===a.length?"00000"+a:2===a.length?"000000"+a:1===a.length?"0000000"+a:a}function f(a,b){if(!a)throw Error(b\|\|"Assertion failed");}p=p("inherits");n.toArray=function(a,b){if(Array.isArr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49794	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:06 UTC	730	OUT	GET /logon/LogonPoint/receiver/js/ctxs.core.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:06 UTC	732	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:54 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:44 GMT ETag: "1b360-5c74026a90a00" Accept-Ranges: bytes Content-Length: 111456 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:06 UTC	733	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 72 65 74 75 72 6e 22 54 72 75 65 22 3d 3d 43 54 58 53 2e 67 65 74 43 6f 6f 6b 69 65 28 22 69 73 47 61 74 65 77 61 79 53 65 73 73 69 6f 6e 22 29 7d 76 61 72 20 62 2c 61 2c 65 3b 77 69 6e 64 6f 77 2e 43 54 58 53 3d 77 69 6e 64 6f 77 2e 43 54 58 53 7c 7c 7b 7d 3b 43 54 58 53 2e 41 63 63 65 73 73 47 61 74 65 77 61 79 3d 7b 70 61 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 65 76 61 6c 28 61 29 7d 2c 69 6e 69 74 69 61 6c 69 7a 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 61 3d 62 3d 21 31 3b 65 3d 6e 75 6c 6c 3b 76 61 72 20 64 3d 43 54 58 53 2e 67 65 74 43 6f 6f 6b 69 65 28 22 43 59 43 59 4c 50 22 29 3b 6e 75 6c 6c 21 3d 64 26 26 28 65 3d 64 29 3b 6e 75 6c 6c 21 3d 65 3f 43 54 58 53 2e 73 Data Ascii: (function(){function c(){return"True"==CTXS.getCookie("isGatewaySession")}var b,a,e;window.CTXS=window.CTXS\|\|{};CTXS.AccessGateway={patch:function(a){eval(a)},initialize:function(){a=b=!1;e=null;var d=CTXS.getCookie("CYCYLP");null!=d&&(e=d);null!=e?CTXS.s
2022-04-01 15:32:06 UTC	740	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 73 65 74 55 73 65 72 41 75 74 68 65 6e 74 69 63 61 74 65 64 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 3d 61 7d 2c 69 73 57 65 62 56 69 65 77 4c 6f 67 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 0a 73 65 74 57 65 62 56 69 65 77 4c 6f 67 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 3d 61 3f 61 3a 21 31 7d 2c 69 73 42 72 6f 77 73 65 72 43 6c 6f 73 65 52 65 71 75 69 72 65 64 54 6f 45 6e 64 53 65 73 73 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 43 54 58 53 2e 67 65 74 43 6f 6f 6b 69 65 28 22 43 74 78 73 42 72 6f 77 73 65 72 43 6c 6f 73 65 54 6f 45 6e 64 53 65 73 73 69 6f 6e 22 29 7d 2c 73 65 74 42 72 6f 77 73 65 72 43 6c 6f 73 65 52 65 71 75 69 Data Ascii: unction(){return l},setUserAuthenticated:function(a){l=a},isWebViewLogon:function(){return r},setWebViewLogon:function(a){r=a?a:!1},isBrowserCloseRequiredToEndSession:function(){return!!CTXS.getCookie("CtxsBrowserCloseToEndSession")},setBrowserCloseRequi
2022-04-01 15:32:06 UTC	747	IN	Data Raw: 74 6f 72 65 29 3b 69 66 28 64 3d 43 54 58 53 2e 43 6f 6e 66 69 67 2e 67 65 74 53 65 63 6f 6e 64 61 72 79 53 74 6f 72 65 73 28 29 29 66 6f 72 28 76 61 72 20 63 20 69 6e 20 64 29 7b 43 54 58 53 2e 74 72 61 63 65 28 22 45 6e 75 6d 65 72 61 74 65 20 61 70 70 73 20 66 6f 72 20 73 65 63 6f 6e 64 61 72 79 20 73 74 6f 72 65 3a 22 2b 0a 63 29 3b 76 61 72 20 68 3d 64 5b 63 5d 3b 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 2e 65 6e 75 6d 65 72 61 74 65 52 65 73 6f 75 72 63 65 73 28 68 2c 61 28 68 29 2c 62 29 7d 7d 2c 62 29 7d 7d 3b 76 61 72 20 68 3d 30 2c 6c 3d 30 2c 6d 3d 30 3b 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 3d 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 7c 7c 7b 7d 3b 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 2e 72 65 66 72 65 73 68 Data Ascii: tore);if(d=CTXS.Config.getSecondaryStores())for(var c in d){CTXS.trace("Enumerate apps for secondary store:"+c);var h=d[c];CTXS.Environment.enumerateResources(h,a(h),b)}},b)}};var h=0,l=0,m=0;CTXS.Environment=CTXS.Environment\|\|{};CTXS.Environment.refresh
2022-04-01 15:32:07 UTC	776	IN	Data Raw: 29 7d 2c 69 73 42 72 6f 77 73 65 72 50 6c 75 67 69 6e 53 75 70 70 6f 72 74 65 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 74 68 69 73 2e 69 73 50 72 6f 74 6f 63 6f 6c 48 61 6e 64 6c 65 72 53 75 70 70 6f 72 74 65 64 28 29 26 26 0a 28 74 68 69 73 2e 69 73 4e 65 74 73 63 61 70 65 50 6c 75 67 69 6e 53 75 70 70 6f 72 74 65 64 28 29 7c 7c 74 68 69 73 2e 69 73 57 69 6e 64 6f 77 73 50 6c 61 74 66 6f 72 6d 28 29 26 26 74 68 69 73 2e 69 73 49 45 28 29 29 7d 2c 69 73 50 72 6f 74 6f 63 6f 6c 48 61 6e 64 6c 65 72 53 75 70 70 6f 72 74 65 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 43 54 58 53 2e 43 6f 6e 66 69 67 2e 67 65 74 43 6f 6e 66 69 67 56 61 6c 75 65 28 22 70 6c 75 67 69 6e 41 73 73 69 73 74 61 6e 74 2e 70 72 6f 74 6f 63 6f 6c 48 61 Data Ascii: )},isBrowserPluginSupported:function(){return!this.isProtocolHandlerSupported()&&(this.isNetscapePluginSupported()\|\|this.isWindowsPlatform()&&this.isIE())},isProtocolHandlerSupported:function(){var a=CTXS.Config.getConfigValue("pluginAssistant.protocolHa
2022-04-01 15:32:07 UTC	784	IN	Data Raw: 65 73 43 6c 69 65 6e 74 2e 63 68 72 6f 6d 65 41 70 70 52 65 71 75 65 73 74 52 65 73 6f 75 72 63 65 73 28 43 54 58 53 2e 43 6f 6e 66 69 67 2e 67 65 74 43 6f 6e 66 69 67 56 61 6c 75 65 28 22 73 74 6f 72 65 50 72 6f 78 79 2e 72 65 73 6f 75 72 63 65 73 50 72 6f 78 79 2e 6c 69 73 74 55 52 4c 22 29 29 7d 2c 70 6f 73 74 53 65 74 74 69 6e 67 73 54 6f 43 68 72 6f 6d 65 41 70 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 73 65 6e 64 4d 65 73 73 61 67 65 54 6f 43 68 72 6f 6d 65 41 70 70 28 7b 74 79 70 65 3a 22 43 68 72 6f 6d 65 41 70 70 50 72 65 66 65 72 65 6e 63 65 73 22 2c 64 61 74 61 3a 43 54 58 53 2e 43 6f 6e 66 69 67 2e 67 65 74 43 6f 6e 66 69 67 56 61 6c 75 65 28 22 70 6c 75 67 69 6e 41 73 73 69 73 74 61 6e 74 2e 68 74 6d 6c 35 2e 63 68 72 6f 6d 65 Data Ascii: esClient.chromeAppRequestResources(CTXS.Config.getConfigValue("storeProxy.resourcesProxy.listURL"))},postSettingsToChromeApp:function(){this._sendMessageToChromeApp({type:"ChromeAppPreferences",data:CTXS.Config.getConfigValue("pluginAssistant.html5.chrome
2022-04-01 15:32:07 UTC	822	IN	Data Raw: 30 31 32 33 34 35 36 37 38 39 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 22 2e 69 6e 64 65 78 4f 66 28 66 29 3b 69 66 28 30 21 3d 63 29 72 65 74 75 72 6e 20 63 7d 7d 7d 7d 29 28 6a 51 75 65 72 79 29 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 61 2c 62 2c 64 29 7b 69 66 28 64 29 7b 64 3d 62 2e 73 72 63 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2f 22 29 3b 76 61 72 20 65 3d 2d 31 3d 3d 64 3f 62 2e 73 72 63 3a 62 2e 73 72 63 2e 73 75 62 73 74 72 69 6e 67 28 64 2b 31 29 2c 67 3d 63 28 22 73 63 72 69 70 74 22 29 3b 66 6f 72 28 64 3d 30 3b 64 3c 67 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 72 3d 67 2e 65 71 Data Ascii: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz".indexOf(f);if(0!=c)return c}}}})(jQuery);(function(c){function b(a,b,d){if(d){d=b.src.lastIndexOf("/");var e=-1==d?b.src:b.src.substring(d+1),g=c("script");for(d=0;d<g.length;d++){var r=g.eq
2022-04-01 15:32:07 UTC	830	IN	Data Raw: 6e 64 65 78 4f 66 28 6b 5b 6c 5d 29 2c 2d 31 21 3d 68 26 26 28 6d 3d 6d 3c 3c 36 7c 68 29 3b 30 3d 3d 6b 2e 6c 65 6e 67 74 68 25 34 26 26 28 70 2e 70 75 73 68 28 6d 3e 3e 31 36 26 32 35 35 29 2c 70 2e 70 75 73 68 28 6d 3e 3e 38 26 32 35 35 29 2c 70 2e 70 75 73 68 28 6d 26 32 35 35 29 29 7d 6d 3d 75 2a 75 2a 77 2f 38 3b 77 3d 28 75 2b 75 25 33 32 29 2a 75 2f 38 3b 69 66 28 71 29 69 66 28 71 3d 63 28 22 23 73 63 72 61 74 63 68 63 61 6e 76 61 73 22 2b 75 29 5b 30 5d 29 7b 78 3d 71 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 29 3b 6e 3d 78 2e 63 72 65 61 74 65 49 6d 61 67 65 44 61 74 61 28 31 2c 31 29 3b 6d 3d 6e 2e 64 61 74 61 3b 6b 3d 77 3b 66 6f 72 28 6c 3d 30 3b 6c 3c 75 3b 6c 2b 2b 29 66 6f 72 28 77 3d 30 3b 77 3c 75 3b 77 2b 2b 29 6d 5b 30 5d 3d 70 Data Ascii: ndexOf(k[l]),-1!=h&&(m=m<<6\|h);0==k.length%4&&(p.push(m>>16&255),p.push(m>>8&255),p.push(m&255))}m=uuw/8;w=(u+u%32)*u/8;if(q)if(q=c("#scratchcanvas"+u)[0]){x=q.getContext("2d");n=x.createImageData(1,1);m=n.data;k=w;for(l=0;l<u;l++)for(w=0;w<u;w++)m[0]=p
2022-04-01 15:32:07 UTC	837	IN	Data Raw: 26 22 5b 22 3d 3d 3d 61 2e 74 6f 53 74 72 69 6e 67 28 29 2e 6d 61 74 63 68 28 22 5e 5c 5c 5b 22 29 5b 30 5d 3f 65 28 61 29 3a 28 64 26 26 64 2e 63 6c 6f 73 65 28 29 2c 61 3d 63 2e 70 61 72 73 65 4a 53 4f 4e 28 61 29 2c 6b 3d 7b 65 72 72 6f 72 49 64 3a 61 2e 65 72 72 6f 72 49 64 2c 73 75 67 67 65 73 74 52 65 73 74 61 72 74 3a 61 2e 73 75 67 67 65 73 74 52 65 73 74 61 72 74 7d 2c 43 54 58 53 2e 44 65 76 69 63 65 2e 69 73 43 69 74 72 69 78 43 68 72 6f 6d 65 41 70 70 28 29 26 26 67 26 26 43 54 58 53 2e 48 74 6d 6c 35 43 6c 69 65 6e 74 2e 70 6f 73 74 49 43 41 44 61 74 61 45 72 72 6f 72 54 6f 43 68 72 6f 6d 65 41 70 70 28 61 2e 65 72 72 6f 72 49 64 2c 62 2c 67 2e 75 6e 69 71 75 65 49 64 65 6e 74 69 66 69 65 72 29 2c 43 54 58 53 2e 45 76 65 6e 74 73 2e 70 75 62 Data Ascii: &"["===a.toString().match("^\\[")[0]?e(a):(d&&d.close(),a=c.parseJSON(a),k={errorId:a.errorId,suggestRestart:a.suggestRestart},CTXS.Device.isCitrixChromeApp()&&g&&CTXS.Html5Client.postICADataErrorToChromeApp(a.errorId,b,g.uniqueIdentifier),CTXS.Events.pub
2022-04-01 15:32:07 UTC	845	IN	Data Raw: 2c 41 70 70 6c 69 63 61 74 69 6f 6e 3a 7b 24 68 69 64 64 65 6e 46 72 61 6d 65 3a 63 28 22 23 69 63 61 2d 64 6f 77 6e 6c 6f 61 64 2d 63 6f 6e 74 61 69 6e 65 72 22 29 7d 2c 67 65 74 49 63 6f 6e 49 64 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 0a 61 2e 72 65 70 6c 61 63 65 28 2f 52 65 73 6f 75 72 63 65 73 5c 2f 49 63 6f 6e 5c 2f 28 5b 41 2d 5a 61 2d 7a 30 2d 39 5d 2a 29 2e 2a 2f 2c 22 24 31 22 29 3a 22 6e 6f 6e 65 22 7d 2c 69 73 51 75 65 72 79 53 74 72 69 6e 67 50 61 72 61 6d 44 65 66 69 6e 65 64 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 2d 31 3c 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 2e 69 6e 64 65 78 4f 66 28 61 29 7d 2c 69 73 48 61 73 68 50 61 72 61 6d 44 65 66 69 6e 65 64 3a 66 75 6e 63 74 Data Ascii: ,Application:{$hiddenFrame:c("#ica-download-container")},getIconId:function(a){return a?a.replace(/Resources\/Icon\/([A-Za-z0-9])./,"$1"):"none"},isQueryStringParamDefined:function(a){return-1<window.location.search.indexOf(a)},isHashParamDefined:funct
2022-04-01 15:32:07 UTC	907	IN	Data Raw: 65 72 76 69 63 65 43 6c 69 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 6c 69 73 74 41 76 61 69 6c 61 62 6c 65 53 65 73 73 69 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 61 2c 63 2c 64 29 7b 24 2e 63 74 78 73 41 6a 61 78 28 7b 74 79 70 65 3a 22 50 4f 53 54 22 2c 75 72 6c 3a 62 2c 64 61 74 61 3a 61 2c 0a 64 61 74 61 54 79 70 65 3a 22 6a 73 6f 6e 22 2c 73 75 70 70 72 65 73 73 45 76 65 6e 74 73 3a 21 30 2c 73 75 63 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 6b 29 7b 6b 2e 67 65 74 52 65 73 70 6f 6e 73 65 48 65 61 64 65 72 28 43 54 58 53 2e 43 48 41 4c 4c 45 4e 47 45 5f 48 45 41 44 45 52 29 3f 43 54 58 53 2e 45 76 65 6e 74 73 2e 70 75 62 6c 69 73 68 28 43 54 58 53 2e 45 76 65 6e 74 73 2e 72 65 73 6f 75 72 63 65 73 2e 63 68 61 6c 6c 65 6e 67 65 64 Data Ascii: erviceClient.prototype={listAvailableSessions:function(b,a,c,d){$.ctxsAjax({type:"POST",url:b,data:a,dataType:"json",suppressEvents:!0,success:function(a,b,k){k.getResponseHeader(CTXS.CHALLENGE_HEADER)?CTXS.Events.publish(CTXS.Events.resources.challenged
2022-04-01 15:32:07 UTC	914	IN	Data Raw: 6e 63 65 6c 20 52 65 71 75 65 73 74 22 2c 43 61 6e 6e 6f 74 41 64 64 41 70 70 3a 27 43 61 6e 6e 6f 74 20 61 64 64 20 61 70 70 20 22 7b 30 7d 22 2e 27 2c 43 61 6e 6e 6f 74 41 64 64 41 70 70 54 69 74 6c 65 3a 22 43 61 6e 6e 6f 74 20 41 64 64 20 41 70 70 22 2c 43 61 6e 6e 6f 74 43 6f 6d 70 6c 65 74 65 59 6f 75 72 52 65 71 75 65 73 74 3a 22 43 61 6e 6e 6f 74 20 63 6f 6d 70 6c 65 74 65 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 22 2c 43 61 6e 6e 6f 74 44 65 74 65 63 74 52 65 63 65 69 76 65 72 49 6e 73 74 61 6c 6c 41 76 61 69 6c 61 62 6c 65 3a 22 57 65 20 63 6f 75 6c 64 6e 27 74 20 64 65 74 65 63 74 20 43 69 74 72 69 78 20 52 65 63 65 69 76 65 72 2e 20 44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 64 6f 77 6e 6c 6f 61 64 20 61 6e 64 20 69 6e 73 74 61 6c 6c 20 69 Data Ascii: ncel Request",CannotAddApp:'Cannot add app "{0}".',CannotAddAppTitle:"Cannot Add App",CannotCompleteYourRequest:"Cannot complete your request.",CannotDetectReceiverInstallAvailable:"We couldn't detect Citrix Receiver. Do you want to download and install i
2022-04-01 15:32:07 UTC	922	IN	Data Raw: 74 6c 65 3a 22 53 45 43 55 52 49 54 59 20 49 4e 46 4f 52 4d 41 54 49 4f 4e 22 2c 53 65 73 73 69 6f 6e 45 78 70 69 72 65 73 49 6e 4d 69 6e 75 74 65 73 3a 22 43 69 74 72 69 78 20 52 65 63 65 69 76 65 72 20 77 69 6c 6c 20 74 69 6d 65 20 6f 75 74 20 69 6e 20 7b 30 7d 20 6d 69 6e 75 74 65 73 20 61 6e 64 20 7b 31 7d 20 73 65 63 6f 6e 64 73 20 64 75 65 20 74 6f 20 69 6e 61 63 74 69 76 69 74 79 2e 22 2c 53 65 73 73 69 6f 6e 45 78 70 69 72 65 73 49 6e 53 65 63 6f 6e 64 73 3a 22 43 69 74 72 69 78 20 52 65 63 65 69 76 65 72 20 77 69 6c 6c 20 74 69 6d 65 20 6f 75 74 20 69 6e 20 7b 30 7d 20 73 65 63 6f 6e 64 73 20 64 75 65 20 74 6f 20 69 6e 61 63 74 69 76 69 74 79 2e 22 2c 53 65 73 73 69 6f 6e 73 4c 69 73 74 46 61 69 6c 75 72 65 3a 22 43 61 6e 6e 6f 74 20 73 74 61 72 Data Ascii: tle:"SECURITY INFORMATION",SessionExpiresInMinutes:"Citrix Receiver will time out in {0} minutes and {1} seconds due to inactivity.",SessionExpiresInSeconds:"Citrix Receiver will time out in {0} seconds due to inactivity.",SessionsListFailure:"Cannot star
2022-04-01 15:32:07 UTC	930	IN	Data Raw: 6e 20 55 62 75 6e 74 75 20 4f 53 29 22 2c 0a 22 49 66 5f 74 68 65 5f 41 63 63 65 73 73 5f 47 61 74 65 77 61 79 5f 50 6c 75 67 2d 69 6e 5f 69 73 5f 6e 6f 74 5f 69 6e 73 74 61 6c 6c 65 64 22 3a 22 54 68 65 20 43 69 74 72 69 78 20 47 61 74 65 77 61 79 20 50 6c 75 67 2d 69 6e 20 69 73 20 65 69 74 68 65 72 20 6e 6f 74 20 69 6e 73 74 61 6c 6c 65 64 20 6f 72 20 72 65 71 75 69 72 65 73 20 75 70 64 61 74 69 6e 67 2e 22 2c 54 6f 5f 69 6e 73 74 61 6c 6c 5f 74 68 65 5f 4e 65 74 73 63 61 6c 65 72 5f 41 63 63 65 73 73 5f 47 61 74 65 77 61 79 5f 43 6c 69 65 6e 74 5f 66 6f 72 5f 4d 61 63 3a 22 50 6c 65 61 73 65 20 64 6f 77 6e 6c 6f 61 64 20 61 6e 64 20 72 75 6e 20 74 68 65 20 70 6c 75 67 2d 69 6e 20 69 6e 73 74 61 6c 6c 65 72 2e 20 54 68 65 20 70 6c 75 67 2d 69 6e 20 63 Data Ascii: n Ubuntu OS)","If_the_Access_Gateway_Plug-in_is_not_installed":"The Citrix Gateway Plug-in is either not installed or requires updating.",To_install_the_Netscaler_Access_Gateway_Client_for_Mac:"Please download and run the plug-in installer. The plug-in c
2022-04-01 15:32:07 UTC	938	IN	Data Raw: 22 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 63 68 61 6e 67 65 20 74 68 65 20 70 61 73 73 77 6f 72 64 2e 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 22 3a 22 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 63 68 61 6e 67 65 20 74 68 65 20 70 61 73 73 77 6f 72 64 2e 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 22 2c 22 4f 6e 65 20 6f 66 20 74 68 65 20 66 69 65 6c 64 73 20 69 73 20 65 6d 70 74 79 2e 20 50 6c 65 61 73 65 20 65 6e 74 65 72 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 2c 20 61 6e 64 20 6e 65 77 20 70 61 73 73 77 6f 72 64 20 74 77 69 63 65 2e 22 3a 22 4f 6e Data Ascii: "You are not allowed to change the password. Please contact your admin for details.":"You are not allowed to change the password. Please contact your admin for details.","One of the fields is empty. Please enter your password, and new password twice.":"On
2022-04-01 15:32:07 UTC	945	IN	Data Raw: 6c 65 61 73 65 5f 73 75 70 70 6c 79 5f 65 69 74 68 65 72 5f 64 6f 6d 61 69 6e 5c 5c 75 73 65 72 6e 61 6d 65 5f 6f 72 5f 75 73 65 72 40 66 75 6c 6c 79 2e 71 75 61 6c 69 66 69 65 64 2e 64 6f 6d 61 69 6e 22 3a 22 44 6f 6d 61 69 6e 5c 5c 75 73 65 72 6e 61 6d 65 20 6f 72 20 75 73 65 72 40 64 6f 6d 61 69 6e 2e 63 6f 6d 22 2c 73 69 6e 67 6c 65 61 75 74 68 70 61 73 73 77 6f 72 64 72 65 73 65 74 5f 72 65 6d 65 6d 62 65 72 5f 6d 79 5f 70 61 73 73 77 6f 72 64 3a 22 52 65 6d 65 6d 62 65 72 20 6d 79 20 70 61 73 73 77 6f 72 64 22 2c 73 69 6e 67 6c 65 61 75 74 68 70 61 73 73 77 6f 72 64 72 65 73 65 74 5f 75 73 65 72 5f 6e 61 6d 65 3a 22 55 73 65 72 20 6e 61 6d 65 3a 22 2c 73 69 6e 67 6c 65 61 75 74 68 70 61 73 73 77 6f 72 64 72 65 73 65 74 5f 66 6f 72 67 6f 74 5f 70 61 Data Ascii: lease_supply_either_domain\\username_or_user@fully.qualified.domain":"Domain\\username or user@domain.com",singleauthpasswordreset_remember_my_password:"Remember my password",singleauthpasswordreset_user_name:"User name:",singleauthpasswordreset_forgot_pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49795	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:06 UTC	731	OUT	GET /logon/LogonPoint/receiver/js/ctxs.webui.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:06 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:54 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:56 GMT ETag: "44a79-5c74027602500" Accept-Ranges: bytes Content-Length: 281209 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:06 UTC	756	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 77 69 6e 64 6f 77 2e 43 54 58 53 3d 77 69 6e 64 6f 77 2e 43 54 58 53 7c 7c 7b 7d 3b 76 61 72 20 65 3d 30 2c 61 3d 5b 5d 3b 43 54 58 53 2e 43 61 74 65 67 6f 72 79 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 43 54 58 53 2e 43 61 74 65 67 6f 72 79 29 29 72 65 74 75 72 6e 20 6e 65 77 20 43 54 58 53 2e 43 61 74 65 67 6f 72 79 28 62 29 3b 74 68 69 73 2e 6e 61 6d 65 3d 62 3b 74 68 69 73 2e 61 70 70 73 3d 5b 5d 3b 74 68 69 73 2e 69 6e 64 65 78 3d 65 3b 61 2e 70 75 73 68 28 74 68 69 73 29 3b 69 66 28 74 68 69 73 2e 6e 61 6d 65 3d 3d 43 54 58 53 2e 43 61 74 65 67 6f 72 79 2e 43 41 54 45 47 4f 52 59 5f 4f 54 48 45 52 29 74 68 69 73 2e 70 6e 61 6d 65 3d 74 68 69 73 2e 64 Data Ascii: (function(c){window.CTXS=window.CTXS\|\|{};var e=0,a=[];CTXS.Category=function(b){if(!(this instanceof CTXS.Category))return new CTXS.Category(b);this.name=b;this.apps=[];this.index=e;a.push(this);if(this.name==CTXS.Category.CATEGORY_OTHER)this.pname=this.d
2022-04-01 15:32:06 UTC	763	IN	Data Raw: 68 75 72 6c 2c 74 3d 43 54 58 53 2e 67 65 74 43 53 52 46 54 6f 6b 65 6e 28 29 2c 75 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 6e 75 6c 6c 21 3d 74 26 26 28 72 3d 43 54 58 53 2e 75 70 64 61 74 65 51 75 65 72 79 53 74 72 69 6e 67 28 72 2c 22 43 73 72 66 54 6f 6b 65 6e 22 2c 74 29 2c 72 3d 43 54 58 53 2e 75 70 64 61 74 65 51 75 65 72 79 53 74 72 69 6e 67 28 72 2c 22 49 73 55 73 69 6e 67 48 74 74 70 73 22 2c 43 54 58 53 2e 69 73 55 73 69 6e 67 48 74 74 70 73 28 29 29 29 3b 43 54 58 53 2e 45 76 65 6e 74 73 2e 70 75 62 6c 69 73 68 28 43 54 58 53 2e 45 76 65 6e 74 73 2e 73 65 73 73 69 6f 6e 2e 72 65 66 72 65 73 68 65 64 29 3b 73 77 69 74 63 68 28 6d 29 7b 63 61 73 65 20 43 54 58 53 2e 4c 61 75 6e 63 68 4d 65 74 68 6f 64 2e 48 54 4d 4c 35 Data Ascii: hurl,t=CTXS.getCSRFToken(),u=(new Date).getTime();null!=t&&(r=CTXS.updateQueryString(r,"CsrfToken",t),r=CTXS.updateQueryString(r,"IsUsingHttps",CTXS.isUsingHttps()));CTXS.Events.publish(CTXS.Events.session.refreshed);switch(m){case CTXS.LaunchMethod.HTML5
2022-04-01 15:32:07 UTC	791	IN	Data Raw: 65 3b 6b 3d 44 2e 6c 65 6e 67 74 68 2b 78 2e 6c 65 6e 67 74 68 3b 5a 3d 67 3d 3d 3d 6b 7c 7c 6c 3d 3d 3d 6b 3f 4d 3d 21 31 3a 4d 3d 21 30 3b 4f 3d 44 2e 73 6c 69 63 65 28 29 3b 43 54 58 53 2e 45 78 74 65 6e 73 69 6f 6e 73 48 65 61 64 2e 66 69 6c 74 65 72 41 6c 6c 41 70 70 73 44 69 73 70 6c 61 79 28 4f 2c 0a 63 2e 6e 6f 6f 70 29 3b 43 54 58 53 2e 45 78 74 65 6e 73 69 6f 6e 73 48 65 61 64 2e 66 69 6c 74 65 72 44 65 73 6b 74 6f 70 73 28 78 2c 66 28 78 29 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 61 29 7b 61 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 6e 75 6c 6c 3d 3d 62 3f 30 3a 31 3a 6e 75 6c 6c 3d 3d 62 3f 2d 31 3a 61 2e 6e 61 6d 65 2e 6c 6f 63 61 6c 65 43 6f 6d 70 61 72 65 28 62 2e 6e 61 6d 65 29 Data Ascii: e;k=D.length+x.length;Z=g===k\|\|l===k?M=!1:M=!0;O=D.slice();CTXS.ExtensionsHead.filterAllAppsDisplay(O,c.noop);CTXS.ExtensionsHead.filterDesktops(x,f(x))}function b(a){a.sort(function(a,b){return null==a?null==b?0:1:null==b?-1:a.name.localeCompare(b.name)
2022-04-01 15:32:07 UTC	799	IN	Data Raw: 73 2e 70 75 62 6c 69 73 68 28 43 54 58 53 2e 45 76 65 6e 74 73 2e 72 65 73 6f 75 72 63 65 73 2e 64 65 73 6b 74 6f 70 41 73 73 69 67 6e 65 64 2c 61 29 3b 43 28 61 2c 62 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 43 28 61 2c 62 29 7d 29 29 3a 43 28 61 2c 62 29 29 7d 2c 73 65 61 72 63 68 46 6f 72 41 70 70 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 43 54 58 53 2e 41 70 70 53 65 61 72 63 68 2e 73 65 61 72 63 68 46 6f 72 41 70 70 73 28 61 2c 44 29 7d 2c 73 65 61 72 63 68 46 6f 72 44 65 73 6b 74 6f 70 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 43 54 58 53 2e 41 70 70 53 65 61 72 63 68 2e 73 65 61 72 63 68 46 6f 72 41 70 70 73 28 61 2c 78 29 7d 2c 73 65 61 72 63 68 46 6f 72 4d 79 41 70 70 73 3a 66 75 6e 63 74 69 6f 6e 28 61 Data Ascii: s.publish(CTXS.Events.resources.desktopAssigned,a);C(a,b)},function(){C(a,b)})):C(a,b))},searchForApps:function(a){return CTXS.AppSearch.searchForApps(a,D)},searchForDesktops:function(a){return CTXS.AppSearch.searchForApps(a,x)},searchForMyApps:function(a
2022-04-01 15:32:07 UTC	807	IN	Data Raw: 22 61 72 69 61 2d 68 69 64 64 65 6e 22 2c 21 6b 29 3b 74 68 69 73 2e 24 63 61 6e 63 65 6c 42 74 6e 2e 74 6f 67 67 6c 65 43 6c 61 73 73 28 22 73 68 6f 77 22 2c 71 29 3b 74 68 69 73 2e 24 63 61 6e 63 65 6c 42 74 6e 2e 61 74 74 72 28 22 61 72 69 61 2d 68 69 64 64 65 6e 22 2c 21 71 29 3b 61 2e 69 73 41 64 64 49 6e 50 72 6f 67 72 65 73 73 7c 7c 61 2e 69 73 52 65 6d 6f 76 65 49 6e 50 72 6f 67 72 65 73 73 7c 7c 28 62 26 26 6b 3f 74 68 69 73 2e 24 72 65 6d 6f 76 65 42 74 6e 2e 66 6f 63 75 73 28 29 3a 64 26 26 68 3f 74 68 69 73 2e 24 61 64 64 42 74 6e 2e 66 6f 63 75 73 28 29 3a 63 26 26 71 3f 74 68 69 73 2e 24 63 61 6e 63 65 6c 42 74 6e 2e 66 6f 63 75 73 28 29 3a 66 26 26 6c 3f 74 68 69 73 2e 24 72 65 71 75 65 73 74 42 74 6e 2e 66 6f 63 75 73 28 29 3a 74 68 69 73 Data Ascii: "aria-hidden",!k);this.$cancelBtn.toggleClass("show",q);this.$cancelBtn.attr("aria-hidden",!q);a.isAddInProgress\|\|a.isRemoveInProgress\|\|(b&&k?this.$removeBtn.focus():d&&h?this.$addBtn.focus():c&&q?this.$cancelBtn.focus():f&&l?this.$requestBtn.focus():this
2022-04-01 15:32:07 UTC	814	IN	Data Raw: 54 6f 55 49 45 76 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 61 2e 24 70 72 65 76 42 75 74 74 6f 6e 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 7d 29 3b 61 2e 24 6e 65 78 74 42 75 74 74 6f 6e 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 7d 29 3b 0a 61 2e 24 62 75 6e 64 6c 65 43 6f 6e 74 61 69 6e 65 72 2e 6f 6e 28 22 74 6f 75 63 68 73 74 61 72 74 2e 73 6c 69 63 6b 20 6d 6f 75 73 65 64 6f 77 6e 2e 73 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 7d 29 3b 61 2e 24 62 75 6e 64 6c 65 43 6f 6e 74 61 Data Ascii: ToUIEvents:function(){var a=this;a.$prevButton.on("click",function(a){a.preventDefault()});a.$nextButton.on("click",function(a){a.preventDefault()});a.$bundleContainer.on("touchstart.slick mousedown.slick",function(a){a.stopPropagation()});a.$bundleConta
2022-04-01 15:32:07 UTC	853	IN	Data Raw: 61 74 69 6f 6e 46 61 69 6c 75 72 65 28 29 7d 29 7d 7d 65 6c 73 65 20 74 68 69 73 2e 5f 64 69 73 70 6c 61 79 45 72 72 6f 72 50 6f 70 75 70 28 63 2e 6c 6f 63 61 6c 69 7a 61 74 69 6f 6e 2e 73 74 72 69 6e 67 28 74 68 69 73 2e 61 70 70 53 68 6f 72 74 63 75 74 52 65 73 6f 75 72 63 65 2e 69 73 64 65 73 6b 74 6f 70 3f 0a 22 43 61 6e 6e 6f 74 53 74 61 72 74 44 65 73 6b 74 6f 70 22 3a 22 43 61 6e 6e 6f 74 53 74 61 72 74 41 70 70 22 2c 74 68 69 73 2e 68 74 6d 6c 45 6e 63 6f 64 65 64 52 65 73 6f 75 72 63 65 4e 61 6d 65 29 29 7d 2c 70 72 6f 63 65 73 73 56 61 6c 69 64 61 74 69 6f 6e 53 75 63 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 63 29 7b 76 61 72 20 61 3d 63 2e 73 74 61 74 75 73 3d 3d 3d 43 54 58 53 2e 41 50 50 5f 53 48 4f 52 54 43 55 54 53 2e 56 41 4c 49 44 41 54 Data Ascii: ationFailure()})}}else this._displayErrorPopup(c.localization.string(this.appShortcutResource.isdesktop?"CannotStartDesktop":"CannotStartApp",this.htmlEncodedResourceName))},processValidationSuccess:function(c){var a=c.status===CTXS.APP_SHORTCUTS.VALIDAT
2022-04-01 15:32:07 UTC	861	IN	Data Raw: 22 44 65 74 61 69 6c 73 22 29 2b 22 3c 2f 61 3e 3c 2f 6c 69 3e 22 7d 0a 66 75 6e 63 74 69 6f 6e 20 62 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 62 2e 66 69 6e 64 28 27 2e 73 74 6f 72 65 61 70 70 5b 64 61 74 61 2d 73 68 6f 72 74 69 64 3d 22 27 2b 61 2e 73 68 6f 72 74 69 64 2b 27 22 5d 27 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 61 2c 64 29 7b 67 7c 7c 28 67 3d 6e 65 77 20 43 54 58 53 2e 41 6e 69 6d 61 74 65 64 53 70 69 6e 6e 65 72 29 3b 76 61 72 20 63 3d 62 28 61 2c 64 29 2e 66 69 6e 64 28 22 2e 73 74 6f 72 65 61 70 70 2d 6c 6f 61 64 69 6e 67 2d 6f 76 65 72 6c 61 79 22 29 2c 66 3d 63 2e 66 69 6e 64 28 22 2e 73 74 6f 72 65 61 70 70 2d 6c 6f 61 64 69 6e 67 2d 73 70 69 6e 6e 65 72 22 29 3b 67 2e 73 74 6f 70 28 66 2c 63 29 7d 76 61 72 20 67 3d 6e 75 6c 6c 2c 66 3d Data Ascii: "Details")+"</a></li>"}function b(a,b){return b.find('.storeapp[data-shortid="'+a.shortid+'"]')}function d(a,d){g\|\|(g=new CTXS.AnimatedSpinner);var c=b(a,d).find(".storeapp-loading-overlay"),f=c.find(".storeapp-loading-spinner");g.stop(f,c)}var g=null,f=
2022-04-01 15:32:07 UTC	868	IN	Data Raw: 3a 65 2e 6f 6e 54 72 79 41 67 61 69 6e 3b 65 3d 63 28 27 3c 61 20 68 72 65 66 3d 22 23 22 20 63 6c 61 73 73 3d 22 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 2d 6c 69 6e 6b 22 3e 27 2b 63 2e 6c 6f 63 61 6c 69 7a 61 74 69 6f 6e 2e 73 74 72 69 6e 67 28 65 2e 6f 74 68 65 72 4f 70 74 69 6f 6e 73 41 76 61 69 6c 61 62 6c 65 3f 0a 22 54 72 79 41 6e 6f 74 68 65 72 4c 6f 67 6f 6e 4f 70 74 69 6f 6e 22 3a 22 54 72 79 41 67 61 69 6e 22 29 2b 22 3c 2f 61 3e 22 29 3b 74 68 69 73 2e 24 63 6f 6e 74 61 69 6e 65 72 2e 61 70 70 65 6e 64 28 65 29 3b 65 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 61 28 29 7d 29 3b 65 2e 66 6f 63 75 73 28 29 7d 2c 73 68 6f 77 4e 6f 41 75 74 68 65 6e 74 69 63 61 Data Ascii: :e.onTryAgain;e=c('<a href="#" class="authentication-link">'+c.localization.string(e.otherOptionsAvailable?"TryAnotherLogonOption":"TryAgain")+"</a>");this.$container.append(e);e.on("click",function(b){b.preventDefault();a()});e.focus()},showNoAuthentica
2022-04-01 15:32:07 UTC	876	IN	Data Raw: 6e 28 29 7b 7d 2c 6f 6e 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 43 61 6e 63 65 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 7d 3b 43 54 58 53 2e 43 6f 6e 74 72 6f 6c 6c 65 72 73 2e 41 63 63 6f 75 6e 74 4d 61 6e 61 67 65 6d 65 6e 74 43 6f 6e 74 72 6f 6c 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 64 3d 74 68 69 73 3b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 3d 63 2e 65 78 74 65 6e 64 28 7b 7d 2c 65 2c 62 29 3b 74 68 69 73 2e 24 63 6f 6e 74 61 69 6e 65 72 3d 61 3b 74 68 69 73 2e 24 6f 76 65 72 6c 61 79 3d 63 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 6f 76 65 72 6c 61 79 53 65 6c 65 63 74 6f 72 29 3b 74 68 69 73 2e 69 73 47 61 74 65 77 61 79 53 65 73 73 69 6f 6e 3d 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 2e 69 73 47 61 74 65 77 61 79 Data Ascii: n(){},onAuthenticationCancel:function(){}};CTXS.Controllers.AccountManagementController=function(a,b){var d=this;this.options=c.extend({},e,b);this.$container=a;this.$overlay=c(this.options.overlaySelector);this.isGatewaySession=CTXS.Environment.isGateway
2022-04-01 15:32:07 UTC	884	IN	Data Raw: 6e 63 74 69 6f 6e 20 68 28 61 29 7b 72 65 74 75 72 6e 20 63 28 22 3c 73 65 6c 65 63 74 20 2f 3e 22 29 2e 61 74 74 72 28 22 69 64 22 2c 61 2e 63 72 65 64 65 6e 74 69 61 6c 2e 69 64 29 2e 61 74 74 72 28 22 6e 61 6d 65 22 2c 61 2e 63 72 65 64 65 6e 74 69 61 6c 2e 69 64 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 61 2c 62 29 7b 63 2e 65 61 63 68 28 61 2e 64 69 73 70 6c 61 79 56 61 6c 75 65 73 2c 66 75 6e 63 74 69 6f 6e 28 64 2c 68 29 7b 76 61 72 20 66 3d 63 28 22 3c 6f 70 74 69 6f 6e 2f 3e 22 29 3b 66 2e 74 65 78 74 28 68 2e 64 69 73 70 6c 61 79 29 3b 66 2e 61 74 74 72 28 22 76 61 6c 75 65 22 2c 68 2e 76 61 6c 75 65 29 3b 61 2e 69 6e 69 74 69 61 6c 53 65 6c 65 63 74 69 6f 6e 21 3d 68 2e 76 61 6c 75 65 26 26 31 21 3d 68 2e 73 65 6c 65 63 74 65 64 7c 7c 66 2e 61 74 Data Ascii: nction h(a){return c("<select />").attr("id",a.credential.id).attr("name",a.credential.id)}function l(a,b){c.each(a.displayValues,function(d,h){var f=c("<option/>");f.text(h.display);f.attr("value",h.value);a.initialSelection!=h.value&&1!=h.selected\|\|f.at
2022-04-01 15:32:07 UTC	891	IN	Data Raw: 73 2e 74 61 67 4e 61 6d 65 7c 7c 22 55 22 3d 3d 74 68 69 73 2e 74 61 67 4e 61 6d 65 7c 7c 22 75 22 3d 3d 74 68 69 73 2e 74 61 67 4e 61 6d 65 29 7b 76 61 72 20 64 3d 0a 63 28 22 3c 22 2b 74 68 69 73 2e 74 61 67 4e 61 6d 65 2b 22 2f 3e 22 29 3b 61 2e 61 70 70 65 6e 64 28 62 28 64 2c 63 28 74 68 69 73 29 2e 63 6f 6e 74 65 6e 74 73 28 29 29 29 7d 65 6c 73 65 20 43 54 58 53 2e 45 78 74 65 72 6e 61 6c 2e 72 65 70 6f 72 74 50 61 72 73 69 6e 67 45 72 72 6f 72 28 22 55 6e 73 75 70 70 6f 72 74 65 64 20 74 61 67 20 69 6e 20 61 20 6c 61 62 65 6c 3a 20 22 2b 74 68 69 73 2e 74 61 67 4e 61 6d 65 29 7d 29 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 64 28 61 2c 62 29 7b 61 2e 61 64 64 43 6c 61 73 73 28 22 6c 61 62 65 6c 22 29 3b 73 77 69 74 63 68 28 62 29 7b Data Ascii: s.tagName\|\|"U"==this.tagName\|\|"u"==this.tagName){var d=c("<"+this.tagName+"/>");a.append(b(d,c(this).contents()))}else CTXS.External.reportParsingError("Unsupported tag in a label: "+this.tagName)});return a}function d(a,b){a.addClass("label");switch(b){
2022-04-01 15:32:07 UTC	899	IN	Data Raw: 7b 24 28 64 6f 63 75 6d 65 6e 74 29 2e 6f 66 66 28 74 68 69 73 2e 63 6c 69 63 6b 45 76 65 6e 74 4e 61 6d 65 29 3b 74 68 69 73 2e 24 6d 65 6e 75 2e 68 69 64 65 28 29 3b 74 68 69 73 2e 24 6f 76 65 72 6c 61 79 2e 68 69 64 65 28 29 3b 0a 74 68 69 73 2e 24 6d 65 6e 75 54 6f 70 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 6f 70 65 6e 22 29 3b 74 68 69 73 2e 24 6d 65 6e 75 43 6f 6e 74 61 69 6e 65 72 2e 63 74 78 73 55 6e 62 69 6e 64 46 6f 63 75 73 57 69 74 68 69 6e 28 29 2e 63 74 78 73 44 69 73 61 62 6c 65 41 72 72 6f 77 4e 61 76 69 67 61 74 69 6f 6e 28 29 2e 63 74 78 73 55 6e 62 69 6e 64 48 6f 76 65 72 46 6f 63 75 73 45 76 65 6e 74 73 28 29 3b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 6f 6e 48 69 64 65 28 29 7d 2c 69 73 4f 70 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: {$(document).off(this.clickEventName);this.$menu.hide();this.$overlay.hide();this.$menuTop.removeClass("open");this.$menuContainer.ctxsUnbindFocusWithin().ctxsDisableArrowNavigation().ctxsUnbindHoverFocusEvents();this.options.onHide()},isOpen:function(){
2022-04-01 15:32:07 UTC	947	IN	Data Raw: 4f 62 6c 69 74 65 72 61 74 65 50 61 73 73 77 6f 72 64 28 29 7d 7d 7d 29 28 6a 51 75 65 72 79 29 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 77 69 6e 64 6f 77 2e 43 54 58 53 3d 77 69 6e 64 6f 77 2e 43 54 58 53 7c 7c 7b 7d 3b 43 54 58 53 2e 57 69 64 67 65 74 73 3d 43 54 58 53 2e 57 69 64 67 65 74 73 7c 7c 7b 7d 3b 76 61 72 20 65 3d 7b 6f 6e 52 65 6e 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 6f 6e 46 6f 6c 64 65 72 4e 61 6d 65 55 70 64 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 6f 6e 46 6f 6c 64 65 72 4e 61 6d 65 48 69 64 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 7d 2c 61 3d 5b 5d 2c 62 3d 63 28 22 2e 66 6f 6c 64 65 72 2d 72 75 6c 65 72 2d 63 6f 6e 74 61 69 6e 65 72 22 29 3b 43 54 58 53 2e 57 69 64 67 65 74 73 2e 46 6f 6c 64 65 72 73 57 69 Data Ascii: ObliteratePassword()}}})(jQuery);(function(c){window.CTXS=window.CTXS\|\|{};CTXS.Widgets=CTXS.Widgets\|\|{};var e={onRender:function(){},onFolderNameUpdate:function(){},onFolderNameHide:function(){}},a=[],b=c(".folder-ruler-container");CTXS.Widgets.FoldersWi
2022-04-01 15:32:07 UTC	954	IN	Data Raw: 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 66 69 6e 64 28 22 69 6e 70 75 74 3a 65 6e 61 62 6c 65 64 2c 20 2e 62 75 74 74 6f 6e 22 29 29 3b 61 26 26 28 61 2e 66 69 72 73 74 28 29 2e 66 6f 63 75 73 28 29 2c 61 2e 66 69 72 73 74 28 29 2e 68 61 73 43 6c 61 73 73 28 22 62 75 74 74 6f 6e 22 29 7c 7c 61 2e 66 69 72 73 74 28 29 2e 73 65 6c 65 63 74 28 29 29 7d 2c 5f 63 6f 6e 76 65 72 74 49 6e 70 75 74 46 6f 72 49 45 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 64 3d 74 68 69 73 2c 63 3d 61 2e 61 74 74 72 28 22 70 6c 61 63 65 68 6f 6c 64 65 72 22 29 3b 69 66 28 63 29 7b 76 61 72 20 66 3d 61 2e 61 74 74 72 28 22 69 64 22 29 2b 22 2d 70 6c 61 63 65 68 6f 6c 64 65 72 22 2c 6d 3d 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 73 65 75 64 6f 2d 69 6e 70 75 74 20 27 2b 28 61 Data Ascii: his.element.find("input:enabled, .button"));a&&(a.first().focus(),a.first().hasClass("button")\|\|a.first().select())},_convertInputForIE:function(a){var d=this,c=a.attr("placeholder");if(c){var f=a.attr("id")+"-placeholder",m='<div class="pseudo-input '+(a
2022-04-01 15:32:07 UTC	962	IN	Data Raw: 79 3d 61 2e 66 69 6e 64 28 22 23 72 65 66 72 65 73 68 2d 6f 76 65 72 6c 61 79 22 29 3b 74 68 69 73 2e 24 68 6f 6d 65 56 69 65 77 2e 63 74 78 73 44 69 73 70 6c 61 79 50 61 6e 65 28 29 3b 43 54 58 53 2e 44 65 76 69 63 65 2e 69 73 43 69 74 72 69 78 43 68 72 6f 6d 65 41 70 70 28 29 26 26 0a 43 54 58 53 2e 48 74 6d 6c 35 43 6c 69 65 6e 74 2e 70 6f 73 74 53 68 6f 77 41 63 63 6f 75 6e 74 53 65 74 74 69 6e 67 73 54 6f 43 68 72 6f 6d 65 41 70 70 28 29 3b 74 68 69 73 2e 5f 62 69 6e 64 54 6f 55 49 45 76 65 6e 74 73 28 29 3b 74 68 69 73 2e 5f 62 69 6e 64 54 6f 41 70 70 45 76 65 6e 74 73 28 29 3b 74 68 69 73 2e 61 75 74 6f 4d 65 73 73 61 67 65 57 69 64 67 65 74 3d 6e 65 77 20 43 54 58 53 2e 57 69 64 67 65 74 73 2e 41 75 74 6f 4d 65 73 73 61 67 65 57 69 64 67 65 74 28 Data Ascii: y=a.find("#refresh-overlay");this.$homeView.ctxsDisplayPane();CTXS.Device.isCitrixChromeApp()&&CTXS.Html5Client.postShowAccountSettingsToChromeApp();this._bindToUIEvents();this._bindToAppEvents();this.autoMessageWidget=new CTXS.Widgets.AutoMessageWidget(
2022-04-01 15:32:07 UTC	970	IN	Data Raw: 6f 77 4d 79 41 70 70 73 3d 74 68 69 73 2e 73 74 6f 72 65 2e 69 73 53 65 6c 66 53 65 72 76 69 63 65 45 6e 61 62 6c 65 64 28 29 7d 2c 5f 69 6e 69 74 69 61 6c 69 7a 65 4d 61 69 6e 56 69 65 77 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 75 70 64 61 74 65 54 61 62 73 41 76 61 69 6c 61 62 6c 65 56 61 6c 75 65 73 28 29 3b 43 54 58 53 2e 43 6f 6e 74 72 6f 6c 6c 65 72 73 2e 56 69 65 77 43 6f 6e 74 72 6f 6c 6c 65 72 2e 69 6e 69 74 69 61 6c 69 73 65 28 74 68 69 73 2e 24 62 6f 64 79 2c 74 68 69 73 2e 24 68 6f 6d 65 56 69 65 77 2e 66 69 6e 64 28 22 2e 74 6f 67 67 6c 65 2d 76 69 65 77 2d 62 75 74 74 6f 6e 22 29 2c 74 68 69 73 2e 24 68 6f 6d 65 56 69 65 77 2e 66 69 6e 64 28 22 2e 6d 79 61 70 70 73 2d 76 69 65 77 2e 74 6f 67 67 6c 65 2d 76 69 65 77 2d 62 75 Data Ascii: owMyApps=this.store.isSelfServiceEnabled()},_initializeMainViews:function(){this._updateTabsAvailableValues();CTXS.Controllers.ViewController.initialise(this.$body,this.$homeView.find(".toggle-view-button"),this.$homeView.find(".myapps-view.toggle-view-bu
2022-04-01 15:32:07 UTC	978	IN	Data Raw: 70 61 63 65 43 6f 6e 74 72 6f 6c 2e 69 73 41 6c 6c 6f 77 65 64 28 29 26 26 65 26 26 74 68 69 73 2e 77 6f 72 6b 73 70 61 63 65 43 6f 6e 74 72 6f 6c 2e 69 73 53 65 73 73 69 6f 6e 52 65 63 6f 6e 6e 65 63 74 41 6c 6c 6f 77 65 64 28 29 29 26 26 61 2e 70 75 73 68 28 7b 6c 69 6e 6b 49 64 3a 22 6d 65 6e 75 43 6f 6e 6e 65 63 74 42 74 6e 22 2c 6c 69 6e 6b 54 65 78 74 3a 63 2e 6c 6f 63 61 6c 69 7a 61 74 69 6f 6e 2e 73 74 72 69 6e 67 28 22 43 6f 6e 6e 65 63 74 22 29 2c 6f 6e 43 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 62 2e 77 6f 72 6b 73 70 61 63 65 43 6f 6e 74 72 6f 6c 2e 72 65 63 6f 6e 6e 65 63 74 41 70 70 53 65 73 73 69 6f 6e 73 28 29 7d 7d 29 2c 43 54 58 53 2e 45 78 74 65 6e 73 69 6f 6e 73 48 65 61 64 2e 73 68 6f 77 57 65 62 44 69 73 63 6f 6e 6e 65 63 74 Data Ascii: paceControl.isAllowed()&&e&&this.workspaceControl.isSessionReconnectAllowed())&&a.push({linkId:"menuConnectBtn",linkText:c.localization.string("Connect"),onClick:function(){b.workspaceControl.reconnectAppSessions()}}),CTXS.ExtensionsHead.showWebDisconnect
2022-04-01 15:32:07 UTC	979	IN	Data Raw: 2c 6e 75 6c 6c 21 3d 43 54 58 53 2e 4e 61 74 69 76 65 43 61 70 61 62 69 6c 69 74 69 65 73 2e 6d 65 6e 75 50 72 65 66 65 72 65 6e 63 65 73 2e 72 65 66 72 65 73 68 26 26 31 21 3d 43 54 58 53 2e 4e 61 74 69 76 65 43 61 70 61 62 69 6c 69 74 69 65 73 2e 6d 65 6e 75 50 72 65 66 65 72 65 6e 63 65 73 2e 72 65 66 72 65 73 68 7c 7c 61 2e 70 75 73 68 28 7b 6c 69 6e 6b 49 64 3a 22 72 65 66 72 65 73 68 42 74 6e 22 2c 6c 69 6e 6b 54 65 78 74 3a 63 2e 6c 6f 63 61 6c 69 7a 61 74 69 6f 6e 2e 73 74 72 69 6e 67 28 22 52 65 66 72 65 73 68 22 29 2c 61 72 69 61 4c 61 62 65 6c 3a 63 2e 6c 6f 63 61 6c 69 7a 61 74 69 6f 6e 2e 73 74 72 69 6e 67 28 22 52 65 66 72 65 73 68 22 29 2c 6f 6e 43 6c 69 63 6b 3a 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 2e 72 65 66 72 65 73 68 7d 29 Data Ascii: ,null!=CTXS.NativeCapabilities.menuPreferences.refresh&&1!=CTXS.NativeCapabilities.menuPreferences.refresh\|\|a.push({linkId:"refreshBtn",linkText:c.localization.string("Refresh"),ariaLabel:c.localization.string("Refresh"),onClick:CTXS.Environment.refresh})
2022-04-01 15:32:07 UTC	986	IN	Data Raw: 67 56 61 6c 75 65 28 22 70 6c 75 67 69 6e 41 73 73 69 73 74 61 6e 74 2e 65 6e 61 62 6c 65 64 22 29 2c 64 3d 43 54 58 53 2e 44 65 76 69 63 65 2e 69 73 57 69 6e 64 6f 77 73 50 6c 61 74 66 6f 72 6d 28 29 3f 64 3a 68 2c 62 3d 28 43 54 58 53 2e 44 65 76 69 63 65 2e 69 73 57 69 6e 64 6f 77 73 50 6c 61 74 66 6f 72 6d 28 29 3f 62 3a 63 29 7c 7c 22 22 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 58 3f 74 28 29 3a 22 74 72 75 65 22 3d 3d 43 54 58 53 2e 43 6f 6e 66 69 67 2e 67 65 74 43 6f 6e 66 69 67 56 61 6c 75 65 28 22 70 6c 75 67 69 6e 41 73 73 69 73 74 61 6e 74 2e 73 68 6f 77 41 66 74 65 72 4c 6f 67 69 6e 22 29 3f 6b 28 29 3a 28 46 2e 66 69 6e 64 28 22 2e 6c 6f 61 64 69 6e 67 2d 73 63 72 65 65 6e 22 29 2e 63 74 78 73 44 69 73 70 6c 61 79 50 61 6e 65 28 29 2c 0a 6c Data Ascii: gValue("pluginAssistant.enabled"),d=CTXS.Device.isWindowsPlatform()?d:h,b=(CTXS.Device.isWindowsPlatform()?b:c)\|\|"",c=function(){X?t():"true"==CTXS.Config.getConfigValue("pluginAssistant.showAfterLogin")?k():(F.find(".loading-screen").ctxsDisplayPane(),l
2022-04-01 15:32:07 UTC	993	IN	Data Raw: 6f 61 64 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 28 65 2c 61 29 7d 29 7d 2c 72 65 76 65 72 74 54 6f 44 65 66 61 75 6c 74 56 69 65 77 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 41 2e 73 65 74 44 65 66 61 75 6c 74 56 69 65 77 28 29 7d 7d 7d 29 28 6a 51 75 65 72 79 29 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 77 69 6e 64 6f 77 2e 43 54 58 53 3d 77 69 6e 64 6f 77 2e 43 54 58 53 7c 7c 7b 7d 3b 43 54 58 53 2e 57 69 64 67 65 74 73 3d 43 54 58 53 2e 57 69 64 67 65 74 73 7c 7c 7b 7d 3b 76 61 72 20 65 3d 7b 70 6f 6c 6c 49 6e 74 65 72 76 61 6c 4d 73 3a 35 30 30 2c 6f 6e 50 6c 75 67 69 6e 41 63 74 69 76 61 74 65 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 7d 3b 43 54 58 53 2e 57 69 64 67 65 74 73 2e 50 6c 75 67 69 6e 41 63 74 69 76 61 74 69 6f 6e 57 69 64 67 65 74 3d 66 75 Data Ascii: oadConfiguration(e,a)})},revertToDefaultView:function(){A.setDefaultView()}}})(jQuery);(function(c){window.CTXS=window.CTXS\|\|{};CTXS.Widgets=CTXS.Widgets\|\|{};var e={pollIntervalMs:500,onPluginActivated:function(){}};CTXS.Widgets.PluginActivationWidget=fu
2022-04-01 15:32:07 UTC	1001	IN	Data Raw: 74 69 6f 6e 73 2e 69 73 49 45 55 70 67 72 61 64 65 26 26 28 74 68 69 73 2e 24 73 65 63 75 72 69 74 79 44 65 74 61 69 6c 73 3d 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 66 69 6e 64 28 22 2e 73 65 63 75 72 69 74 79 64 65 74 61 69 6c 73 2d 70 6f 70 75 70 2d 69 65 22 29 2c 74 68 69 73 2e 24 73 65 63 75 72 69 74 79 44 65 74 61 69 6c 73 4c 69 6e 6b 3d 0a 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 66 69 6e 64 28 22 2e 73 65 63 75 72 69 74 79 64 65 74 61 69 6c 73 6c 69 6e 6b 22 29 2c 74 68 69 73 2e 24 73 65 63 75 72 69 74 79 44 65 74 61 69 6c 73 4c 69 6e 6b 2e 63 74 78 73 41 64 64 43 75 73 74 6f 6d 54 6f 6f 6c 74 69 70 28 74 68 69 73 2e 24 73 65 63 75 72 69 74 79 44 65 74 61 69 6c 73 2c 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 29 29 3b 74 68 69 73 2e 24 73 6b 69 70 Data Ascii: tions.isIEUpgrade&&(this.$securityDetails=this.$element.find(".securitydetails-popup-ie"),this.$securityDetailsLink=this.$element.find(".securitydetailslink"),this.$securityDetailsLink.ctxsAddCustomTooltip(this.$securityDetails,this.$element));this.$skip
2022-04-01 15:32:07 UTC	1008	IN	Data Raw: 28 29 7d 2c 74 72 69 67 67 65 72 44 6f 77 6e 6c 6f 61 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 63 6c 69 65 6e 74 49 6e 73 74 61 6c 6c 55 72 6c 7d 2c 67 65 74 43 6c 69 65 6e 74 44 65 74 65 63 74 69 6f 6e 54 69 63 6b 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 74 68 69 73 2e 70 6f 6c 6c 43 61 6e 63 65 6c 6c 65 64 3d 21 31 3b 43 54 58 53 2e 57 65 62 41 70 69 43 6c 69 65 6e 74 2e 67 65 74 43 6c 69 65 6e 74 44 65 74 65 63 74 69 6f 6e 54 69 63 6b 65 74 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 67 65 74 44 65 74 65 63 74 69 6f 6e 54 69 63 6b 65 74 55 72 6c 2c 0a 66 75 6e 63 74 69 6f 6e 28 62 2c 64 2c 63 29 7b 61 2e 70 6f 73 74 62 61 63 6b 55 72 6c 3d 62 Data Ascii: ()},triggerDownload:function(){location.href=this.options.clientInstallUrl},getClientDetectionTicket:function(){var a=this;this.pollCancelled=!1;CTXS.WebApiClient.getClientDetectionTicket(this.options.getDetectionTicketUrl,function(b,d,c){a.postbackUrl=b
2022-04-01 15:32:07 UTC	1016	IN	Data Raw: 69 6e 73 74 61 6c 6c 4d 65 73 73 61 67 65 3d 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 66 69 6e 64 28 22 2e 64 6f 77 6e 6c 6f 61 64 2d 69 6e 73 74 61 6c 6c 2d 72 65 63 65 69 76 65 72 22 29 3b 76 61 72 20 62 3d 27 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 65 74 61 69 6c 2d 74 65 78 74 2d 68 69 67 68 6c 69 67 68 74 22 3e 7b 30 7d 3c 2f 73 70 61 6e 3e 27 2e 66 6f 72 6d 61 74 28 63 2e 6c 6f 63 61 6c 69 7a 61 74 69 6f 6e 2e 73 74 72 69 6e 67 28 22 43 6f 6e 74 69 6e 75 65 22 29 29 3b 74 68 69 73 2e 24 69 6e 73 74 61 6c 6c 4d 65 73 73 61 67 65 2e 68 74 6d 6c 28 63 2e 6c 6f 63 61 6c 69 7a 61 74 69 6f 6e 2e 73 74 72 69 6e 67 28 22 49 6e 73 74 61 6c 6c 57 68 65 6e 44 6f 77 6e 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 22 2c 0a 62 29 29 3b 74 68 69 73 2e 6f 70 74 69 6f 6e Data Ascii: installMessage=this.$element.find(".download-install-receiver");var b='<span class="detail-text-highlight">{0}</span>'.format(c.localization.string("Continue"));this.$installMessage.html(c.localization.string("InstallWhenDownloadComplete",b));this.option
2022-04-01 15:32:07 UTC	1023	IN	Data Raw: 66 69 6e 64 28 22 2e 6c 65 67 61 6c 73 74 61 74 65 6d 65 6e 74 2d 63 68 65 63 6b 62 6f 78 22 29 3b 74 68 69 73 2e 24 61 63 63 65 70 74 54 65 72 6d 73 4d 65 73 73 61 67 65 3d 74 68 69 73 2e 24 76 69 65 77 2e 66 69 6e 64 28 22 2e 61 63 63 65 70 74 74 65 72 6d 73 2d 70 6f 70 75 70 22 29 3b 74 68 69 73 2e 24 73 65 63 75 72 69 74 79 44 65 74 61 69 6c 73 3d 74 68 69 73 2e 24 76 69 65 77 2e 66 69 6e 64 28 22 2e 73 65 63 75 72 69 74 79 64 65 74 61 69 6c 73 2d 70 6f 70 75 70 22 29 3b 74 68 69 73 2e 24 6c 69 63 65 6e 73 65 41 67 72 65 65 6d 65 6e 74 3d 74 68 69 73 2e 24 76 69 65 77 2e 66 69 6e 64 28 22 2e 6c 69 63 65 6e 73 65 61 67 72 65 65 6d 65 6e 74 2d 70 6f 70 75 70 22 29 3b 74 68 69 73 2e 24 6c 69 63 65 6e 73 65 4c 69 6e 6b 3d 74 68 69 73 2e 24 76 69 65 77 2e Data Ascii: find(".legalstatement-checkbox");this.$acceptTermsMessage=this.$view.find(".acceptterms-popup");this.$securityDetails=this.$view.find(".securitydetails-popup");this.$licenseAgreement=this.$view.find(".licenseagreement-popup");this.$licenseLink=this.$view.
2022-04-01 15:32:07 UTC	1031	IN	Data Raw: 54 58 53 2e 55 49 2e 75 73 65 53 6d 61 6c 6c 55 49 4c 61 79 6f 75 74 28 29 3f 74 68 69 73 2e 24 73 65 61 72 63 68 49 6e 70 75 74 2e 66 69 6c 74 65 72 28 22 2e 70 68 6f 6e 65 2d 6f 6e 6c 79 22 29 3a 74 68 69 73 2e 24 73 65 61 72 63 68 49 6e 70 75 74 2e 6e 6f 74 28 22 2e 70 68 6f 6e 65 2d 6f 6e 6c 79 22 29 3b 74 68 69 73 2e 5f 61 70 70 6c 79 50 73 65 75 64 6f 50 6c 61 63 65 68 6f 6c 64 65 72 28 61 29 3b 0a 74 68 69 73 2e 5f 70 72 6f 63 65 73 73 53 65 61 72 63 68 54 65 78 74 28 61 2e 76 61 6c 28 29 29 7d 2c 5f 75 6e 62 69 6e 64 46 72 6f 6d 53 65 61 72 63 68 42 6f 78 43 68 61 6e 67 65 45 76 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 24 73 65 61 72 63 68 49 6e 70 75 74 2e 6f 66 66 28 74 68 69 73 2e 73 65 61 72 63 68 42 6f 78 43 68 61 6e 67 65 Data Ascii: TXS.UI.useSmallUILayout()?this.$searchInput.filter(".phone-only"):this.$searchInput.not(".phone-only");this._applyPseudoPlaceholder(a);this._processSearchText(a.val())},_unbindFromSearchBoxChangeEvent:function(){this.$searchInput.off(this.searchBoxChange
2022-04-01 15:32:07 UTC	1038	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 63 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 61 29 7b 4e 2e 73 68 6f 77 46 6f 6c 64 65 72 54 6f 6f 6c 62 61 72 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 4e 2e 68 69 64 65 46 6f 6c 64 65 72 54 6f 6f 6c 62 61 72 28 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 61 2c 62 29 7b 52 26 26 28 52 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 73 68 6f 77 22 29 2c 52 3d 6e 75 6c 6c 29 3b 76 61 72 20 64 3d 42 2e 67 65 74 41 70 70 42 79 53 68 6f 72 74 49 64 28 61 29 3b 69 66 28 64 2e 63 61 6e 4f 70 65 6e 28 29 29 42 2e 6c 61 75 6e 63 68 41 70 70 28 64 29 3b 65 6c 73 65 7b 76 61 72 20 68 2c 6b 3d 6e 75 6c 6c 3b 68 3d 64 2e 67 65 74 53 74 61 74 65 28 29 3b 68 3d 3d 43 54 58 53 2e 41 70 70 2e 53 74 61 74 65 2e 52 45 51 55 45 53 54 41 42 4c 45 3f 28 Data Ascii: function(c){function e(a){N.showFolderToolbar(a)}function a(){N.hideFolderToolbar()}function b(a,b){R&&(R.removeClass("show"),R=null);var d=B.getAppByShortId(a);if(d.canOpen())B.launchApp(d);else{var h,k=null;h=d.getState();h==CTXS.App.State.REQUESTABLE?(
2022-04-01 15:32:07 UTC	1046	IN	Data Raw: 61 69 6e 65 72 22 29 2c 7b 6f 6e 43 6c 69 63 6b 3a 68 7d 29 3b 4b 3d 6e 65 77 20 43 54 58 53 2e 57 69 64 67 65 74 73 2e 41 70 70 6c 69 63 61 74 69 6f 6e 42 75 6e 64 6c 65 73 57 69 64 67 65 74 28 6e 2c 53 2c 42 2e 67 65 74 41 70 70 6c 69 63 61 74 69 6f 6e 42 75 6e 64 6c 65 73 28 29 2c 7b 75 73 65 53 6d 61 6c 6c 54 69 6c 65 73 3a 43 54 58 53 2e 55 49 2e 75 73 65 53 6d 61 6c 6c 54 69 6c 65 73 28 29 2c 72 65 70 65 61 74 54 69 6c 65 73 3a 43 54 58 53 2e 55 49 2e 72 65 70 65 61 74 41 70 70 47 72 6f 75 70 54 69 6c 65 73 2c 6d 69 6e 69 6d 75 6d 41 76 61 69 6c 61 62 6c 65 57 69 64 74 68 3a 43 54 58 53 2e 55 49 2e 67 65 74 4d 69 6e 69 6d 75 6d 41 76 61 69 6c 61 62 6c 65 57 69 64 74 68 28 29 2c 6f 6e 43 6c 69 63 6b 42 75 6e 64 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 61 Data Ascii: ainer"),{onClick:h});K=new CTXS.Widgets.ApplicationBundlesWidget(n,S,B.getApplicationBundles(),{useSmallTiles:CTXS.UI.useSmallTiles(),repeatTiles:CTXS.UI.repeatAppGroupTiles,minimumAvailableWidth:CTXS.UI.getMinimumAvailableWidth(),onClickBundle:function(a
2022-04-01 15:32:07 UTC	1054	IN	Data Raw: 67 2c 22 2e 76 69 65 77 2d 73 70 72 69 74 65 22 2c 21 31 29 7d 7d 3b 77 69 6e 64 6f 77 2e 43 54 58 53 2e 75 70 64 61 74 65 53 70 72 69 74 65 43 6f 6c 6f 72 3d 0a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 66 2c 65 29 7b 74 72 79 7b 76 61 72 20 68 3b 69 66 28 65 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 6b 3d 6c 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 29 3b 6c 2e 77 69 64 74 68 3d 61 2e 77 69 64 74 68 3b 6c 2e 68 65 69 67 68 74 3d 61 2e 68 65 69 67 68 74 3b 6b 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 61 2e 77 69 64 74 68 2c 61 2e 68 65 69 67 68 74 29 3b 6b 2e 64 72 61 77 49 6d 61 67 65 28 61 2c 30 2c 30 29 3b 76 61 72 20 71 3d 6b 2e 67 65 74 49 6d 61 67 65 44 61 74 61 Data Ascii: g,".view-sprite",!1)}};window.CTXS.updateSpriteColor=function(a,b,f,e){try{var h;if(e){var l=document.createElement("canvas"),k=l.getContext("2d");l.width=a.width;l.height=a.height;k.clearRect(0,0,a.width,a.height);k.drawImage(a,0,0);var q=k.getImageData
2022-04-01 15:32:07 UTC	1061	IN	Data Raw: 74 53 75 62 73 74 72 69 6e 67 55 6e 69 63 6f 64 65 28 6b 2c 30 2c 6b 2e 6c 65 6e 67 74 68 2f 61 2a 31 2e 34 29 29 2c 66 3f 28 76 3d 74 68 69 73 2e 5f 67 65 74 53 75 62 73 74 72 69 6e 67 55 6e 69 63 6f 64 65 28 76 2c 30 2c 76 2e 6c 65 6e 67 74 68 2d 31 29 2c 62 3d 63 2e 74 72 69 6d 28 76 29 2b 22 2e 2e 2e 20 22 2b 71 29 3a 28 6b 3d 74 68 69 73 2e 5f 67 65 74 53 75 62 73 74 72 69 6e 67 55 6e 69 63 6f 64 65 28 6b 2c 0a 30 2c 6b 2e 6c 65 6e 67 74 68 2d 31 29 2c 62 3d 6b 2b 22 2e 2e 2e 22 2b 71 29 2c 6d 2e 74 65 78 74 28 62 29 2c 65 3d 6d 2e 6f 75 74 65 72 57 69 64 74 68 28 29 2c 68 3d 6d 2e 6f 75 74 65 72 48 65 69 67 68 74 28 29 3b 72 65 74 75 72 6e 20 62 7d 2c 64 69 73 70 6c 61 79 48 54 4d 4c 35 54 68 69 72 64 50 61 72 74 79 4e 6f 74 69 63 65 73 4c 69 6e 6b Data Ascii: tSubstringUnicode(k,0,k.length/a*1.4)),f?(v=this._getSubstringUnicode(v,0,v.length-1),b=c.trim(v)+"... "+q):(k=this._getSubstringUnicode(k,0,k.length-1),b=k+"..."+q),m.text(b),e=m.outerWidth(),h=m.outerHeight();return b},displayHTML5ThirdPartyNoticesLink
2022-04-01 15:32:07 UTC	1069	IN	Data Raw: 2e 73 75 62 73 63 72 69 70 74 69 6f 6e 73 74 61 74 75 73 2c 73 75 62 73 63 72 69 70 74 69 6f 6e 70 72 6f 70 65 72 74 69 65 73 3a 68 2e 73 75 62 73 63 72 69 70 74 69 6f 6e 70 72 6f 70 65 72 74 69 65 73 2c 70 6f 73 69 74 69 6f 6e 3a 68 2e 70 6f 73 69 74 69 6f 6e 7d 29 7d 7d 63 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 3b 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 53 65 74 49 74 65 6d 28 22 65 6e 75 6d 64 65 6c 74 61 2d 22 2b 61 2e 69 64 2c 63 29 7d 7d 7d 29 28 6a 51 75 65 72 79 29 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 61 2c 62 2c 63 29 7b 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 2e 67 6f 4f 6e 6c 69 6e 65 28 61 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 61 26 26 Data Ascii: .subscriptionstatus,subscriptionproperties:h.subscriptionproperties,position:h.position})}}c=JSON.stringify(e);CTXS.Environment.localStorageSetItem("enumdelta-"+a.id,c)}}})(jQuery);(function(c){function e(a,b,c){CTXS.Environment.goOnline(a,function(){a&&
2022-04-01 15:32:07 UTC	1077	IN	Data Raw: 76 69 72 6f 6e 6d 65 6e 74 2e 65 6e 61 62 6c 65 4f 66 66 6c 69 6e 65 26 26 0a 43 54 58 53 2e 4e 61 74 69 76 65 48 65 6c 70 65 72 2e 73 61 76 65 4d 6f 64 69 66 69 65 64 41 70 70 4c 69 73 74 46 72 6f 6d 53 74 6f 72 65 28 61 29 7d 2c 72 65 71 75 65 73 74 57 65 62 53 74 6f 72 65 52 65 66 72 65 73 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 7d 2c 72 65 71 75 65 73 74 53 68 6f 77 4d 79 41 70 70 73 56 69 65 77 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 67 65 74 4c 61 6e 67 75 61 67 65 50 72 65 66 65 72 65 6e 63 65 3a 6e 75 6c 6c 7d 29 3b 74 72 79 7b 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 69 6e 20 77 69 6e 64 6f 77 26 26 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 Data Ascii: vironment.enableOffline&&CTXS.NativeHelper.saveModifiedAppListFromStore(a)},requestWebStoreRefresh:function(){window.location.reload()},requestShowMyAppsView:function(){},getLanguagePreference:null});try{"localStorage"in window&&null!=window.localStorage
2022-04-01 15:32:07 UTC	1081	IN	Data Raw: 63 29 7b 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 67 65 74 49 6e 73 74 61 6c 6c 65 64 41 70 70 73 28 61 2c 62 2c 63 29 7d 2c 67 65 74 49 74 65 6d 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 67 65 74 49 74 65 6d 28 61 2c 62 29 7d 2c 73 65 74 49 74 65 6d 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 0a 62 2c 63 29 7b 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 73 65 74 49 74 65 6d 28 61 2c 62 2c 63 29 7d 2c 6f 70 65 6e 55 72 6c 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 6f 70 65 6e 55 72 6c 28 61 29 7d 2c 72 65 63 6f 6c 6f 72 49 6d 61 67 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 72 65 63 Data Ascii: c){window.external.getInstalledApps(a,b,c)},getItem:function(a,b){window.external.getItem(a,b)},setItem:function(a,b,c){window.external.setItem(a,b,c)},openUrl:function(a){window.external.openUrl(a)},recolorImage:function(a,b,c,d,e,f){window.external.rec
2022-04-01 15:32:07 UTC	1089	IN	Data Raw: 6b 3a 63 7d 29 2c 74 68 69 73 2e 63 61 6c 6c 4e 61 74 69 76 65 43 6f 6e 74 61 69 6e 65 72 28 22 6c 61 75 6e 63 68 56 69 61 49 63 61 55 72 6c 22 2c 62 2c 61 29 2c 21 30 29 3a 64 2e 6c 61 75 6e 63 68 56 69 61 49 63 61 55 72 6c 28 61 2c 62 2c 63 29 7d 2c 67 65 74 55 73 65 72 44 69 73 70 6c 61 79 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 2e 68 61 73 4e 61 74 69 76 65 46 75 6e 63 74 69 6f 6e 28 22 73 79 6e 63 5f 67 65 74 55 73 65 72 44 69 73 70 6c 61 79 4e 61 6d 65 22 29 29 7b 76 61 72 20 62 3d 43 54 58 53 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 2e 62 72 69 64 67 65 2e 73 79 6e 63 5f 67 65 74 55 73 65 72 44 69 73 70 6c 61 79 4e 61 6d 65 28 29 3b 61 28 62 29 7d 65 6c 73 65 20 69 66 28 43 54 58 53 2e Data Ascii: k:c}),this.callNativeContainer("launchViaIcaUrl",b,a),!0):d.launchViaIcaUrl(a,b,c)},getUserDisplayName:function(a){if(CTXS.Environment.hasNativeFunction("sync_getUserDisplayName")){var b=CTXS.Environment.bridge.sync_getUserDisplayName();a(b)}else if(CTXS.
2022-04-01 15:32:07 UTC	1097	IN	Data Raw: 6c 62 61 63 6b 73 7d 7d 3b 77 69 6e 64 6f 77 2e 63 74 78 73 5f 69 6e 73 74 61 6c 6c 41 70 70 5f 63 6f 6d 70 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 0a 62 29 7b 62 7c 7c 28 62 3d 43 54 58 53 2e 46 41 49 4c 55 52 45 29 3b 76 61 72 20 63 3d 43 54 58 53 2e 4e 61 74 69 76 65 48 65 6c 70 65 72 2e 72 65 74 72 69 65 76 65 43 61 6c 6c 62 61 63 6b 28 61 29 3b 63 26 26 43 54 58 53 2e 77 72 61 70 45 78 63 65 70 74 69 6f 6e 73 28 7b 66 6e 3a 63 2c 61 72 67 73 3a 5b 62 5d 2c 64 65 62 75 67 3a 22 69 6e 73 74 61 6c 6c 41 70 70 22 7d 29 7d 3b 77 69 6e 64 6f 77 2e 63 74 78 73 5f 75 6e 69 6e 73 74 61 6c 6c 41 70 70 5f 63 6f 6d 70 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 62 3d 3d 43 54 58 53 2e 53 55 43 43 45 53 53 3f 43 54 58 53 2e 53 55 42 53 Data Ascii: lbacks}};window.ctxs_installApp_complete=function(a,b){b\|\|(b=CTXS.FAILURE);var c=CTXS.NativeHelper.retrieveCallback(a);c&&CTXS.wrapExceptions({fn:c,args:[b],debug:"installApp"})};window.ctxs_uninstallApp_complete=function(a,b){b=b==CTXS.SUCCESS?CTXS.SUBS
2022-04-01 15:32:07 UTC	1104	IN	Data Raw: 6e 73 48 65 61 64 2e 6e 6f 74 65 4e 61 74 69 76 65 43 6c 69 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 64 3d 64 7c 7c 7b 7d 3b 64 2e 66 65 61 74 75 72 65 73 3d 64 2e 66 65 61 74 75 72 65 73 7c 7c 7b 7d 3b 69 66 28 30 21 3d 64 2e 66 65 61 74 75 72 65 73 2e 65 6e 61 62 6c 65 54 6f 75 63 68 53 63 72 6f 6c 6c 54 77 65 61 6b 29 7b 76 61 72 20 65 3d 63 28 22 2e 73 63 72 6f 6c 6c 61 62 6c 65 2e 73 74 6f 72 65 56 69 65 77 53 65 63 74 69 6f 6e 22 29 3b 65 2e 6f 6e 28 22 73 63 72 6f 6c 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 30 21 3d 64 2e 66 65 61 74 75 72 65 73 2e 65 6e 61 62 6c 65 54 6f 75 63 68 53 63 72 6f 6c 6c 54 77 65 61 6b 26 26 31 3e 65 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 26 26 65 2e 73 63 72 6f 6c 6c 54 6f 70 28 31 29 7d 29 3b 43 54 58 53 2e 45 78 Data Ascii: nsHead.noteNativeClient=function(d){d=d\|\|{};d.features=d.features\|\|{};if(0!=d.features.enableTouchScrollTweak){var e=c(".scrollable.storeViewSection");e.on("scroll",function(){0!=d.features.enableTouchScrollTweak&&1>e.scrollTop()&&e.scrollTop(1)});CTXS.Ex
2022-04-01 15:32:07 UTC	1112	IN	Data Raw: 67 61 63 79 49 45 28 29 26 26 6d 2e 73 74 79 6c 65 53 68 65 65 74 3f 6d 2e 73 74 79 6c 65 53 68 65 65 74 2e 63 73 73 54 65 78 74 3d 62 3a 6d 2e 69 6e 6e 65 72 48 54 4d 4c 3d 62 2c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6d 29 29 3a 43 54 58 53 2e 44 65 76 69 63 65 2e 69 73 4c 65 67 61 63 79 49 45 28 29 26 26 6d 2e 73 74 79 6c 65 53 68 65 65 74 3f 6d 2e 73 74 79 6c 65 53 68 65 65 74 2e 63 73 73 54 65 78 74 3d 62 3a 6d 2e 69 6e 6e 65 72 48 54 4d 4c 3d 62 29 29 7d 2c 74 72 61 63 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 43 54 58 53 2e 74 72 61 63 65 28 61 2c 62 29 7d 2c 72 65 66 72 65 73 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 43 54 58 Data Ascii: gacyIE()&&m.styleSheet?m.styleSheet.cssText=b:m.innerHTML=b,document.getElementsByTagName("head")[0].appendChild(m)):CTXS.Device.isLegacyIE()&&m.styleSheet?m.styleSheet.cssText=b:m.innerHTML=b))},trace:function(a,b){CTXS.trace(a,b)},refresh:function(){CTX
2022-04-01 15:32:07 UTC	1120	IN	Data Raw: 68 69 73 2e 5f 67 65 74 46 6f 6c 64 65 72 4c 69 6e 6b 4d 61 72 6b 75 70 28 61 2e 69 6e 64 65 78 2c 61 2e 67 65 74 44 69 73 70 6c 61 79 46 6f 6c 64 65 72 4e 61 6d 65 28 29 2c 21 30 29 2c 0a 63 3d 61 3b 66 6f 72 28 74 68 69 73 2e 62 72 65 61 64 63 72 75 6d 62 3d 5b 7b 6e 61 6d 65 3a 61 2e 67 65 74 44 69 73 70 6c 61 79 46 6f 6c 64 65 72 4e 61 6d 65 28 29 2c 66 6f 6c 64 65 72 49 6e 64 65 78 3a 61 2e 69 6e 64 65 78 7d 5d 3b 63 3b 29 7b 63 3d 63 2e 70 61 72 65 6e 74 43 61 74 65 67 6f 72 79 3b 69 66 28 6e 75 6c 6c 3d 3d 63 7c 7c 6e 75 6c 6c 3d 3d 63 2e 70 61 72 65 6e 74 43 61 74 65 67 6f 72 79 29 62 72 65 61 6b 3b 62 3d 74 68 69 73 2e 5f 67 65 74 46 6f 6c 64 65 72 4c 69 6e 6b 4d 61 72 6b 75 70 28 63 2e 69 6e 64 65 78 2c 63 2e 67 65 74 44 69 73 70 6c 61 79 46 6f Data Ascii: his._getFolderLinkMarkup(a.index,a.getDisplayFolderName(),!0),c=a;for(this.breadcrumb=[{name:a.getDisplayFolderName(),folderIndex:a.index}];c;){c=c.parentCategory;if(null==c\|\|null==c.parentCategory)break;b=this._getFolderLinkMarkup(c.index,c.getDisplayFo

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49796	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:06 UTC	731	OUT	GET /logon/LogonPoint/receiver/images/common/wspinner@2x.gif HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:06 UTC	771	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:54 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "8af-5c74025d36a80" Accept-Ranges: bytes Content-Length: 2223 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/gif Connection: close
2022-04-01 15:32:06 UTC	771	IN	Data Raw: 47 49 46 38 39 61 2d 00 2c 00 f5 00 00 64 5a 64 bc ba bc 84 82 84 dc de dc 9c 96 9c 74 72 7c 6c 66 6c d4 d6 d4 94 8e 94 cc c6 cc 94 8a 94 f4 f6 f4 a4 9e a4 8c 82 8c 7c 7a 84 74 6a 74 64 5e 64 c4 be c4 9c 9a 9c 7c 72 7c 6c 6a 74 fc fe fc 84 82 8c ec ee ec 6c 66 74 dc da dc 94 92 9c cc ca cc fc fa fc a4 a2 ac 8c 86 8c 64 5e 6c 9c 9a a4 7c 76 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 01 0d 00 22 00 2c 00 00 00 00 2d 00 2c 00 00 06 ff 40 91 70 48 2c 7e 0a 02 05 01 24 Data Ascii: GIF89a-,dZdtr\|lfl\|ztjtd^d\|r\|ljtlftd^l\|v\|!NETSCAPE2.0!",-,@pH,~$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49772	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:01 UTC	4	OUT	GET / HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:02 UTC	5	IN	HTTP/1.1 302 Object Moved Location: /logon/LogonPoint/index.html Set-Cookie: NSC_DLGE=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: NSC_USER=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: NSC_CERT=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: NSC_ERRM=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: NSC_BASEURL=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: CsrfToken=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: CtxsAuthId=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: ASP.NET_SessionId=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: NSC_VPNERR=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure X-Content-Type-Options: nosniff X-XSS-Protection: 1 Connection: close Content-Length: 564 Cache-control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: text/html; charset=utf-8
2022-04-01 15:32:02 UTC	6	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 76 70 6e 2f 72 65 73 6f 75 72 63 65 73 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 52 65 73 6f 75 72 63 65 73 20 3d 20 6e 65 77 20 52 65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 28 22 2f 6c 6f 67 6f 6e 2f 74 68 65 6d 65 73 2f 44 65 66 61 75 6c 74 2f Data Ascii: <html><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"><script type="text/javascript" src="/vpn/resources.js"></script><script type="text/javascript" language="javascript">var Resources = new ResourceManager("/logon/themes/Default/
2022-04-01 15:32:02 UTC	6	IN	Data Raw: 4f 4e 5f 42 4f 44 59 22 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 70 61 6e 20 69 64 3d 22 54 68 69 73 20 6f 62 6a 65 63 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 22 3e 3c 2f 73 70 61 6e 3e 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 6f 6e 2f 4c 6f 67 6f 6e 50 6f 69 6e 74 2f 69 6e 64 65 78 2e 68 74 6d 6c 22 3e 3c 73 70 61 6e 20 69 64 3d 22 68 65 72 65 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 73 70 61 6e 20 69 64 3d 22 54 72 61 69 6c 69 6e 67 20 70 68 72 61 73 65 20 61 66 74 65 72 20 68 65 72 65 22 3e 3c 2f 73 70 61 6e 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 3e 52 65 73 6f 75 72 63 65 73 2e 4c 6f 61 64 28 Data Ascii: ON_BODY");</script></head><body><span id="This object may be found "></span><a href="/logon/LogonPoint/index.html"><span id="here"></span></a><span id="Trailing phrase after here"></span><script type="text/javascript" language="javascript">Resources.Load(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49797	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:06 UTC	732	OUT	GET /vpn/media/citrixgateway_logo_white.png HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:06 UTC	773	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:54 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 24 Sep 2021 02:02:40 GMT ETag: "8fc-5ccb4245ff000" Accept-Ranges: bytes Content-Length: 2300 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: no-cache Content-Type: image/png Connection: close
2022-04-01 15:32:06 UTC	774	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 a0 00 00 00 19 08 06 00 00 00 b6 0a 25 90 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 28 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 Data Ascii: PNGIHDR%tEXtSoftwareAdobe ImageReadyqe<(iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49803	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:08 UTC	1122	OUT	POST /logon/LogonPoint/Home/Configuration HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive Content-Length: 0 Accept: application/xml, text/xml, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-Citrix-IsUsingHTTPS: Yes Origin: https://emsonline.tritech.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:08 UTC	1124	IN	HTTP/1.1 200 OK X-Content-Type-Options: nosniff X-XSS-Protection: 1 Content-Length: 2361 Cache-control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: application/vnd.citrix.authenticateresponse-1+xml; charset=utf-8 X-Citrix-Application: Receiver for Web
2022-04-01 15:32:08 UTC	1125	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 63 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 3e 3c 73 65 73 73 69 6f 6e 20 74 69 6d 65 6f 75 74 3d 22 32 30 22 20 75 73 65 72 4c 61 6e 67 75 61 67 65 73 3d 22 65 6e 2d 55 53 2c 65 6e 3b 71 3d 30 2e 39 22 20 6c 6f 67 69 6e 46 6f 72 6d 54 69 6d 65 6f 75 74 3d 22 31 30 22 2f 3e 3c 61 75 74 68 4d 61 6e 61 67 65 72 20 6c 6f 67 69 6e 55 52 4c 3d 22 2f 70 2f 75 2f 67 65 74 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 52 65 71 75 69 72 65 6d 65 6e 74 73 2e 64 6f 22 20 67 65 74 55 73 65 72 6e 61 6d 65 55 52 4c 3d 22 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 2f 47 65 74 55 73 65 72 4e 61 6d 65 22 20 6c 6f 67 6f 66 66 55 52 4c 3d 22 41 75 74 68 65 6e 74 69 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><clientSettings><session timeout="20" userLanguages="en-US,en;q=0.9" loginFormTimeout="10"/><authManager loginURL="/p/u/getAuthenticationRequirements.do" getUsernameURL="Authentication/GetUserName" logoffURL="Authenti
2022-04-01 15:32:08 UTC	1126	IN	Data Raw: 61 63 6b 22 20 70 6c 61 74 66 6f 72 6d 73 3d 22 46 69 72 65 66 6f 78 3b 43 68 72 6f 6d 65 3b 56 65 72 73 69 6f 6e 2f 28 5b 36 2d 39 5d 7c 5c 64 5c 64 29 2e 2a 53 61 66 61 72 69 3b 4d 53 49 45 20 5c 64 5c 64 3b 54 72 69 64 65 6e 74 2f 28 5b 36 2d 39 5d 7c 5c 64 5c 64 29 3b 41 6e 64 72 6f 69 64 3b 69 50 61 64 3b 69 50 68 6f 6e 65 3b 69 50 6f 64 3b 22 20 20 6c 61 75 6e 63 68 55 52 4c 3d 22 63 6c 69 65 6e 74 73 2f 48 54 4d 4c 35 43 6c 69 65 6e 74 2f 73 72 63 2f 53 65 73 73 69 6f 6e 57 69 6e 64 6f 77 2e 68 74 6d 6c 22 20 63 68 72 6f 6d 65 41 70 70 4f 72 69 67 69 6e 73 3d 22 63 68 72 6f 6d 65 2d 65 78 74 65 6e 73 69 6f 6e 3a 2f 2f 68 61 69 66 66 6a 63 61 64 61 67 6a 6c 69 6a 6f 67 67 63 6b 70 67 66 6e 6f 65 69 66 6c 6e 65 6d 7c 63 68 72 6f 6d 65 2d 65 78 74 65 Data Ascii: ack" platforms="Firefox;Chrome;Version/([6-9]\|\d\d).*Safari;MSIE \d\d;Trident/([6-9]\|\d\d);Android;iPad;iPhone;iPod;" launchURL="clients/HTML5Client/src/SessionWindow.html" chromeAppOrigins="chrome-extension://haiffjcadagjlijoggckpgfnoeiflnem\|chrome-exte
2022-04-01 15:32:08 UTC	1128	OUT	GET /logon/LogonPoint/plugins/ns-gateway/nsg-epa.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:08 UTC	1137	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:56 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:47 GMT ETag: "9f17-5c74026d6d0c0" Accept-Ranges: bytes Content-Length: 40727 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Keep-Alive: timeout=15, max=83 Connection: Keep-Alive Content-Type: application/javascript; charset=utf-8 (function(a){CTXS.ExtensionAPI.addPlugin({name:"nsg-epa",initialize:function(){CTXS.ExtensionAPI.addCustomAuthLabelHandler({getLabelTypeName:function(){return"nsg-epa"},getLabelTypeMarkup:function(b){UnsetCookie("NSC_ERRM");var c=a("<div></div>"),d=a("<div></div>").attr({id:"nsepadiv",style:"visibility:hidden"});c.append(d);d=a("<p></p>").attr({id:"epa_title","class":"main-text"});ns_getcookie("NSC_AAAC")?d.addClass("_ctxstxt_postepa_title"):d.addClass("_ctxstxt_epa_title");c.append(d);d=a("<div></div>").attr({"class":"detail-text _ctxstxt_Epa_Pre_Reqm_Msg"}); c.append(d);d=a("<br/>");c.append(d);d=a("<div></div>").attr({"class":"detail-text _ctxstxt_Checking_if_the_plug-in_is_installed",id:"PluginCheck"});c.append(d);d=a("<br/>");c.append(d);d=a("<div></div>").attr({"class":"detail-text",id:"timer"});c.append(d);c.ctxsLocalize();null!=b.input.text&&""!=b.input.text.initialValue&&(secureToken=base64decode(b.input.text.initialValue),isEpaFactor=!0,"EPA-Factor"==secureToken&&(secureToken=""));return c},parseAsType:function(){return"plain"}});CTXS.ExtensionAPI.addCustomCredentialHandler({getCredentialTypeName:function(){return"nsg-epa"}, getDataToAutoPost:function(b,c,d){epa_form=b;success_callback_global=d;c=a("<a>"+_localize("Skip Check")+"</a>").attr({id:"skipbutton","class":"default button",style:"display:none; cursor:pointer"});a(c).click(function(b){b.preventDefault();window.clearInterval(util.pollNSId);SetErrMsg(_localize("user_skip_epa_msg"));!secureToken&&CTXS.getCookie("NSC_AAAC")?a.ctxsAjax({store:null,type:"GET",url:"/epaskip",dataType:"text",async:!1,success:function(a,b,c){console.log("Epaskip successful!");epa_success_callback("epaskip")}, error:function(a,b,c){console.log("Epaskip request failed! Reason: "+b)},refreshSession:!0}):(SetErrMsg(_localize("user_skip_epa_msg")),epa_success_callback("failure"))});CTXS.getCookie("NSC_EPAC")?c.hide():c.show();b.append(c);detectEpaComponent()}});CTXS.ExtensionAPI.addCustomAuthLabelHandler({getLabelTypeName:function(){return"nsg-epa-failure"},getLabelTypeMarkup:function(b){b=a("<div></div>");var c=a("<div></div>").attr({id:"epa-failure-heading","class":"main-text error _ctxstxt_EPAAccessDenied"}); b.append(c);c=a("<div></div>").attr({"class":"detail-text _ctxstxt_EPA_not_meet_reqm_msg"});b.append(c);c=a("<br/>");b.append(c);c=a("<div></div>").attr({"class":"detail-text _ctxstxt_EPA_MoreInfoMsg"});b.append(c);c=a("<br/>");b.append(c);var c=a("<table></table>").attr({id:"epaErrorTable"}),d=a("<tr></tr>").append(a("<td></td>").attr({width:"20%"}),a("<td></td>").attr({width:"80%"}));d.find("td").append(a("<span></span>").attr({"class":"detail-text"}));var e=d.clone(),f=d.clone(),d=d.clone(),g= new Date;e.find("td:first span").text(a.localization.string("Date"));e.find("td:nth-child(2) span").text(g.toLocaleDateString());f.find("td:first span").text(a.localization.string("Time"));f.find("td:nth-child(2) span").text(g.toLocaleTimeString());if(g=CTXS.getCookie("NSC_ERRM"))formatError(g,!1),null==util.epaFailResult.epaMessage&&(util.epaFailResult.epaMessage=_localize("GenericError"));if(util.epaFailResult){var h=a("<ul></ul>");h.css("list-style-type","circle");h.css("margin","0.5em");var k= d.find("td:nth-child(2) span");a.each(util.epaFailResult.epaErrors,function(b,c){h.append(a("<li></li>").text(c))});a.each(util.epaFailResult.epaMessage,function(b,c){k.append(a("<span><span/>").text(c));k.append(a("</br>"))});k.append(h);k.append("<br/>");d.find("td:nth-child(2) span").append(k)}else g=_localize("GenericError"),d.find("td:nth-child(2) span").text(g);d.find("td:first span").text(a.localization.string("EPAMessaage"));d.find("td:first").attr("style","vertical-align:top");c.append(e, f,d);b.append(c);b.append("<br/>");c=a("<a></a>").attr({"class":"button forms-authentication-button default",href:"#"}).text(a.localization.string("TryAgain"));b.append(c);UnsetCookie("NSC_ERRM");b.ctxsLocalize();return b},parseAsType:function(){return"plain"}})}})})(jQuery);var epa_form,success_callback_global,autoposted=0,isFirstEpaScan=1; function epa_success_callback(a){util.clearAllTimeouts();resetGlobalVars();0==autoposted&&(autoposted=1,success_callback_global(a));1==isFirstEpaScan&&(isFirstEpaScan=0)} var util={win:{},linux:{},mac:{},timers:[],emptyFunction:function(){},ajaxGet:function(a,b,c){c="undefined"!==typeof c?c:util.emptyFunction;try{var d=new XMLHttpRequest;d.open("GET",a);d.onerror=c;d.onreadystatechange=function(){4==d.readyState&&b(d)};d.send()}catch(e){c("Error in sending request"+e)}},synAjax:function(a,b){try{var c=new XMLHttpRequest;c.open(a,b,!1);c.send();return c}catch(d){}},parseToXml:function(a){var b;window.DOMParser?b=(new DOMParser).parseFromString(a,"text/xml"):(b=new ActiveXObject("Microsoft.XMLDOM"), b.async=!1,b.loadXML(a));return b},extractPluginInfo:function(a,b,c){for(var d=0;d<a.childNodes.length;d++)if("repository"===a.childNodes[d].nodeName&&a.childNodes[d].getAttribute("name")===b)for(var e=a.childNodes[d],f=0;f<e.childNodes.length;f++)if("plugin"===e.childNodes[f].nodeName&&e.childNodes[f].getAttribute("type")===c)return{path:e.childNodes[f].getAttribute("path"),version:e.childNodes[f].getAttribute("version"),compatibleFrom:e.childNodes[f].getAttribute("compatibleFrom"),compatibleTill:e.childNodes[f].getAttribute("compatibleTill")}; return null},extractPluginHeader:function(a,b,c){b=c.toLowerCase()+"_"+b.toLowerCase();a=a.split(";");for(c=0;c<a.length;c++){var d=a[c].split(":");if(d[0]==b)return d[1]}return"Always"},getPluginInfo:function(a,b,c){var d=util.synAjax("GET","/vpn/pluginlist.xml"),e=util.parseToXml(d.responseText).firstChild,f=d.getResponseHeader("repository"),d=util.extractPluginHeader(d.getResponseHeader("Plugin-Upgrade"),a,b);a=a+"-"+("undefined"!==typeof c?c:b);if(null!==f&&""!=f&&(f=util.extractPluginInfo(e, f,a))&&f.path&&f.version&&f.compatibleFrom)return f.upgradeType=d,f;f=util.extractPluginInfo(e,"default",a);f.upgradeType=d;return f},redirectToPlugin:function(a,b){var c=util.getPluginInfo(a,b);window.location.assign(c.path)},compareVersion:function(a,b){for(var c=a.split(/[\.,]/),d=b.split(/[\.,]/),e=0;4>e;e++){var f=parseInt(c[e])-parseInt(d[e]);if(0!==f)return f}return 0}};util.win.ACTIVEX_SUPPORTED="ActiveXObject"in window;util.win.NOPSuccess=!1;var winAgentPortForLauncher=3198; util.prob=function(a,b,c){image=new Image;image.onload=b;image.onerror=c;image.src="http://localhost:"+winAgentPortForLauncher+"/"+a+"&"+Math.random()}; util.getStringFromLauncher=function(a,b){var c=0,d=[],e=function(){b("")},f=function(){d.push(this.height-1);if(2<d.length&&0==d.length%2&&0==d[d.length-1]&&0==d[d.length-2])try{for(var g="",h=0;h<d.length-2;h+=2)var k=16*d[h]+d[h+1],g=g+("%"+(16>k?"0":"")+k.toString(16));b(decodeURIComponent(g))}catch(l){b("")}else c+=1,util.prob(a+"&"+c,f,e)};util.prob(a+"&"+c,f,e)};util.maxAttempt=20;util.currentAttempt=0;util.maxInactiveAttempts=12;util.useOnlyLocalHostComm=!1;util.useOnlyNSproxyComm=!1; util.fallbackStarted=!1;util.isPluginActive=!1;util._launchErrorHandler=util.emptyFunction;util._launchSuccessHandler=util.emptyFunction;util.checkIfLaunched=util._checkIfLaunched;util._checkIfLaunched=function(){function a(){util.timers.push(window.setTimeout(function(){util._checkIfLaunched()},1E3))}util.fallbackStarted=!0;util.currentAttempt+=1;util.currentAttempt>util.maxA
2022-04-01 15:32:08 UTC	1145	IN	Data Raw: 74 74 65 6d 70 74 3f 75 74 69 6c 2e 5f 6c 61 75 6e 63 68 45 72 72 6f 72 48 61 6e 64 6c 65 72 28 29 3a 75 74 69 6c 2e 70 72 6f 62 28 22 4e 4f 50 22 2c 75 74 69 6c 2e 5f 6c 61 75 6e 63 68 53 75 63 63 65 73 73 48 61 6e 64 6c 65 72 2c 61 29 7d 3b 0a 75 74 69 6c 2e 6c 61 75 6e 63 68 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 22 63 69 74 72 69 78 4e 47 3a 2f 2f 22 3b 63 26 26 21 75 74 69 6c 2e 75 73 65 4f 6e 6c 79 4c 6f 63 61 6c 48 6f 73 74 43 6f 6d 6d 26 26 28 65 3d 28 22 45 50 41 22 3d 3d 64 3f 65 2b 22 65 70 61 70 6c 75 67 69 6e 2f 22 3a 65 2b 22 76 70 6e 70 6c 75 67 69 6e 2f 22 29 2b 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 2c 65 2b 3d 22 2f 22 2c 65 2b 3d 63 2c 65 2b 3d 22 2f 22 29 Data Ascii: ttempt?util._launchErrorHandler():util.prob("NOP",util._launchSuccessHandler,a)};util.launchPlugin=function(a,b,c,d){var e="citrixNG://";c&&!util.useOnlyLocalHostComm&&(e=("EPA"==d?e+"epaplugin/":e+"vpnplugin/")+document.location.host,e+="/",e+=c,e+="/")
2022-04-01 15:32:09 UTC	1152	IN	Data Raw: 28 22 66 61 69 6c 65 64 22 29 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 76 65 72 73 69 6f 6e 4d 69 73 6d 61 74 63 68 46 61 6c 6c 62 61 63 6b 43 68 72 6f 6d 65 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 22 45 50 41 5f 56 45 52 4d 49 53 4d 41 54 43 48 3d 31 3b 20 70 61 74 68 3d 2f 22 3b 64 65 74 65 63 74 45 70 61 43 6f 6d 70 6f 6e 65 6e 74 28 21 30 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 68 65 69 67 68 74 3b 31 3d 3d 61 3f 28 74 69 6d 65 72 49 44 26 26 77 69 6e 64 6f 77 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 69 6d 65 72 49 44 29 2c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 64 6f 77 6e 6c 6f 61 64 5f 65 70 61 5f 63 6f 6e 74 65 6e 74 22 Data Ascii: ("failed"))}function versionMismatchFallbackChrome(){function a(){document.cookie="EPA_VERMISMATCH=1; path=/";detectEpaComponent(!0)}function b(){var a=this.height;1==a?(timerID&&window.clearTimeout(timerID),document.getElementById("download_epa_content"
2022-04-01 15:32:09 UTC	1160	IN	Data Raw: 68 6f 77 44 77 6e 6c 64 3d 30 2c 61 67 6d 61 63 5f 74 69 6d 65 49 6e 74 65 72 76 61 6c 3d 31 45 33 2c 61 67 6d 61 63 5f 6e 53 65 63 73 3d 32 30 2c 63 6f 76 70 43 6f 6f 6b 69 65 3d 22 22 2c 63 6f 76 70 43 6f 75 6e 74 3d 30 2c 61 67 6d 61 63 5f 45 70 61 4d 73 67 3d 22 22 3b 0a 66 75 6e 63 74 69 6f 6e 20 61 67 6d 61 63 5f 73 68 6f 77 54 69 6d 65 72 28 29 7b 30 3c 61 67 6d 61 63 5f 6e 53 65 63 73 26 26 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 74 69 6d 65 72 22 29 2e 69 6e 6e 65 72 48 54 4d 4c 3d 61 67 6d 61 63 5f 6e 53 65 63 73 2b 22 20 22 2b 5f 6c 6f 63 61 6c 69 7a 65 28 22 73 65 63 73 22 29 2c 75 74 69 6c 2e 74 69 6d 65 72 73 2e 70 75 73 68 28 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e Data Ascii: howDwnld=0,agmac_timeInterval=1E3,agmac_nSecs=20,covpCookie="",covpCount=0,agmac_EpaMsg="";function agmac_showTimer(){0<agmac_nSecs&&(document.getElementById("timer").innerHTML=agmac_nSecs+" "+_localize("secs"),util.timers.push(window.setTimeout(function
2022-04-01 15:32:09 UTC	1168	IN	Data Raw: 3b 63 2e 69 64 3d 22 6c 61 75 6e 63 68 65 72 49 66 72 61 6d 65 22 3b 63 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 70 78 22 3b 63 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 70 78 22 3b 0a 63 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 7d 65 6c 73 65 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 62 3b 6c 69 6e 75 78 5f 70 6f 72 74 4e 6f 3d 6c 69 6e 75 78 5f 73 74 61 72 74 70 6f 72 74 4e 6f 3b 61 26 26 21 75 74 69 6c 2e 75 73 65 4f 6e 6c 79 4c 6f 63 61 6c 48 6f 73 74 43 6f 6d 6d 26 26 75 74 69 6c 2e 70 6c 75 67 69 6e 52 65 73 75 6c 74 73 28 29 3b 75 74 69 6c 2e 75 73 65 4f 6e 6c 79 4e 53 70 72 6f 78 79 43 6f 6d 6d 7c 7c 75 74 Data Ascii: ;c.id="launcherIframe";c.style.width="1px";c.style.height="1px";c.style.visibility="hidden";document.body.appendChild(c)}else window.location=b;linux_portNo=linux_startportNo;a&&!util.useOnlyLocalHostComm&&util.pluginResults();util.useOnlyNSproxyComm\|\|ut
2022-04-01 15:32:09 UTC	1175	IN	Data Raw: 6c 2e 69 73 50 6c 75 67 69 6e 41 63 74 69 76 65 3d 21 30 29 2c 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 73 68 6f 77 54 69 6d 65 72 48 61 6e 64 6c 65 72 29 2c 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 61 2e 74 79 70 65 29 29 3a 22 55 70 67 72 61 64 65 20 45 50 41 22 3d 3d 61 2e 74 79 70 65 3f 28 75 74 69 6c 2e 66 61 6c 6c 62 61 63 6b 53 74 61 72 74 65 64 7c 7c 28 75 74 69 6c 2e 69 73 50 6c 75 67 69 6e 41 63 74 69 76 65 3d 21 30 29 2c 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 55 70 67 72 61 64 65 20 45 50 41 20 72 65 63 65 69 76 65 64 22 29 2c 41 70 70 65 6e 64 44 6f 77 6e 6c 6f 61 64 42 75 74 74 6f 6e 28 29 29 3a 22 55 70 67 72 61 64 65 20 56 50 4e 22 3d 3d 61 2e 74 79 70 65 3f 28 75 74 69 6c 2e 66 61 6c 6c 62 61 63 6b 53 74 61 72 74 65 64 7c 7c 28 75 74 69 6c 2e 69 Data Ascii: l.isPluginActive=!0),clearTimeout(showTimerHandler),console.log(a.type)):"Upgrade EPA"==a.type?(util.fallbackStarted\|\|(util.isPluginActive=!0),console.log("Upgrade EPA received"),AppendDownloadButton()):"Upgrade VPN"==a.type?(util.fallbackStarted\|\|(util.i
2022-04-01 15:32:09 UTC	1177	OUT	GET /logon/LogonPoint/custom/strings.en.json HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-Citrix-IsUsingHTTPS: Yes Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:09 UTC	1178	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:57 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "3-5c74025d36a80" Accept-Ranges: bytes Content-Length: 3 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff X-Citrix-Application: Receiver for Web Keep-Alive: timeout=15, max=97 Connection: Keep-Alive Content-Type: application/json; charset=utf-8 { }
2022-04-01 15:32:09 UTC	1178	OUT	GET /logon/LogonPoint/plugins/ns-gateway/nsg-setclient.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:09 UTC	1179	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:57 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:41 GMT ETag: "1297c-5c740267b4340" Accept-Ranges: bytes Content-Length: 76156 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Keep-Alive: timeout=15, max=96 Connection: Keep-Alive Content-Type: application/javascript; charset=utf-8 "undefined"==typeof console&&(this.console={log:function(){}});function _localize(a){var b=$.localization.string.apply(a,arguments);return b?b:"undefined"===typeof b?a:""}var LargeUI=!0,SmallUI=!0;$("html").hasClass("smallTiles")?(LargeUI=!1,SmallUI=!0):(LargeUI=!0,SmallUI=!1);function base64decode(a){return window.atob?atob(a):Base64.decode(a)}function isInsideVPN(){return"object"===typeof CONFIG&&CONFIG.isVPN} function checkVPNConfig(a){return isInsideVPN()?"object"===typeof CONFIG.EXTERNAL?CONFIG.EXTERNAL[a]:!1:!1} function getBoomarksDisplay(){if(!CTXS.Gateway.bookmarksKnob.getBookmarkDisplayDone){for(var a=document.getElementById("gatewaycustomStyle").sheet?document.getElementById("gatewaycustomStyle").sheet.rules\|\|document.getElementById("gatewaycustomStyle").sheet.cssRules:document.getElementById("gatewaycustomStyle").styleSheet.rules,b=0;b<a.length;b++)".enterprise_website_section"==a[b].selectorText&&(showEnterpriseBookmarks=!1),".personal_websites_section"==a[b].selectorText&&(showPersonalBookmarks=!1); CTXS.Gateway.bookmarksKnob.getBookmarkDisplayDone=!0}}function sendProperChoice(a){if(-1!=a.indexOf("agent"))return"agnt";if(-1!=a.indexOf("wicps"))return"wica";if(-1!=a.indexOf("cvpn"))return"cvpn";if(-1!=a.indexOf("mac"))return"macc";if(-1!=a.indexOf("java")\|\|-1!=a.indexOf("plugin"))return logWarning("Unknown/unsupported choice: "+a),"unknown";console.log("Returning client choice: "+a);return a} function waitForChrome(a){$.ctxsAjax({store:null,async:!1,type:"GET",url:"/cgi/getUserName",dataType:"text",success:function(b,c,d){util.clearAllTimeouts();util.timers.push(window.setTimeout(function(){a("done")},3E3))},error:function(b,c,d){util.timers.push(window.setTimeout(function(){waitForChrome(a)},1E3))},ajax:!1,suppressEvents:!0,refreshSession:!0})}var json={},MasterStore={},fullvpn_form,personalBundlePushed=!1,adminBundlePushed=!1;CTXS.Gateway={}; CTXS.Gateway.bookmarksKnob={getBookmarkDisplayDone:!1,vmwareAppsAggregated:!1,personalBookmarkRefreshNeeded:!0,getHomepageConfigDone:!1,loadedVMwareapps:!1,AdminBookmarksadded:!1};CTXS.Gateway.Apps={hasVmwareApps:!1,hasVmwareDesktops:!1}; var showEnterpriseBookmarks=!0,showPersonalBookmarks=!0,showLogout,gatewayBookmarksKeyword=["GatewayEnterpriseBookmarks"],personalBookmarksKeyword=["GatewayPersonalBookmarks"],vmwareBookmarksKeyword=["vmwareBookmarks"],gatewayBundle={description:_localize("Admin_apps_bundle_descr"),tileid:"appBundle3",title:_localize("Admin_apps_bundle_title"),keywords:gatewayBookmarksKeyword,apps:[]},personalBundle={description:_localize("Personal_apps_bundle_descr"),tileid:"appBundle2",title:_localize("Personal_apps_bundle_title"), keywords:personalBookmarksKeyword,apps:[]},vmwarebundle={description:_localize("vmware_bundle_descr"),tileid:"appBundle4",title:_localize("vmware_bundle_title"),keywords:vmwareBookmarksKeyword,apps:[]};CTXS.UI.repeatAppGroupTiles=!1; function choice_resize(){if(LargeUI){var a=Math.max.apply(null,$(".box-content").map(function(){return $(this).outerHeight()}).get());$(".box").outerHeight(a+40)}else{var b=$("#outerbox").height()+44,b=800<b?b:800;$(".authentication-clientchoices-view.web-screen").attr("style",function(a,d){return d+"height:"+b+"px !important;"})}} function getFormattedTime(a){a=new Date(10*parseInt(a));var b=a.getUTCHours()+":";10>a.getUTCMinutes()&&(b+="0");b+=a.getUTCMinutes()+":";10>a.getUTCSeconds()&&(b+="0");return b+=a.getUTCSeconds()}function logWarning(a){"warn"in console?console.warn(a):console.log(a)}CTXS.SessionMonitor.prototype={start:function(){},refreshed:function(){},stop:function(){}}; function setNSGBaseURL(){function a(a,d,b){logWarning("Resources/List request to SF failed with Error code = "+a.status+". Error msg = "+d);unsetNSGBaseURL();CTXS.Bootstrapper.loadAggregatedStore()}var b=CTXS.getCookie("NSC_BASEURL");UnsetCookie("NSC_FSSO");null!=b&&(b=base64decode(b),"/"!=b.charAt(b.length-1)&&(b+="/"),CTXS.primaryStore.baseUrl=b);CTXS.Controllers.AuthenticationController.prototype._handleAuthenticationFailure=function(a){CTXS.Authentication.clearSavedAuthenticationMethod();a.name== CTXS.Authentication.Method.GATEWAY&&(logWarning("SSO to SF failed! Displaying only Gateway bookmarks"),unsetNSGBaseURL(),this._completeAuthentication(a,{}))};CTXS.ResourcesClient.requestResources=function(c,d,b,f,h){$.ctxsAjax({store:c,type:"POST",url:d,dataType:"json",data:{format:"json",resourceDetails:b\|\|[CTXS.RESOURCE_DETAILS.DEFAULT]},success:function(a,c,d){(c=d.getResponseHeader(CTXS.CHALLENGE_HEADER))?(a=CTXS.Authentication.parseChallenge(c).reason)&&"notoken"!=a&&"TokenRequired"!=a?CTXS.Events.publish(CTXS.Events.resources.challenged): CTXS.Events.publish(CTXS.Events.resources.unauthorized,c):(CTXS.Device.isCitrixChromeApp()&&CTXS.Html5Client.postResourcesToChromeApp(a.resources),f(a))},error:a,suppressEvents:!0,refreshSession:!0})};CTXS.ResourcesClient.subscription=function(a,d,b){var f=$.extend({operation:d},a.subscriptionproperties);("subscribe"==d\|\|"update"==d&&"subscribed"==a.subscriptionstatus)&&a.position&&(f["dazzle:position"]=a.position,f.position=a.position);d=a.subscriptionurl;1==a.isGatewayBookmark?(f.appID=a.id,f.nsc_nonce= CTXS.Gateway.HomePageConfig.NSC_NONCE):d=a.store.baseUrl+a.subscriptionurl;$.ctxsAjax({store:a.store,type:"POST",url:d,data:f,dataType:"json",callErrorHandlerFor503:!0,success:function(d,f,k){k.getResponseHeader(CTXS.CHALLENGE_HEADER)?CTXS.Events.publish(CTXS.Events.resources.challenged):(d=d.subscriptionstatus\|\|d.status)?(a.subscriptionstatus=d,b(a.subscriptionstatus==CTXS.SUBSCRIPTION_STATUS.PENDING?CTXS.SUBSCRIPTION_PENDING:CTXS.SUBSCRIPTION_SUCCESS)):b(CTXS.SUBSCRIPTION_FAILURE)},error:function(){b(CTXS.SUBSCRIPTION_FAILURE)}, refreshSession:!0})}}function unsetNSGBaseURL(){UnsetCookie("NSC_BASEURL");CTXS.primaryStore.baseUrl=""} function evaluateXPath(a,b,c){var d;if(util.win.ACTIVEX_SUPPORTED)try{return a.setProperty("SelectionLanguage","XPath"),d=a.selectNodes(b),d.getAttribute("position")}catch(e){for(b=0;b<a.getElementsByTagName("subscription").length;b++)if(a.getElementsByTagName("subscription")[b].getAttribute("appID")==c&&(d=a.getElementsByTagName("subscription")[b].getAttribute("position")))return d}else if("evaluate"in document&&(d=a.evaluate(b,a,null,XPathResult.ANY_TYPE,null),a=d.iterateNext(),null!=a))return a.getAttribute("position"); return null}function getSubscriptionStatus(a,b){return CTXS.Gateway.HomePageConfig.SubscriptionsXML?evaluateXPath(CTXS.Gateway.HomePageConfig.SubscriptionsXML,'//subscription[@appID="'+a+'"]',a):null} (function(a){CTXS.ExtensionAPI.addPlugin({name:"nsg-setclient",initialize:function(){function b(c,d,b){if(b.responseXML)var f=a(b.responseXML).find("String[id='"+eulaName+"']");0==f.length&&f.text("");c=a('<a href="#" id="nsg-eula-display" style="color:#02A1C1"></a>').text(_localize("eula_terms"));c.click(function(a){a.preventDefault();CTXS.ExtensionAPI.showMessage({localize:!0,messageText:f.text(),messageTitle:"End_User_License_Agreement",okButtonText:"OK",isalert:!1,okAction:function(){}})});d= a('<div><input type="checkbox" id="nsg-eula-accept" tabindex="0"></div>');LargeUI&&d.attr("style","width:385px");b=a('<label for="nsg-eula-accept"></label>').text(_localize("eula_agreement"));b.append(c);d.append(b);eulaDOM=d}setNSGBaseURL();a(document).on("ctxsformsauthenticationauthenticatio
2022-04-01 15:32:09 UTC	1187	IN	Data Raw: 6e 73 75 63 63 65 73 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 73 65 74 4e 53 47 42 61 73 65 55 52 4c 28 29 7d 29 3b 43 54 58 53 2e 45 78 74 65 6e 73 69 6f 6e 41 50 49 2e 61 64 64 43 75 73 74 6f 6d 43 72 65 64 65 6e 74 69 61 6c 48 61 6e 64 6c 65 72 28 7b 67 65 74 43 72 65 64 65 6e 74 69 61 6c 54 79 70 65 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 6e 73 67 2d 78 31 22 7d 2c 67 65 74 43 72 65 64 65 6e 74 69 61 6c 54 79 70 65 4d 61 72 6b 75 70 3a 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 61 28 22 3c 64 69 76 3e 3c 2f 64 69 76 3e 22 29 7d 7d 29 3b 43 54 58 53 2e 45 78 74 65 6e 73 69 6f 6e 41 50 49 2e 61 64 64 43 75 73 74 6f 6d 43 72 65 64 65 6e 74 69 61 6c 48 61 6e 64 6c 65 72 28 7b 67 65 74 43 72 65 64 65 6e 74 69 61 Data Ascii: nsuccess",function(){setNSGBaseURL()});CTXS.ExtensionAPI.addCustomCredentialHandler({getCredentialTypeName:function(){return"nsg-x1"},getCredentialTypeMarkup:function(c){return a("<div></div>")}});CTXS.ExtensionAPI.addCustomCredentialHandler({getCredentia
2022-04-01 15:32:09 UTC	1194	IN	Data Raw: 61 73 73 28 62 2c 63 29 3b 64 2e 6f 70 74 69 6f 6e 73 2e 72 65 73 65 72 76 65 64 53 70 61 63 65 26 26 64 2e 5f 75 70 64 61 74 65 53 63 72 6f 6c 6c 48 65 69 67 68 74 28 29 3b 76 61 72 20 6b 3d 62 2e 61 74 74 72 28 22 61 63 74 69 6f 6e 22 29 2c 6c 3d 64 2e 5f 67 65 74 46 6f 72 6d 50 6f 73 74 44 61 74 61 28 63 29 3b 2f 5c 2f 6e 66 5c 2f 61 75 74 68 5c 2f 64 6f 43 72 65 64 65 6e 74 69 61 6c 55 70 64 61 74 65 2e 64 6f 7c 5c 2f 6e 66 5c 2f 61 75 74 68 5c 2f 64 6f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 2e 64 6f 2f 2e 74 65 73 74 28 6b 29 26 26 77 69 6e 64 6f 77 2e 70 61 73 73 5f 65 6e 63 5f 65 6e 61 62 6c 65 3f 33 30 30 3c 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2f 31 45 33 29 2d 77 69 6e 64 6f 77 2e 70 Data Ascii: ass(b,c);d.options.reservedSpace&&d._updateScrollHeight();var k=b.attr("action"),l=d._getFormPostData(c);/\/nf\/auth\/doCredentialUpdate.do\|\/nf\/auth\/doAuthentication.do/.test(k)&&window.pass_enc_enable?300<=Math.floor((new Date).getTime()/1E3)-window.p
2022-04-01 15:32:09 UTC	1202	IN	Data Raw: 54 79 70 65 4d 61 72 6b 75 70 3a 66 75 6e 63 74 69 6f 6e 28 63 29 7b 55 6e 73 65 74 43 6f 6f 6b 69 65 28 22 43 73 72 66 54 6f 6b 65 6e 22 29 3b 72 65 74 75 72 6e 20 61 28 22 3c 64 69 76 3e 3c 2f 64 69 76 3e 22 29 7d 2c 67 65 74 44 61 74 61 54 6f 41 75 74 6f 50 6f 73 74 3a 66 75 6e 63 74 69 6f 6e 28 63 2c 62 2c 65 29 7b 62 3d 61 28 22 3c 69 6d 67 3e 3c 2f 69 6d 67 3e 22 29 2e 61 74 74 72 28 7b 73 72 63 3a 22 72 65 63 65 69 76 65 72 2f 69 6d 61 67 65 73 2f 63 6f 6d 6d 6f 6e 2f 77 73 70 69 6e 6e 65 72 40 32 78 2e 67 69 66 22 2c 22 63 6c 61 73 73 22 3a 22 6c 6f 61 64 69 6e 67 2d 73 70 69 6e 6e 65 72 22 7d 29 3b 63 2e 61 70 70 65 6e 64 28 62 29 3b 65 28 22 64 6f 6e 65 22 29 7d 7d 29 3b 43 54 58 53 2e 45 78 74 65 6e 73 69 6f 6e 41 50 49 2e 61 64 64 43 75 73 74 Data Ascii: TypeMarkup:function(c){UnsetCookie("CsrfToken");return a("<div></div>")},getDataToAutoPost:function(c,b,e){b=a("<img></img>").attr({src:"receiver/images/common/wspinner@2x.gif","class":"loading-spinner"});c.append(b);e("done")}});CTXS.ExtensionAPI.addCust
2022-04-01 15:32:09 UTC	1210	IN	Data Raw: 50 42 5f 61 64 64 62 6f 78 5f 73 68 6f 77 6e 3d 21 30 2c 62 2e 61 64 64 43 6c 61 73 73 28 22 70 65 72 73 6f 6e 61 6c 5f 62 6d 5f 64 72 6f 70 64 6f 77 6e 5f 68 6f 76 65 72 22 29 2c 61 28 22 2e 70 65 72 73 6f 6e 61 6c 5f 62 6d 5f 61 64 64 62 6f 78 22 29 2e 73 68 6f 77 28 29 29 3a 28 50 42 5f 61 64 64 62 6f 78 5f 73 68 6f 77 6e 3d 21 31 2c 62 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 70 65 72 73 6f 6e 61 6c 5f 62 6d 5f 64 72 6f 70 64 6f 77 6e 5f 68 6f 76 65 72 22 29 2c 61 28 22 2e 70 65 72 73 6f 6e 61 6c 5f 62 6d 5f 61 64 64 62 6f 78 22 29 2e 68 69 64 65 28 29 29 7d 29 3b 73 68 6f 77 50 65 72 73 6f 6e 61 6c 42 6f 6f 6b 6d 61 72 6b 73 7c 7c 28 61 28 22 2e 70 65 72 73 6f 6e 61 6c 5f 62 6d 5f 61 64 64 62 6f 78 22 29 2e 63 73 73 28 22 68 65 69 67 68 74 22 2c 22 Data Ascii: PB_addbox_shown=!0,b.addClass("personal_bm_dropdown_hover"),a(".personal_bm_addbox").show()):(PB_addbox_shown=!1,b.removeClass("personal_bm_dropdown_hover"),a(".personal_bm_addbox").hide())});showPersonalBookmarks\|\|(a(".personal_bm_addbox").css("height","
2022-04-01 15:32:09 UTC	1217	IN	Data Raw: 6b 3a 21 30 2c 6c 61 75 6e 63 68 75 72 6c 3a 22 22 2c 70 6c 61 79 6c 69 73 74 73 3a 5b 5d 2c 73 68 6f 72 74 63 75 74 76 61 6c 69 64 61 74 69 6f 6e 75 72 6c 3a 22 22 2c 73 75 62 73 63 72 69 70 74 69 6f 6e 73 74 61 74 75 73 3a 22 75 6e 73 75 62 73 63 72 69 62 65 64 22 2c 73 75 62 73 63 72 69 70 74 69 6f 6e 75 72 6c 3a 43 54 58 53 2e 47 61 74 65 77 61 79 2e 48 6f 6d 65 50 61 67 65 43 6f 6e 66 69 67 2e 47 61 74 65 77 61 79 42 61 73 65 55 52 4c 2b 22 2f 76 70 6e 73 2f 70 6f 72 74 61 6c 2f 73 63 72 69 70 74 73 2f 73 75 62 73 63 72 69 70 74 69 6f 6e 2e 70 6c 22 7d 3b 61 2e 63 6f 6e 74 65 6e 74 3d 24 28 24 78 6d 6c 6f 62 6a 65 63 74 2e 66 69 6e 64 28 22 62 6f 6f 6b 6d 61 72 6b 22 29 5b 62 5d 29 2e 61 74 74 72 28 22 75 72 6c 22 29 3b 63 3d 62 61 73 65 36 34 64 65 Data Ascii: k:!0,launchurl:"",playlists:[],shortcutvalidationurl:"",subscriptionstatus:"unsubscribed",subscriptionurl:CTXS.Gateway.HomePageConfig.GatewayBaseURL+"/vpns/portal/scripts/subscription.pl"};a.content=$($xmlobject.find("bookmark")[b]).attr("url");c=base64de
2022-04-01 15:32:09 UTC	1225	IN	Data Raw: 2e 73 70 6c 69 63 65 28 6a 73 6f 6e 2e 62 75 6e 64 6c 65 73 2e 6c 65 6e 67 74 68 2d 31 2c 30 2c 67 61 74 65 77 61 79 42 75 6e 64 6c 65 29 2c 41 64 6d 69 6e 42 6f 6f 6b 6d 61 72 6b 73 4a 53 4f 4e 2e 62 75 6e 64 6c 65 73 2e 70 75 73 68 28 67 61 74 65 77 61 79 42 75 6e 64 6c 65 29 2c 61 64 6d 69 6e 42 75 6e 64 6c 65 50 75 73 68 65 64 3d 21 30 29 3a 0a 62 26 26 28 6a 73 6f 6e 2e 62 75 6e 64 6c 65 73 2e 70 75 73 68 28 67 61 74 65 77 61 79 42 75 6e 64 6c 65 29 2c 41 64 6d 69 6e 42 6f 6f 6b 6d 61 72 6b 73 4a 53 4f 4e 2e 62 75 6e 64 6c 65 73 2e 70 75 73 68 28 67 61 74 65 77 61 79 42 75 6e 64 6c 65 29 2c 61 64 6d 69 6e 42 75 6e 64 6c 65 50 75 73 68 65 64 3d 21 30 29 3b 43 54 58 53 2e 47 61 74 65 77 61 79 2e 62 6f 6f 6b 6d 61 72 6b 73 4b 6e 6f 62 2e 41 64 6d 69 6e Data Ascii: .splice(json.bundles.length-1,0,gatewayBundle),AdminBookmarksJSON.bundles.push(gatewayBundle),adminBundlePushed=!0):b&&(json.bundles.push(gatewayBundle),AdminBookmarksJSON.bundles.push(gatewayBundle),adminBundlePushed=!0);CTXS.Gateway.bookmarksKnob.Admin
2022-04-01 15:32:09 UTC	1233	IN	Data Raw: 6c 28 29 7b 74 69 6d 65 72 49 44 26 26 77 69 6e 64 6f 77 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 69 6d 65 72 49 44 29 3b 70 72 6f 62 65 45 72 72 6f 72 73 2b 2b 3b 31 30 3c 70 72 6f 62 65 45 72 72 6f 72 73 3f 64 69 73 70 6c 61 79 44 6f 77 6e 6c 6f 61 64 41 72 65 61 28 29 3a 34 3d 3d 70 72 6f 62 65 45 72 72 6f 72 73 26 26 28 6d 61 63 5f 69 66 72 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6d 61 63 5f 69 66 72 61 6d 65 29 2c 6d 61 63 5f 69 66 72 61 6d 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 77 69 64 74 68 22 2c 22 31 22 29 2c 6d 61 63 5f 69 66 72 61 6d 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 68 Data Ascii: l(){timerID&&window.clearTimeout(timerID);probeErrors++;10<probeErrors?displayDownloadArea():4==probeErrors&&(mac_iframe=document.createElement("iframe"),document.body.appendChild(mac_iframe),mac_iframe.setAttribute("width","1"),mac_iframe.setAttribute("h
2022-04-01 15:32:09 UTC	1241	IN	Data Raw: 54 20 2f 73 76 63 3f 4e 53 43 5f 41 41 41 43 3d 22 2b 6e 73 5f 61 61 61 63 2b 22 26 6e 73 45 78 74 43 6f 6f 6b 69 65 3d 22 2b 6e 73 5f 6e 65 77 5f 61 61 61 63 2b 22 26 6e 73 6c 6f 63 3d 22 2b 6e 73 6c 6f 63 2b 22 26 6e 73 76 65 72 73 69 6f 6e 3d 22 2b 6e 73 56 65 72 73 69 6f 6e 2b 22 26 6e 73 74 72 61 63 65 3d 44 45 42 55 47 26 6e 73 76 69 70 3d 32 35 35 2e 32 35 35 2e 32 35 35 2e 32 35 35 26 6e 73 74 64 69 3d 4f 4e 20 48 54 54 50 2f 31 2e 31 5c 72 5c 6e 22 29 3b 69 66 28 31 3d 3d 62 29 7b 6c 6f 67 69 6e 53 75 63 63 65 73 73 28 29 3b 72 65 74 75 72 6e 7d 55 6e 73 65 74 43 6f 6f 6b 69 65 28 22 42 52 4f 57 53 45 52 5f 43 4f 4e 4e 45 43 54 22 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 22 53 54 41 52 54 5f 50 52 4f 42 45 5f 41 47 45 4e 54 3d 31 3b Data Ascii: T /svc?NSC_AAAC="+ns_aaac+"&nsExtCookie="+ns_new_aaac+"&nsloc="+nsloc+"&nsversion="+nsVersion+"&nstrace=DEBUG&nsvip=255.255.255.255&nstdi=ON HTTP/1.1\r\n");if(1==b){loginSuccess();return}UnsetCookie("BROWSER_CONNECT");document.cookie="START_PROBE_AGENT=1;
2022-04-01 15:32:09 UTC	1248	IN	Data Raw: 72 57 69 6e 64 6f 77 73 28 61 2c 64 2c 65 29 3a 6f 70 65 6e 47 61 74 65 77 61 79 55 72 69 57 69 74 68 48 69 64 64 65 6e 46 72 61 6d 65 28 61 2c 64 2c 65 29 7d 7d 3b 76 61 72 20 53 59 4d 5f 45 4e 43 5f 41 4c 47 4f 3d 22 41 45 53 2d 47 43 4d 22 2c 53 59 4e 5f 45 4e 43 5f 4b 45 59 5f 4c 45 4e 3d 32 35 36 2c 45 43 5f 43 55 52 56 45 5f 4e 41 4d 45 3d 22 50 2d 32 35 36 22 3b 0a 66 75 6e 63 74 69 6f 6e 20 67 65 74 45 43 44 65 74 61 69 6c 73 28 61 2c 62 29 7b 76 61 72 20 63 3d 62 3f 62 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 77 69 6e 64 6f 77 2e 70 61 73 73 5f 65 6e 63 5f 65 6e 61 62 6c 65 3d 21 31 3b 77 69 6e 64 6f 77 2e 70 61 73 73 5f 65 6e 63 5f 73 65 72 76 65 72 5f 74 69 6d 65 73 74 61 6d 70 3d 6e 75 6c 6c 3b 24 2e 63 74 78 73 41 6a 61 78 28 7b 73 74 6f 72 Data Ascii: rWindows(a,d,e):openGatewayUriWithHiddenFrame(a,d,e)}};var SYM_ENC_ALGO="AES-GCM",SYN_ENC_KEY_LEN=256,EC_CURVE_NAME="P-256";function getECDetails(a,b){var c=b?b:function(){};window.pass_enc_enable=!1;window.pass_enc_server_timestamp=null;$.ctxsAjax({stor
2022-04-01 15:32:09 UTC	1269	OUT	GET /nf/auth/getECdetails HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-Citrix-IsUsingHTTPS: Yes Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:09 UTC	1289	IN	HTTP/1.1 200 OK X-Content-Type-Options: nosniff X-XSS-Protection: 1 Content-Length: 23 Cache-control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: application/json; charset=utf-8 X-Citrix-Application: Receiver for Web {"encrypt": "DISABLED"}
2022-04-01 15:32:09 UTC	1289	OUT	GET /logon/LogonPoint/receiver/images/common/icon_vpn.ico HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:10 UTC	1290	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:58 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "7d26-5c74025d36a80" Accept-Ranges: bytes Content-Length: 32038 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Keep-Alive: timeout=15, max=84 Connection: Keep-Alive Content-Type: image/x-icon @@ (BF00 %nB h hx(@ @'3=I OZ[[[[[[[S LB9.!%5D V5nB!K&a1"}@,F1J4L5O7O7O7O7O7O7O7O7M6K4H2D/t;)P)H$> ~-fPB3$ 9X3t=d3#B.I2N6U;W<Y>X=W<V<U;U;U;U;U;U;U;U;U;U;U;U;V;V<W<Z>Y=W<S:M5H2~A-_0!;1q U8 ZY. E/Q8X=Z?Y>X=W<W<V;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;U;V;W<W<X=Z>Z?W<Q8D/U, Y ?]1!T:[?Z>X<W<V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;V;W<X<Z>[>T:]1!?"UG1]@X=W<W<W<W<W<W<W<W<W<W<W<W<W<V;V;V:U:U:U9U9U9U9U9U9U:U:U:V:V;V;W<W<W<W<W<W<W<W<W<W<W<W<W<Y=]@G1Q!RQ8]?X=X=X=X=X=X=X<X<X<W;U9S6P3N0Q4T7W:Y>\@\@`E`E`E`E`E`E^D[@\@X<V:S6P2N0Q4S6V9X<X<X<X<X=X=X=X=X=X=]?N6P0N5]?Y=Y=Y=Y=Z=W;R4Q3T7V9[?kR\|f{uybgMX<V9T6Q3R5W;Z=Y=Y=Y=Y=]@N50g8&`B[>[>[>[>Y<R4aEnjaDR4Y<[>[>[>[>`Bg8&%D]?]?\>\>\?Z<Z<Z<Z<\?\>\>]?]?%Do=)bC]?]?]?[=X9X9[=]?]?]?bCo=)U9`A^@^@^@V6V6^@^@^@`AU9]?_@_@_@]>cEcE]>_@_@_@]?`@`A`A`AZ9myw`iNdI`C^AY;Y:W8Q1Q1Q1Q1R2Y:Y9Z<^AbEeJkR{e}mZ9`A`A`A`@aAaAaAaAX6~\|jObFX9S2V5Z8\;^=_>_?`?a@a@aAbBbBbBbBbBa@a@`@`?_?_>^=\;Y8V5S2Y;eIjP\|~X6aAaAaAaAbBbBbBbBY7~R/]<`?bAcBcBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBbBcBcBbA_>]<R/~Y7bBbBbBbBdCdCdCdC[8~X5dCdCdCdCdCdCdCdCdCdCdCdCdCdCdC_=X5Z7bAdCdCdCdCdCdCdCdCdCdCdCdCdCdCX5~[8dCdCdCdCeCeCeCeC\8~Z6eCeCeCeCeCeCeCeCeCeCeCeCeCeCb?jkKcAeCeCeCeCeCeCeCeCeCeCeCeCeCZ6~\8eCeCeCeCfDfDfDfD]9[7fDfDfDfDfDfDfDfDfDfDfDfDfDfDc>^:fDfDfDfDfDfDfDfDfDfDfDfDfD[7]9fDfDfDfDgDgDgDgD^:\7gDgDgDgDgDgDgDgDgDgDgDgDgDgDd=]8gDgDgDgDgDgDgDgDgDgDgDgDgD\7^:gDgDgDgDhEhEhEhE`;]8hEhEhEhEhEhEhEhEhEhEhEhEhEhEe>^8hEhEhEhEhEhEhEhEhEhEhEhEhE]8`;hEhEhEhEiFiFiFiFa<^9iFiFiFiFiFiFiFiFiFiFiFiFiFiFe>_9iFiFiFiFiFiFiFiFiFiFiFiFiF^9a<iFiFiFiFkFkFkFkFc<_9kFkFkFkFkFkFkFkFkFkFkFkFkFkFa7^6kFkFkFkFkFkFkFkFkFkFkFkFkF_9c<kFkFkFkFkGkGkGkGc=a:kGkGkGkGkGkGkGkGkGkGkGlGkGf?ilEiDlGkGkGkGkGkGkGkGkGkGkGkGa:c=kGkGkGkGlGlGlGlGd=b:lGlGlGlGlGlGlGlGlGlGlGlGg@pLkElGlGlGlGlGlGlGlGlGlGlGb:d=lGlGlGlGnHnHnHnHf>d;nHnHnHnHnHnHnHnHnHnHnHkD{Yf>nHnHnHnHnHnHnHnHnHnHnHd;f>nHnHnHnHoIoIoIoIg?e<oIoIoIoIoIoIoIoIoIoIoIjBve;oIoIoIoIoIoIoIoIoIoIoIe<g?oIoIoIoIpIpIpIpIh?f<pIpIpIpIpIpIpIpIpIpIpIlChg=pIpIpIpIpIpIpIpIpIpIpIf<h?pIpIpIpIqJqJqJqJi@g=qJqJqJqJqJqJqJqJqJqJqJqHpIqmD
2022-04-01 15:32:10 UTC	1298	IN	Data Raw: b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b4 67 3d ff e5 cb bc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff cf 9f 83 ff b5 69 40 ff b9 71 4a ff b9 71 4a ff b9 71 4a ff b9 71 4a ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b5 6a 40 ff cf 9f 83 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e5 cb bc ff b4 68 3d ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 72 4a ff b9 73 4b ff b7 6e 46 ff b8 7e 5e ff e8 de d8 ff ff ff ff ff ff ff ff ff ff ff ff ff f7 f6 f4 ff c8 a3 8f ff b4 6c 43 ff b9 73 4a Data Ascii: qJqJqJqJqJqJqJqJqJqJqJg=i@qJqJqJqJrJrJrJrJj@h=rJrJrJrJrJrJrJrJrJrJrJsKnF~^lCsJ
2022-04-01 15:32:10 UTC	1305	IN	Data Raw: d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ff d1 94 5d ca d1 93 5c 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d2 95 5d 21 d2 95 5e 99 d2 95 5e Data Ascii: ]]]]]]]]]]]]]]]]]]]\4]!^^
2022-04-01 15:32:10 UTC	1313	IN	Data Raw: 00 00 00 00 00 00 00 00 c4 7e 53 01 00 00 00 00 c4 81 53 6a c4 82 53 f4 c4 82 53 ff c4 82 53 ff c4 82 53 ff c4 82 53 ff c5 84 55 ff bf 78 47 ff e2 c1 aa ff ff ff ff ff fe fc fb ff ff ff ff ff eb d3 c3 ff c2 7d 4c ff c4 82 53 ff c4 82 53 ff c4 82 53 ff c4 82 53 ff c4 82 53 ff c4 82 53 ff c4 82 53 ff c4 82 53 ff c4 83 54 ff c2 7f 4e ff cb 8f 66 ff fc f7 f5 ff ff ff ff ff ff ff ff ff ef dd d0 ff c1 7b 4a ff c4 83 54 ff c4 82 53 ff c4 82 53 fe c4 82 53 ff c4 82 53 fe c4 82 53 ff c4 82 53 c0 c4 81 52 21 00 00 00 00 c3 80 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 80 52 01 c4 81 53 02 00 00 00 00 c5 83 53 34 c5 83 54 ab c5 83 54 ee c5 83 54 ff c5 83 54 ff c6 85 57 ff c0 79 47 ff e1 bf a7 ff ff ff ff ff fe fc fc ff ff ff ff Data Ascii: ~SSjSSSSSUxG}LSSSSSSSSTNf{JTSSSSSSR!RRSS4TTTTWyG
2022-04-01 15:32:10 UTC	1321	IN	Data Raw: 8a 54 3e 26 a3 54 36 f2 c2 88 72 ff f4 ea e6 fc fe fe fd fc ff ff ff fd ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fd ff ff ff fd fd fc fb fc eb d9 d2 fb b5 70 55 ff 9f 54 36 ca 00 00 9b 01 ae 64 45 46 aa 5b 3a ff ef e1 da fd ee e1 dc ff c8 9c 89 ff c1 8d 77 ff ba 7f 66 ff b2 70 55 ff b4 73 58 ff bc 82 6b ff c4 92 7d ff cd a6 94 ff fa f8 f7 fe da b7 a9 ff a6 54 31 e9 be 85 6f 12 b1 67 45 45 ad 60 3d ff f5 eb e7 fe ce a0 8c ff a3 4d 26 ff ae 60 3d ff a9 57 32 ff c3 8d 73 ff bf 83 68 ff a9 57 32 ff ad 5f 3c ff a3 4c 25 ff e5 cd c3 fe e1 c5 b8 ff a9 57 32 ea c5 8d 73 11 b4 6c 48 46 b0 65 40 ff f5 eb e7 fe d5 ac 99 ff ae 60 3b ff b6 71 4e ff ad 5e 37 ff da bd ab ff d2 ac 97 ff ae 5f 38 ff b6 70 4e ff ae 60 3a ff ea d5 cb fe e2 c6 b8 ff ac 5c 35 eb c6 8f 74 Data Ascii: T>&T6rpUT6dEF[:wfpUsXk}T1ogEE`=M&`=W2shW2_<L%W2slHFe@`;qN^7_8pN`:\5t
2022-04-01 15:32:10 UTC	1326	OUT	GET /logon/LogonPoint/receiver/images/common/ReceiverFullScreenBackground.jpg HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:11 UTC	1327	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:59 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "c676-5c74025d36a80" Accept-Ranges: bytes Content-Length: 50806 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Keep-Alive: timeout=15, max=83 Connection: Keep-Alive Content-Type: image/jpeg JFIFC %# , #&'))-0-(0%()(C (((((((((((((((((((((((((((((((((((((((((((((((((((@ "$!1QAqa"2?REv9a!PhEX@fP$haQ@djU, 2)Aa $PmvquH,"H@H5+#Q $" #P$R@d$X("9{\EX @PP E ($ $Pi" ,@"(,H($$@^MTQy@ )R@H(* HEPhH,"$Fdi.{(#D` B@HEdRH(4@fAR !FT 2)$PP!B(Q=g9H(+$j$FD DPR EHPP ` ,@@ @@H@;(DQtXGX@B,! "XDhQa(PPDQDH,?DA`EAHH()@"PH,PE`@AR P@d$5X@@ @"3=D @@ HH@ PHDPX($"EH"(E $PTg;]4@@\DyPPPPPaA`)Q"FPPX@A@fFDT(,@ `#H"()R@AAPXP #H," "FT!FY 24t9uQDHj)@H()((-Ab@$H+h HH(H$FdX () A"@R"DH(.(byP@H(((, B"PP#Q $", ! DPX`Ph5+"(/>fqDAa@ $h`EX@B$"EAb@`24"FAbA@$"H+0jsA"40X@dRP@AAQ#@25 EH Dj PP (AEb"("(vh ?F' (B($FX@H" ",!FX@BA@AH,@"ED/24DADXFfa A@AH,@(ARP@AaP"FPX@@!^~QsHbFdR@A@fD@AP&@di H `"P"(,@@ HP)@AP&My6ePE@N0$PTPQD$"A#P D @@B(A@GoQH ," $"5#HE@"E $PTPaPDPR [$PE$"42()Aa 4H,@AYM@ P DQDHAPT2)@ @@P$PT$FdX(@ @@Mh`2 (?K'@!PPXAR (","!D(,HH $P >-M)U 3`j PX@@@A@fdR @3`#FekHhET"PR$X"4"T A@fX$FVF@@(2,@"EDFE$PH* (@AR(dX R( $PT;u@C~G!P@HE 24@T 2)B$A@AR)AP @@(D3#Q $H ,H@A@dDTP #@24P@HF&,HH !B Q,A@Dj$A 24XAPPXPXPB($MVf @B(`E"4 @ "Q"4 "$muP~G!!@HE "H,@PXP()( 8H24X "X@!A40DH"X!@H9?B(+#I $P$hafHf$ FEHHB$X0PX HAY@EDi)@DD"$EE(FDiAP"({xh?Ry8APB PPR(HE@DhE! PH(P Px4 $" !FdR P" 3@H,+"X@HEAR 0=k2aQ!f0$,HE!FdX$YUj"E"FY$idjH@A@@"b w("4@dRH@Ab E4H" E 7n6srMPN EAHEHE75wm`"XH@HEVE $"#H)H 2Ff]8fg"B,VFdhI 30BF D "F@H1#idjDDH B"$j HF@B,@A@@"5qD"E R"B(ETPX$iH"( " 7A ?T(A@@EH$PHAHE "(l}~6Ue$ PEHE "4"X@B, $")B /sHE"FfB" $PAYi@d+0PH2)!U4PH+$X"* 1#iY "E4D"E !T" DP"E\{2B@<@A@PAY@Aa"(,E H24 ARP<[yM/T!QVH#H(Q "E!P !`$\\gEha!XETQFdi!T@AHB50 1+)` $"4$FH5+1#Q(`"5D $,T"4EqD#I` @" w\<i B((-ADXN@@" AB)(@D$F(G~vQ$ PAQfa!a"FFdjF@AaAa$u9u0+l`m"@f@fUf+#P7 #Q $" f$mdjQ$j$`@ARB(Udi $F$j$`X#[AR#Qe)f V`d]E($ R"DhE)@H"F#I@P)@{[z@d((Z." @AQ@@"4PAuDPMQE@AH/:H A<{y $P@HE$"A@A@A@AaX@djVj\B(40B0D"!, "5+0DX@dj#Q 545j$!H(HFB5B(R $X@dR1#B(H5T@VEHAA@Cqb M@EH@4T@b5dTPDxvDPT?T ((("4@T5@dT]<[75k$PPX!XB(QdjF@dB0B0B128Ff@fV "D$jjXARaDTX@HE@A@f+bFE@DHUd 17H$oq 2)Q"@f $M5#H* (APTQ DiqQEA@dX"5T"EHDhD"()sloSt @NPVQQ)ABPQ(P@Td5MP-OuQ X@AaR@HE! A@A@B(B(u]"E!A!a!APP45+0B#HB7H+0X#I!$QD!U1#q 1@b$Q$aT!q#@17p[@HDHEVb6H@B j E A"@H gr(b DP "U$Pn"` H?R j(&(.{m@tT EEX#PX4B*p&,jFb!$"B, 5
2022-04-01 15:32:11 UTC	1335	IN	Data Raw: 08 0c c2 35 08 0c c4 8d c2 03 10 8d c4 80 cc 23 50 8a 33 08 d4 48 2a 41 60 08 93 1a 01 98 91 b8 90 18 9f e1 1b 89 3f c1 58 84 6e 62 40 66 24 6e 6a 03 30 6a 10 18 89 1b 89 05 64 8d 44 80 cc 1a 88 a3 31 23 71 20 31 06 88 2b 10 6a 24 51 92 35 12 08 cc 46 d2 0a c8 b1 20 24 4d c6 85 18 88 e9 13 70 1c e0 d6 e7 d2 28 88 d4 41 52 23 48 09 11 a8 80 89 1a 88 a3 31 1b 4d c1 59 46 a2 05 44 8d 44 15 05 48 09 11 a4 15 91 a8 90 11 22 8a 88 2a 00 91 40 64 50 19 dc 46 81 59 17 73 e9 00 45 05 44 69 20 21 00 54 22 90 19 15 20 00 02 23 49 01 00 55 11 40 41 62 00 00 00 0a 00 02 6e 28 0c 0d c6 77 04 40 00 00 00 00 00 07 0f 26 de b5 db ad 9c ee b8 26 88 29 11 50 58 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 00 00 00 00 00 00 Data Ascii: 5#P3HA`?Xnb@f$nj0jdD1#q 1+j$Q5F $Mp(AR#H1MYFDDH"@dPFYsEDi !T" #IU@Abn(w@&&)PX
2022-04-01 15:32:11 UTC	1342	IN	Data Raw: 28 02 d1 01 54 42 82 89 4a 0a 25 01 44 01 44 01 44 01 44 01 44 a5 05 12 94 14 28 00 00 b4 a8 02 ab 25 15 aa ac aa 0a 25 51 05 40 14 00 15 17 00 69 95 15 40 41 40 05 0c 04 68 4c 54 17 15 14 17 15 31 41 5b f1 6c ea 7d b1 86 6c da 83 d5 8b 8c f3 b7 2b 58 a8 d6 09 8a 8a d2 e2 2e 22 2a e2 2e 20 b8 d2 62 a0 b8 b8 8b 80 d6 2e 22 e2 2a e2 a6 35 88 0a 62 e2 0b 9f 0d 62 34 06 35 89 8a c8 e9 e2 cf 7a eb 8c f8 f2 72 de 02 e2 98 b8 88 63 59 86 63 48 a6 2e 0b 88 2e 2e 0a 80 a6 62 80 a3 59 88 19 8a b9 82 04 51 73 10 33 14 69 15 22 99 8d 66 01 98 a2 c4 13 31 62 88 02 e6 2c 04 82 a8 24 22 90 11 56 11 04 23 50 11 98 b1 40 48 46 88 0c c2 35 08 0c c2 35 05 18 84 68 06 60 d1 04 65 23 51 22 8c ee 23 68 0c 8b 12 28 91 96 c1 18 88 d6 e2 2a 33 b8 91 b8 80 c2 37 b8 91 46 37 11 b8 Data Ascii: (TBJ%DDDDD(%%Q@i@A@hLT1A[l}l+X.". b."5bb45zrcYcH...bYQs3i"f1b,$"V#P@HF55h`e#Q"#h(*37F7
2022-04-01 15:32:11 UTC	1350	IN	Data Raw: 55 00 40 01 40 10 00 54 00 01 14 04 45 01 91 75 15 11 35 40 44 54 d5 11 35 45 11 17 51 51 35 17 50 44 df 96 1b d6 75 55 35 15 15 13 59 6b 7e 19 54 4d 45 4d 51 94 d6 99 d5 19 d4 d6 b5 35 51 8d 1a d6 54 67 7e 53 57 53 54 65 35 53 54 67 53 5a d4 54 63 59 d6 ba 45 19 d6 75 a6 75 51 35 35 51 46 75 35 75 35 44 df 86 35 bd 67 55 23 3a 8d 6a 6a 8c b3 d3 5a 9b f0 a3 2c eb 4c ea 89 a8 a8 0c ea 35 ac 82 26 aa 6a 8c a7 4d 6a 6a 8c b2 d4 4d c0 44 54 51 35 8d f9 74 d6 75 70 67 51 52 28 9a cb 5a 9a 82 24 51 44 4d 50 19 22 ea 0a 82 ea 08 ce a3 5b 95 05 40 14 41 58 f3 6f a7 c7 b3 e7 e0 58 f2 79 3a f5 77 ba c8 22 a4 14 04 16 00 82 80 80 44 50 58 b0 19 58 b0 82 a0 aa 09 05 10 02 28 22 80 02 c5 88 a9 16 0a 00 45 41 22 8b 01 17 31 62 82 45 22 a2 a4 51 60 22 c5 82 04 16 2c 04 Data Ascii: U@@TEu5@DT5EQQ5PDuU5Yk~TMEMQ5QTg~SWSTe5STgSZTcYEuuQ55QFu5u5D5gU#:jjZ,L5&jMjjMDTQ5tupgQR(Z$QDMP"[@AXoXy:w"DPXX("EA"1bE"Q`",
2022-04-01 15:32:11 UTC	1358	IN	Data Raw: 61 01 05 84 04 15 41 21 16 2c 11 91 a0 44 16 10 10 58 40 42 28 00 00 02 88 40 58 08 2c 22 08 2c 20 23 48 aa 80 00 2a 28 0b 11 70 d4 00 41 73 2e e6 3d 19 ed 8e 5e 1c bd 5f a7 60 0c 50 05 c4 50 00 41 55 95 aa 8a a8 22 aa e3 35 44 68 40 1a 75 f1 ed e5 c6 b7 e3 df 7f e8 ae c2 08 2d 54 01 ac d6 b3 58 01 d0 ac 66 b5 51 1a 5a ca d1 5a aa c2 d4 1b a3 35 50 6b 35 ac d7 3a a0 e9 56 b9 d6 b3 51 5b ab 58 5a 83 75 6b 05 06 ea d6 2a 83 75 6b 15 6a 0d e6 b5 5c ab 59 a2 ba 51 8a b5 06 f3 56 b1 56 a2 b7 57 35 8a a8 37 9d 35 5c aa d4 57 4a b5 ce ad 06 ea d6 2a d0 6e ae 6b 15 51 5b a5 62 ad 15 ba 56 2a d4 1a ab 58 ab 45 6a ad 62 ad 41 aa b5 8a b4 56 a9 59 a5 06 a9 52 95 22 ad 5a c8 2b 54 ac d2 83 54 ac 80 d2 25 05 51 29 45 51 2a 50 68 ac d5 a0 51 29 41 44 a9 45 5a 33 75 37 Data Ascii: aA!,DX@B(@X,", #H(pAs.=^_`PPAU"5Dh@u-TXfQZZ5Pk5:VQ[XZukukj\YQVVW575\WJnkQ[bVXEjbAVYR"Z+TT%Q)EQ*PhQ)ADEZ3u7
2022-04-01 15:32:11 UTC	1365	IN	Data Raw: fe 1a 79 ff 00 27 ab d6 73 f4 26 b8 d4 05 64 54 01 69 52 82 2d 2a 52 80 25 04 6a 95 90 1a a2 52 88 b4 a8 20 2d 40 16 88 08 d0 85 05 28 02 88 50 50 10 16 a0 0a 22 82 d5 64 44 6a ab 35 41 56 a0 0a 22 d0 16 a0 83 4a c2 d0 68 4a a8 00 0a b4 cd 40 1a aa cd 10 68 a9 54 14 40 15 6b 35 41 68 80 28 8b 40 0a 51 45 a9 4a 88 b4 a9 4a a2 d2 a5 4a 2b 54 ac 82 2d 4a 14 01 28 05 10 aa 2a 15 01 50 a8 a8 05 4a 0a 88 55 0a 82 6e aa 05 40 04 dd 2b 2a 02 68 a8 25 35 35 50 a8 26 a8 20 80 6e a0 95 50 a8 26 ea 86 ea 06 aa 25 04 d5 1f 79 41 f3 5d c0 a2 06 28 00 62 c0 01 40 20 08 0a 62 82 28 00 00 00 00 00 01 08 10 08 40 02 10 20 10 81 01 45 19 1a 88 2a 23 49 a0 80 00 8a 28 80 00 8a 02 0a 9a a4 12 28 08 8d 32 a0 40 04 89 ab a2 88 02 89 a8 d3 22 40 00 88 68 28 81 05 13 51 41 10 d0 Data Ascii: y's&dTiR-R%jR -@(PP"dDj5AV"JhJ@hT@k5Ah(@QEJJJ+T-J(PJUn@+h%55P& nP&%yA](b@ b(@ E#I((2@"@h(QA
2022-04-01 15:32:11 UTC	1373	IN	Data Raw: 11 01 50 0a c8 08 a8 a1 a8 ba 8a 89 a2 b2 21 a8 1a a8 80 6a a3 3a 8b a8 a0 68 8a 86 b3 aa 08 ca 6f c2 ef b2 2a 20 22 a2 26 aa 2a 26 a6 b5 a8 a8 ca 6b 49 a3 28 9a a6 aa 33 a8 a8 a8 9a 1a 2a 20 ba ce 88 86 82 b3 a8 02 a2 6a 6a 8a 8c b7 f2 c3 5c 88 a0 34 22 35 a8 32 ca 6b 48 a8 80 00 00 89 a2 a2 a6 a2 34 82 22 29 aa 88 00 80 0a 06 80 20 6a 51 95 12 94 14 4a 50 54 d2 94 10 05 40 00 00 00 00 16 a0 0b 44 11 1a 19 5a 0a 25 01 40 00 00 00 00 01 40 00 a5 00 51 00 51 29 41 40 02 ad 41 05 10 22 d5 12 ad 0a a5 4a 02 d1 04 56 86 56 82 89 4a 0b 56 a3 3e 4d f4 f3 a0 e3 df 57 ad d4 a9 4a 8c ad 10 45 68 64 11 a1 0a 2a 89 4a 0a 25 28 28 94 a0 a2 28 00 01 4a 00 a2 02 2a d6 6a d4 14 40 14 28 02 a0 0b 44 01 a1 91 20 d0 80 28 94 a0 a2 52 82 d5 66 80 d0 85 11 42 80 55 a8 05 51 Data Ascii: P!j:ho* "&&kI(3 jj\4"52kH4") jQJPT@DZ%@@QQ)A@A"JVVJV>MWJEhdJ%(((Jj@(D (RfBUQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49802	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:08 UTC	1122	OUT	GET /logon/LogonPoint/custom/script.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:08 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:56 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "399-5c74025d36a80" Accept-Ranges: bytes Content-Length: 921 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:08 UTC	1128	IN	Data Raw: ef bb bf 2f 2f 20 45 64 69 74 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 61 64 64 20 79 6f 75 72 20 63 75 73 74 6f 6d 69 7a 65 64 20 4a 61 76 61 53 63 72 69 70 74 20 6f 72 20 6c 6f 61 64 20 61 64 64 69 74 69 6f 6e 61 6c 20 4a 61 76 61 53 63 72 69 70 74 20 66 69 6c 65 73 2e 0a 0a 2f 2a 20 45 78 61 6d 70 6c 65 20 63 75 73 74 6f 6d 69 7a 61 74 69 6f 6e 20 2d 20 53 68 6f 77 20 61 20 63 6c 69 63 6b 20 74 68 72 6f 75 67 68 20 73 63 72 65 65 6e 20 6f 6e 20 77 65 62 20 61 6e 64 20 6e 61 74 69 76 65 20 2a 2f 0a 0a 2f 2a 0a 76 61 72 20 64 6f 6e 65 43 6c 69 63 6b 54 68 72 6f 75 67 68 20 3d 20 66 61 6c 73 65 3b 0a 0a 2f 2f 20 42 65 66 6f 72 65 20 77 65 62 20 6c 6f 67 69 6e 0a 43 54 58 53 2e 45 78 74 65 6e 73 69 6f 6e 73 2e 62 65 66 6f 72 65 4c 6f 67 6f 6e 20 3d 20 66 Data Ascii: // Edit this file to add your customized JavaScript or load additional JavaScript files./* Example customization - Show a click through screen on web and native //var doneClickThrough = false;// Before web loginCTXS.Extensions.beforeLogon = f

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49804	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:08 UTC	1123	OUT	GET /logon/LogonPoint/custom/strings.en.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:08 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:56 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "1b6-5c74025d36a80" Accept-Ranges: bytes Content-Length: 438 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:08 UTC	1129	IN	Data Raw: 24 2e 63 74 78 73 41 6a 61 78 28 7b 0a 09 74 79 70 65 3a 20 27 47 45 54 27 2c 0a 09 75 72 6c 3a 20 22 2f 6c 6f 67 6f 6e 2f 4c 6f 67 6f 6e 50 6f 69 6e 74 2f 63 75 73 74 6f 6d 2f 73 74 72 69 6e 67 73 2e 65 6e 2e 6a 73 6f 6e 22 2c 0a 09 64 61 74 61 54 79 70 65 3a 20 27 6a 73 6f 6e 27 2c 0a 09 61 73 79 6e 63 3a 20 66 61 6c 73 65 2c 0a 09 73 75 63 63 65 73 73 3a 20 63 75 73 74 6f 6d 5f 73 74 72 69 6e 67 73 5f 69 6e 69 74 69 61 6c 69 7a 65 2c 0a 09 65 72 72 6f 72 3a 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 44 61 74 61 2c 20 74 65 78 74 53 74 61 74 75 73 2c 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 20 7b 0a 09 7d 2c 0a 09 72 65 66 72 65 73 68 53 65 73 73 69 6f 6e 3a 20 74 72 75 65 0a 7d 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 63 75 73 74 6f 6d 5f Data Ascii: $.ctxsAjax({type: 'GET',url: "/logon/LogonPoint/custom/strings.en.json",dataType: 'json',async: false,success: custom_strings_initialize,error: function(responseData, textStatus, XMLHttpRequest) {},refreshSession: true});function custom_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49807	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:08 UTC	1123	OUT	GET /logon/LogonPoint/receiver/images/1x/actionSprite.png HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:08 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:56 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "95a-5c74025d36a80" Accept-Ranges: bytes Content-Length: 2394 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:08 UTC	1130	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 86 00 00 00 13 08 06 00 00 00 55 d2 75 61 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0e bf 00 00 0e bf 01 38 05 53 24 00 00 00 07 74 49 4d 45 07 df 04 01 0c 0c 2c f5 f7 1f 74 00 00 08 e7 49 44 41 54 68 de dd 9a 7b 6c 5b d5 1d c7 3f bf 6b 3b 76 93 94 32 0d 34 c1 d6 c7 18 65 6c b0 b1 89 56 a2 3c 6c a7 5b 40 45 20 b5 1b 81 b5 25 76 52 3a c2 78 15 21 18 eb 63 69 12 1a 86 e8 c6 63 65 63 40 1f b9 4e 5b 44 cb 4b 62 50 a0 db 6c df 44 b4 83 21 34 8d 32 51 d8 80 16 31 81 40 a5 49 1c d2 d8 f7 fe f6 87 6f 8a 9d 38 89 9d b8 30 ed 48 57 b9 e7 9c 7b 4e ce b9 e7 73 be e7 f7 fb f9 0a ff ef 69 8b 75 1e 5e 4f 2d fd fe bb 68 9a d3 3f bc 5a 55 c7 ed 42 cc 64 33 18 69 8d 5e f0 ab Data Ascii: PNGIHDRUuabKGDpHYs8S$tIME,tIDATh{l[?k;v24elV<l[@E %vR:x!cicec@N[DKbPlD!42Q1@Io80HW{Nsiu^O-h?ZUBd3i^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49806	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:08 UTC	1124	OUT	GET /logon/LogonPoint/receiver/images/1x/folder_template.png HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:08 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:56 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "1b0-5c74025d36a80" Accept-Ranges: bytes Content-Length: 432 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:08 UTC	1136	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 06 00 00 00 3a fc d9 72 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 01 52 49 44 41 54 78 da ec db b1 4a c3 40 00 87 f1 3b 53 c5 08 8a 10 aa 9b 28 5d 74 74 72 d0 37 70 70 15 71 f0 01 74 f6 01 1c 2b 74 2a 3e 81 a3 88 38 08 e2 28 fa 00 2e 82 08 59 1c 44 b3 b8 9a 10 bf 83 0c 5d 85 34 3d 72 ff 83 6f 6c 8e 1f 97 5e ae d0 d8 34 4d 4d 48 63 ca 04 36 46 c1 33 74 4c cf f4 43 e5 3f 73 9f 79 a5 4b da 23 eb 23 d8 56 b7 f4 32 dd d1 66 8d d7 7e a4 7d fa f0 6d 85 3b 74 55 33 d6 8d 1d 7a a2 9e 6f e0 03 da 1e d3 f5 57 e8 81 ba 3e 81 0f c7 3c c7 2a dd d2 9c 2f e0 ad 06 e6 71 73 dc d3 9a 0f e0 85 86 e6 72 5f 9b 37 ba a6 23 da a0 Data Ascii: PNGIHDR<<:rtEXtSoftwareAdobe ImageReadyqe<RIDATxJ@;S(]ttr7ppqt+t>8(.YD]4=rol^4MMHc6F3tLC?syK##V2f~}m;tU3zoW></qsr_7#

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49808	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:08 UTC	1124	OUT	GET /logon/LogonPoint/receiver/images/1x/viewSprite.png HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:08 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:56 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "c5f-5c74025d36a80" Accept-Ranges: bytes Content-Length: 3167 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:08 UTC	1133	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 e9 00 00 00 19 08 06 00 00 00 d4 a5 09 fa 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e bf 00 00 0e bf 01 38 05 53 24 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 30 2e 35 65 85 32 65 00 00 0b dd 49 44 41 54 78 5e ed 9c 09 c8 3d 55 19 c6 2d 4d 2d 2b 4b 5b 5d 42 4b d4 0a d3 54 2c c3 35 5b 6c 31 dc 37 5c 20 ca 25 15 0a 35 d4 d4 cc b2 12 44 41 c4 4a 25 a8 70 29 35 09 a2 0c 45 cd 2d 48 30 2c 4d 2d cb d4 14 53 cb 2d 77 d3 7e bf f1 39 d3 dc 7b e7 2e df 77 e7 7e ff fe f2 3d f0 7c 33 e7 79 df f3 9e b9 73 e6 bd 67 e6 cc b9 df 32 8b 58 c4 22 96 02 bc f0 c2 0b cf c3 ff cc 88 cf a7 19 db 69 b3 4f cc 84 31 ce da f0 6a f8 fc 8b 7d 40 7b Data Ascii: PNGIHDRgAMAapHYs8S$tEXtSoftwarepaint.net 4.0.5e2eIDATx^=U-M-+K[]BKT,5[l17\ %5DAJ%p)5E-H0,M-S-w~9{.w~=\|3ysg2X"iO1j}@{

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49809	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:09 UTC	1179	OUT	GET /logon/LogonPoint/plugins/ns-gateway/ns-nfactor.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:09 UTC	1254	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:57 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:47 GMT ETag: "8543-5c74026d6d0c0" Accept-Ranges: bytes Content-Length: 34115 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:09 UTC	1254	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 28 24 29 20 7b 0a 0a 09 43 54 58 53 2e 45 78 74 65 6e 73 69 6f 6e 41 50 49 2e 61 64 64 50 6c 75 67 69 6e 28 7b 0a 09 09 6e 61 6d 65 3a 20 22 6e 73 2d 6e 66 61 63 74 6f 72 22 2c 20 2f 2f 20 4e 61 6d 65 20 6f 66 20 70 6c 75 67 69 6e 20 2d 20 6d 75 73 74 20 6d 61 74 63 68 20 6e 61 6d 65 20 73 65 6e 74 20 69 6e 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 0a 09 09 69 6e 69 74 69 61 6c 69 7a 65 3a 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 0a 09 09 09 2f 2a 0a 09 09 09 20 2a 20 43 75 73 74 6f 6d 20 63 72 65 64 65 6e 74 69 61 6c 20 68 61 6e 64 6c 65 72 20 66 6f 72 20 47 6f 6f 67 6c 65 20 52 65 43 61 70 74 63 68 61 2e 0a 09 09 09 20 2a 20 49 66 20 61 20 63 72 65 64 65 6e 74 69 61 6c 20 6f 66 20 74 79 70 65 20 22 6e 66 2d 72 65 63 61 Data Ascii: (function ($) {CTXS.ExtensionAPI.addPlugin({name: "ns-nfactor", // Name of plugin - must match name sent in configurationinitialize: function () {/* * Custom credential handler for Google ReCaptcha. * If a credential of type "nf-reca
2022-04-01 15:32:09 UTC	1262	IN	Data Raw: 6c 54 79 70 65 4e 61 6d 65 3a 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 09 09 09 09 09 72 65 74 75 72 6e 20 22 6e 66 2d 70 6f 6c 6c 22 3b 0a 09 09 09 09 7d 2c 0a 09 09 09 09 2f 2f 20 47 65 6e 65 72 61 74 65 20 48 54 4d 4c 20 66 6f 72 20 74 68 65 20 63 75 73 74 6f 6d 20 63 72 65 64 65 6e 74 69 61 6c 0a 09 09 09 09 67 65 74 43 72 65 64 65 6e 74 69 61 6c 54 79 70 65 4d 61 72 6b 75 70 3a 20 66 75 6e 63 74 69 6f 6e 20 28 72 65 71 75 69 72 65 6d 65 6e 74 73 29 20 7b 0a 09 09 09 09 09 63 72 65 61 74 65 54 6f 70 4d 65 6e 75 28 29 3b 0a 09 09 09 09 09 76 61 72 20 6c 61 62 65 6c 20 3d 20 24 28 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 74 61 6e 64 61 6c 6f 6e 65 54 65 78 74 20 6c 61 62 65 6c 20 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 20 72 6f 6c 65 3d 22 61 6c 65 Data Ascii: lTypeName: function () {return "nf-poll";},// Generate HTML for the custom credentialgetCredentialTypeMarkup: function (requirements) {createTopMenu();var label = $('<div class="standaloneText label confirmation" role="ale
2022-04-01 15:32:09 UTC	1270	IN	Data Raw: 2e 61 74 74 72 28 22 63 6f 6d 6d 61 6e 64 22 2c 20 63 6f 6d 6d 61 6e 64 29 3b 0a 09 09 7d 09 0a 09 7d 20 65 6c 73 65 20 7b 0a 09 09 74 65 78 74 42 6f 78 2e 61 74 74 72 28 22 63 6f 6d 6d 61 6e 64 22 2c 20 63 6f 6d 6d 61 6e 64 29 3b 0a 09 09 24 28 22 23 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 22 29 2e 73 6c 69 64 65 44 6f 77 6e 28 32 35 30 29 3b 0a 09 7d 0a 7d 0a 0a 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 47 6f 28 29 20 7b 0a 09 76 61 72 20 74 65 78 74 42 6f 78 20 3d 20 24 28 22 2e 6f 74 70 2d 74 65 78 74 22 29 3b 0a 09 76 61 72 20 63 6f 6d 6d 61 6e 64 20 3d 20 74 65 78 74 42 6f 78 2e 61 74 74 72 28 22 63 6f 6d 6d 61 6e 64 22 29 3b 0a 09 72 65 6d 6f 76 65 49 6e 66 6f 4d 65 73 73 61 67 65 28 29 3b 0a 09 24 28 22 23 6f 74 70 2d 63 6f 6e 66 2d 64 69 76 Data Ascii: .attr("command", command);}} else {textBox.attr("command", command);$("#text-container").slideDown(250);}}function handleGo() {var textBox = $(".otp-text");var command = textBox.attr("command");removeInfoMessage();$("#otp-conf-div
2022-04-01 15:32:09 UTC	1277	IN	Data Raw: 24 28 22 23 72 65 67 69 73 74 65 72 65 64 2d 6f 74 70 20 6f 70 74 69 6f 6e 3a 73 65 6c 65 63 74 65 64 22 29 2e 72 65 6d 6f 76 65 28 29 3b 0a 09 09 64 69 73 70 6c 61 79 4d 65 73 73 61 67 65 28 22 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 2c 20 22 4f 54 50 44 65 6c 65 74 65 44 65 76 69 63 65 53 75 63 63 65 73 73 22 2c 20 64 65 76 69 63 65 4e 61 6d 65 29 3b 0a 09 09 69 66 28 24 28 22 23 72 65 67 69 73 74 65 72 65 64 2d 6f 74 70 20 6f 70 74 69 6f 6e 22 29 2e 6c 65 6e 67 74 68 20 3d 3d 20 30 29 20 7b 0a 09 09 09 64 69 73 70 6c 61 79 46 54 55 55 49 28 29 3b 0a 09 09 7d 0a 09 7d 20 65 6c 73 65 20 7b 0a 09 09 64 69 73 70 6c 61 79 4d 65 73 73 61 67 65 28 22 65 72 72 6f 72 22 2c 20 22 4f 54 50 44 65 6c 65 74 65 44 65 76 69 63 65 46 61 69 6c 75 72 65 22 2c 20 64 65 76 Data Ascii: $("#registered-otp option:selected").remove();displayMessage("confirmation", "OTPDeleteDeviceSuccess", deviceName);if($("#registered-otp option").length == 0) {displayFTUUI();}} else {displayMessage("error", "OTPDeleteDeviceFailure", dev
2022-04-01 15:32:09 UTC	1285	IN	Data Raw: 63 6f 64 65 46 69 65 6c 64 29 20 7b 0a 09 09 09 09 69 66 28 24 28 27 23 6f 74 70 6d 61 6e 75 61 6c 65 6e 74 72 79 27 29 2e 69 73 28 27 3a 63 68 65 63 6b 65 64 27 29 29 20 7b 0a 09 09 09 09 09 70 61 73 73 63 6f 64 65 46 69 65 6c 64 2e 73 68 6f 77 28 29 3b 0a 09 09 09 09 09 24 28 27 23 6f 74 70 70 75 73 68 27 29 2e 76 61 6c 28 22 66 61 6c 73 65 22 29 3b 0a 09 09 09 09 7d 20 65 6c 73 65 20 7b 0a 09 09 09 09 09 24 28 22 23 70 61 73 73 77 64 31 22 29 2e 76 61 6c 28 22 22 29 3b 0a 09 09 09 09 09 70 61 73 73 63 6f 64 65 46 69 65 6c 64 2e 68 69 64 65 28 29 3b 0a 09 09 09 09 09 24 28 27 23 6f 74 70 70 75 73 68 27 29 2e 76 61 6c 28 22 74 72 75 65 22 29 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 0a 09 09 09 24 28 27 23 6f 74 70 6d 61 6e 75 61 6c 65 6e 74 72 79 27 29 2e Data Ascii: codeField) {if($('#otpmanualentry').is(':checked')) {passcodeField.show();$('#otppush').val("false");} else {$("#passwd1").val("");passcodeField.hide();$('#otppush').val("true");}}$('#otpmanualentry').

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49810	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:09 UTC	1288	OUT	POST /logon/LogonPoint/Resources/List HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive Content-Length: 35 Accept: application/json, text/javascript, /; q=0.01 X-Citrix-IsUsingHTTPS: Yes X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: https://emsonline.tritech.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:09 UTC	1289	OUT	Data Raw: 66 6f 72 6d 61 74 3d 6a 73 6f 6e 26 72 65 73 6f 75 72 63 65 44 65 74 61 69 6c 73 3d 44 65 66 61 75 6c 74 Data Ascii: format=json&resourceDetails=Default
2022-04-01 15:32:10 UTC	1290	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: text/plain; charset=utf-8 Expires: -1 X-Citrix-Application: Receiver for Web CitrixWebReceiver-Authenticate: reason="notoken", location="/cgi/GetAuthMethods" Content-Length: 22
2022-04-01 15:32:10 UTC	1290	IN	Data Raw: 7b 22 75 6e 61 75 74 68 6f 72 69 7a 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"unauthorized": true}
2022-04-01 15:32:10 UTC	1322	OUT	POST /cgi/GetAuthMethods HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive Content-Length: 0 Accept: application/xml, text/xml, /; q=0.01 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-Citrix-IsUsingHTTPS: Yes Origin: https://emsonline.tritech.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:10 UTC	1322	IN	HTTP/1.1 200 OK X-Content-Type-Options: nosniff X-XSS-Protection: 1 Content-Length: 139 Cache-control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: application/vnd.citrix.authenticateresponse-1+xml; charset=utf-8 X-Citrix-Application: Receiver for Web <?xml version="1.0" encoding="UTF-8"?><authMethods><method name="ExplicitForms" url="/p/u/getAuthenticationRequirements.do"/></authMethods>
2022-04-01 15:32:10 UTC	1322	OUT	POST /p/u/getAuthenticationRequirements.do HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive Content-Length: 0 Accept: application/xml, text/xml, /; q=0.01 X-Citrix-IsUsingHTTPS: Yes X-Citrix-AM-CredentialTypes: none, username, domain, password, newpassword, passcode, savecredentials, textcredential, webview, nsg-epa, nsg-x1, nsg-setclient, nsg-eula, nsg-tlogin, nsg-fullvpn, nsg-hidden, nsg-auth-failure, nsg-auth-success, nsg-epa-success, nsg-l20n, GoBack, nf-recaptcha, ns-dialogue, nf-gw-test, nf-poll, nsg_qrcode, nsg_manageotp, negotiate, nsg_push, nsg_push_otp, nf_sspr_rem X-Requested-With: XMLHttpRequest X-Citrix-AM-LabelTypes: none, plain, heading, information, warning, error, confirmation, image, nsg-epa, nsg-epa-failure, nsg-login-label, tlogin-failure-msg, nsg-tlogin-heading, nsg-tlogin-single-res, nsg-tlogin-multi-res, nsg-tlogin, nsg-login-heading, nsg-fullvpn, nsg-l20n, nsg-l20n-error, certauth-failure-msg, dialogue-label, nsg-change-pass-assistive-text, nsg_confirmation, nsg_kba_registration_heading, nsg_email_registration_heading, nsg_kba_validation_question, nsg_sspr_success, nf-manage-otp User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Origin: https://emsonline.tritech.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:10 UTC	1324	IN	HTTP/1.1 200 OK Set-Cookie: NSC_DLGE=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: NSC_USER=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: NSC_ERRM=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: NSC_BASEURL=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: CsrfToken=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: CtxsAuthId=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure Set-Cookie: ASP.NET_SessionId=xyz;Path=/;expires=Wednesday, 09-Nov-1999 23:12:40 GMT;Secure X-Content-Type-Options: nosniff X-XSS-Protection: 1 Connection: close Content-Length: 1594 Cache-control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: application/vnd.citrix.authenticateresponse-1+xml; charset=utf-8 X-Citrix-Application: Receiver for Web <?xml version="1.0" encoding="UTF-8" standalone="yes"?><AuthenticateResponse xmlns="http://citrix.com/authentication/response/1"><Status>success</Status><Result>more-info</Result><StateContext>bG9naW5zY2hlbWE9ZGVmYXVsdA==</StateContext><AuthenticationRequirements><PostBack>/p/u/doAuthentication.do</PostBack><CancelPostBack>/p/u/doLogoff.do</CancelPostBack><CancelButtonText>Cancel</CancelButtonText><Requirements><Require
2022-04-01 15:32:10 UTC	1325	IN	Data Raw: 6d 65 6e 74 3e 3c 43 72 65 64 65 6e 74 69 61 6c 3e 3c 54 79 70 65 3e 6e 6f 6e 65 3c 2f 54 79 70 65 3e 3c 2f 43 72 65 64 65 6e 74 69 61 6c 3e 3c 4c 61 62 65 6c 3e 3c 54 79 70 65 3e 6e 73 67 2d 6c 6f 67 69 6e 2d 68 65 61 64 69 6e 67 3c 2f 54 79 70 65 3e 3c 54 65 78 74 3e 6e 73 67 5f 6c 6f 67 69 6e 48 65 61 64 69 6e 67 3c 2f 54 65 78 74 3e 3c 2f 4c 61 62 65 6c 3e 3c 2f 52 65 71 75 69 72 65 6d 65 6e 74 3e 3c 52 65 71 75 69 72 65 6d 65 6e 74 3e 3c 43 72 65 64 65 6e 74 69 61 6c 3e 3c 49 44 3e 6c 6f 67 69 6e 3c 2f 49 44 3e 3c 53 61 76 65 49 44 3e 6c 6f 67 69 6e 3c 2f 53 61 76 65 49 44 3e 3c 54 79 70 65 3e 75 73 65 72 6e 61 6d 65 3c 2f 54 79 70 65 3e 3c 2f 43 72 65 64 65 6e 74 69 61 6c 3e 3c 4c 61 62 65 6c 3e 3c 54 65 78 74 3e 6e 73 67 5f 75 73 65 72 6e 61 6d 65 Data Ascii: ment><Credential><Type>none</Type></Credential><Label><Type>nsg-login-heading</Type><Text>nsg_loginHeading</Text></Label></Requirement><Requirement><Credential><ID>login</ID><SaveID>login</SaveID><Type>username</Type></Credential><Label><Text>nsg_username

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49818	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:15 UTC	1377	OUT	GET /logon/LogonPoint/receiver/images/common/wspinner@2x.gif HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:16 UTC	1378	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:04 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "8af-5c74025d36a80" Accept-Ranges: bytes Content-Length: 2223 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/gif Connection: close
2022-04-01 15:32:16 UTC	1378	IN	Data Raw: 47 49 46 38 39 61 2d 00 2c 00 f5 00 00 64 5a 64 bc ba bc 84 82 84 dc de dc 9c 96 9c 74 72 7c 6c 66 6c d4 d6 d4 94 8e 94 cc c6 cc 94 8a 94 f4 f6 f4 a4 9e a4 8c 82 8c 7c 7a 84 74 6a 74 64 5e 64 c4 be c4 9c 9a 9c 7c 72 7c 6c 6a 74 fc fe fc 84 82 8c ec ee ec 6c 66 74 dc da dc 94 92 9c cc ca cc fc fa fc a4 a2 ac 8c 86 8c 64 5e 6c 9c 9a a4 7c 76 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 01 0d 00 22 00 2c 00 00 00 00 2d 00 2c 00 00 06 ff 40 91 70 48 2c 7e 0a 02 05 01 24 Data Ascii: GIF89a-,dZdtr\|lfl\|ztjtd^d\|r\|ljtlftd^l\|v\|!NETSCAPE2.0!",-,@pH,~$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49773	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:02 UTC	6	OUT	GET /logon/LogonPoint/index.html HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:02 UTC	7	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:50 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 15:49:01 GMT ETag: "a696-5c73f86bdb540" Accept-Ranges: bytes Content-Length: 42646 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, must-revalidate Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: no-cache
2022-04-01 15:32:02 UTC	7	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 5f 6d 61 6e 69 66 65 73 74 3d 22 72 65 63 65 69 76 65 72 2e 61 70 70 63 61 63 68 65 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 20 63 6c 61 73 73 3d 22 5f 63 74 78 73 74 78 74 5f 4e 65 74 73 63 61 6c 65 72 47 61 74 65 77 61 79 22 3e 43 69 74 72 69 78 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 49 43 4f 4e 22 20 68 72 65 66 3d 22 72 65 63 65 69 76 65 72 2f 69 6d Data Ascii: <!DOCTYPE html><html _manifest="receiver.appcache"><head> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta charset="utf-8" /> <title class="_ctxstxt_NetscalerGateway">Citrix Gateway</title> <link rel="ICON" href="receiver/im
2022-04-01 15:32:02 UTC	15	IN	Data Raw: 6f 6e 20 76 69 65 77 2d 73 70 72 69 74 65 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 61 62 6c 65 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 74 6f 6f 6c 62 61 72 2d 74 61 62 6c 65 20 70 68 6f 6e 65 2d 6f 6e 6c 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 64 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 63 6f 6e 74 61 69 6e 65 72 20 70 68 6f 6e 65 2d 6f 6e 6c 79 20 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 72 75 6c 65 72 2d 63 6f 6e Data Ascii: on view-sprite"></div> </a> <table class="search-toolbar-table phone-only"> <tr> <td class="search-container phone-only "> <div class="search-ruler-con
2022-04-01 15:32:02 UTC	22	IN	Data Raw: 20 3c 61 20 68 72 65 66 3d 22 23 22 20 63 6c 61 73 73 3d 22 61 6c 6c 2d 61 70 70 2d 72 65 73 75 6c 74 73 20 74 68 65 6d 65 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 20 5f 63 74 78 73 74 78 74 5f 54 72 79 53 65 61 72 63 68 69 6e 67 49 6e 41 70 70 73 22 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 2d 66 61 76 2d 72 65 73 75 6c 74 73 2d 6d 65 73 73 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 2d 66 61 76 2d 72 65 73 75 6c 74 73 2d 6d 65 73 73 61 67 65 2d 69 6d 61 67 65 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <a href="#" class="all-app-results theme-highlight-color _ctxstxt_TrySearchingInApps"></a> </div> <div class="no-fav-results-message"> <div class="no-fav-results-message-image"></div>
2022-04-01 15:32:02 UTC	30	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 73 70 69 6e 6e 65 72 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 2d 73 70 69 6e 6e 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 62 61 63 6b 2d 74 6f 2d 63 68 6f 69 63 65 73 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 63 6c 61 73 73 3d 22 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 2d 6c 69 6e 6b 20 5f 63 74 78 73 74 78 74 5f 55 73 65 41 6e 6f 74 68 65 72 4c 6f 67 6f 6e 4f 70 74 69 6f 6e 22 3e 3c 2f 61 3e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 Data Ascii: div class="spinner authentication-spinner"></div> </div> <p class="back-to-choices"><a href="#" class="authentication-link _ctxstxt_UseAnotherLogonOption"></a></p> </div>
2022-04-01 15:32:02 UTC	38	IN	Data Raw: 75 67 69 6e 2d 61 73 73 69 73 74 61 6e 63 65 2d 64 6f 77 6e 6c 6f 61 64 2d 75 6e 61 76 61 69 6c 61 62 6c 65 22 20 63 6c 61 73 73 3d 22 66 75 6c 6c 73 63 72 65 65 6e 2d 70 61 6e 65 20 73 63 72 6f 6c 6c 61 62 6c 65 20 77 65 62 2d 73 63 72 65 65 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 76 65 72 74 69 63 61 6c 2d 63 65 6e 74 65 72 2d 6f 75 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 76 65 72 74 69 63 61 6c 2d 63 65 6e 74 65 72 2d 69 6e 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 70 6c 75 67 69 6e 2d 64 6f 77 6e 6c 6f 61 64 2d 75 6e 61 76 61 69 6c 61 62 6c 65 22 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 61 72 65 61 22 3e 0a 20 20 Data Ascii: ugin-assistance-download-unavailable" class="fullscreen-pane scrollable web-screen"> <div class="vertical-center-outer"> <div class="vertical-center-inner"> <div id="plugin-download-unavailable" class="content-area">
2022-04-01 15:32:02 UTC	45	IN	Data Raw: 6f 77 6e 6c 6f 61 64 2d 75 73 65 2d 6c 69 67 68 74 2d 76 65 72 73 69 6f 6e 20 77 65 62 2d 73 63 72 65 65 6e 2d 6c 69 6e 6b 20 5f 63 74 78 73 74 78 74 5f 55 73 65 4c 69 67 68 74 56 65 72 73 69 6f 6e 22 20 68 72 65 66 3d 22 23 22 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 70 72 6f 74 6f 63 6f 6c 68 61 6e 64 6c 65 72 2d 76 61 6c 69 64 61 74 65 22 Data Ascii: ownload-use-light-version web-screen-link _ctxstxt_UseLightVersion" href="#"></a> </div> </div> </div> </div> </div> </section> <section id="protocolhandler-validate"

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49819	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:16 UTC	1377	OUT	GET /logon/LogonPoint/receiver/images/1x/folder_template.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:16 UTC	1380	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:04 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "1b0-5c74025d36a80" Accept-Ranges: bytes Content-Length: 432 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:16 UTC	1381	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 06 00 00 00 3a fc d9 72 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 01 52 49 44 41 54 78 da ec db b1 4a c3 40 00 87 f1 3b 53 c5 08 8a 10 aa 9b 28 5d 74 74 72 d0 37 70 70 15 71 f0 01 74 f6 01 1c 2b 74 2a 3e 81 a3 88 38 08 e2 28 fa 00 2e 82 08 59 1c 44 b3 b8 9a 10 bf 83 0c 5d 85 34 3d 72 ff 83 6f 6c 8e 1f 97 5e ae d0 d8 34 4d 4d 48 63 ca 04 36 46 c1 33 74 4c cf f4 43 e5 3f 73 9f 79 a5 4b da 23 eb 23 d8 56 b7 f4 32 dd d1 66 8d d7 7e a4 7d fa f0 6d 85 3b 74 55 33 d6 8d 1d 7a a2 9e 6f e0 03 da 1e d3 f5 57 e8 81 ba 3e 81 0f c7 3c c7 2a dd d2 9c 2f e0 ad 06 e6 71 73 dc d3 9a 0f e0 85 86 e6 72 5f 9b 37 ba a6 23 da a0 Data Ascii: PNGIHDR<<:rtEXtSoftwareAdobe ImageReadyqe<RIDATxJ@;S(]ttr7ppqt+t>8(.YD]4=rol^4MMHc6F3tLC?syK##V2f~}m;tU3zoW></qsr_7#

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49811	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:16 UTC	1377	OUT	GET /logon/LogonPoint/receiver/images/common/authspinner.gif HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:16 UTC	1381	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:04 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "3ba-5c74025d36a80" Accept-Ranges: bytes Content-Length: 954 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/gif Connection: close
2022-04-01 15:32:16 UTC	1382	IN	Data Raw: 47 49 46 38 39 61 16 00 16 00 f4 00 00 44 3a 44 ac aa ac 7c 72 7c 5c 52 5c dc d6 dc 8c 8a 94 54 46 54 84 7e 84 f4 f2 f4 4c 42 4c d4 ce d4 64 5e 6c 54 4e 54 4c 3e 4c 7c 76 7c e4 e6 e4 9c 96 9c 8c 86 8c fc fa fc ac aa b4 64 5a 64 54 4a 54 8c 82 8c d4 d2 d4 6c 66 74 5c 4e 5c 7c 76 84 ec e6 ec a4 9a a4 fc fe fc a4 9e a4 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 01 0d 00 1e 00 2c 00 00 00 00 16 00 16 00 00 05 be a0 27 8e cd e2 58 03 87 28 10 33 be 24 16 cd 51 06 75 b8 34 19 b0 68 1c 33 0d c5 00 48 2c 0a 17 dc 83 02 fb 15 2c 99 9e 48 b0 e9 20 98 a2 c6 a1 e0 68 48 47 15 42 e7 c1 f3 c8 2c de 2f b8 3a f1 34 66 51 f5 4b d0 91 64 8e 0e 79 2f 09 71 44 b0 7a 23 05 1d 0a 16 11 65 81 22 0b 56 03 19 00 89 23 09 13 01 0c 15 8f 90 1e 00 19 Data Ascii: GIF89aD:D\|r\|\R\TFT~LBLd^lTNTL>L\|v\|dZdTJTlft\N\\|v!NETSCAPE2.0!,'X(3$Qu4h3H,,H hHGB,/:4fQKdy/qDz#e"V#

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49821	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:16 UTC	1383	OUT	GET /vpn/media/citrixgateway_logo_black.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:17 UTC	1383	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:05 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 24 Sep 2021 02:02:40 GMT ETag: "878-5ccb4245ff000" Accept-Ranges: bytes Content-Length: 2168 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: no-cache Content-Type: image/png Connection: close
2022-04-01 15:32:17 UTC	1383	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 84 00 00 00 15 08 06 00 00 00 87 7e 46 41 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 28 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 Data Ascii: PNGIHDR~FAtEXtSoftwareAdobe ImageReadyqe<(iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49820	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:16 UTC	1383	OUT	GET /vpn/media/citrixgateway_logo_white.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:17 UTC	1385	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:05 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 24 Sep 2021 02:02:40 GMT ETag: "8fc-5ccb4245ff000" Accept-Ranges: bytes Content-Length: 2300 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: no-cache Content-Type: image/png Connection: close
2022-04-01 15:32:17 UTC	1386	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 a0 00 00 00 19 08 06 00 00 00 b6 0a 25 90 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 28 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 30 20 37 39 2e 31 36 30 34 35 31 2c 20 32 30 31 37 2f 30 35 2f 30 36 2d 30 31 3a 30 38 3a 32 31 20 20 Data Ascii: PNGIHDR%tEXtSoftwareAdobe ImageReadyqe<(iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49824	172.217.168.33	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:17 UTC	1388	OUT	GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:17 UTC	1389	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdt8IQ4uLhp1sdtAD0vy_jn2-CA8PZ41bP4EVVMccexEaiDoRZjI0gcc4uMp8x-UG4OmvP3f8jGtZ3HKDgMYpd9mK2kmuA Content-Disposition: attachment; filename="extension_8520_615_0_5.crx" Cross-Origin-Resource-Policy: same-site Accept-Ranges: bytes X-Goog-Hash: crc32c=DxAZGA== Content-Length: 768843 Server: UploadServer Date: Thu, 31 Mar 2022 21:05:58 GMT Expires: Fri, 31 Mar 2023 21:05:58 GMT Cache-Control: public, max-age=31536000 Age: 66379 Last-Modified: Wed, 05 Aug 2020 01:15:29 GMT ETag: 730d2491_a246e948_e80d9c94_d8b3f142_86eb8dd2 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-04-01 15:32:17 UTC	1389	IN	Data Raw: 43 72 32 34 03 00 00 00 18 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2022-04-01 15:32:17 UTC	1390	IN	Data Raw: 40 3b f4 9e 6a bc a6 ca cb a3 80 eb 8b 1c a8 07 a9 3d 61 65 c8 c2 d3 30 c2 ff f6 cc 90 8b f9 14 44 55 b1 1f a8 1a 6e 1c 91 f5 6e 12 3b ff 49 70 72 cc a2 1f 51 db 15 1c 81 3a 10 b6 e5 20 3c e2 ad 87 0f d5 1e 80 61 09 59 dc 93 f3 83 96 97 87 7b 65 69 9e cd 12 a8 02 0a a2 01 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 cd 4d 62 68 3d 9f 5b 4f 7d b2 2b 1b ae 55 af 4b 48 46 28 6e 33 e8 5c 22 d7 dd d8 2c 67 d7 63 0e b5 8a 36 29 13 10 28 dd 45 ed ff 00 55 db fa ff 23 92 69 ad 61 03 e7 3a 04 98 9f 4e 89 fd 0a 1d 0e 50 88 1b a9 78 ef 4f a0 90 ea 28 6d 43 3b 7c eb 35 01 53 ac 7b 6d ea 61 45 78 8d bb 91 5b 7f 98 66 50 af 69 60 85 79 cc c2 35 b1 88 52 02 84 8b 90 76 7f 24 1a cf 2e b4 00 bd 6c 2d 6d ee b5 02 03 01 00 01 12 80 Data Ascii: @;j=ae0DUnn;IprQ: <aY{ei00*H0Mbh=[O}+UKHF(n3\",gc6)(EU#ia:NPxO(mC;\|5S{maEx[fPi`y5Rv$.l-m
2022-04-01 15:32:17 UTC	1391	IN	Data Raw: f6 ad c7 4a cb 2f 1f 77 0d f5 97 97 c5 5f 2f ee 4b 21 c4 5f 5e de 7e 29 ae 9a 3f 8a c1 c7 9b f2 f2 e7 8b 83 8f 77 77 5f 6e 7f 7a f9 f2 f6 fe cb 97 eb 9b bb 17 1f 6a 3b be 58 5f ff fa 72 bd d5 ec cb e2 ea f6 df e5 cd 4b 08 bb 2a 89 5f 1c 0c ee 8a 9b 0f e5 1d 8c 5f ae 3e 17 57 ff bc 38 68 04 57 0f 19 ac 3f 17 b7 b7 70 f1 a6 fc d7 fd a7 9b 72 f3 3c ce 08 06 5e 7d 78 7e fb f1 fa df 70 f1 7f ee ae bf bc b8 bd bf bc fc b4 fe 04 8b 3b 2e cb cd aa 58 57 a2 6a 15 40 46 b0 99 55 06 9e 99 69 25 32 27 d9 60 40 0f c3 54 2a 57 e8 61 24 24 d0 59 30 1d a0 d3 c5 2c ef b6 1e 00 31 f7 64 d3 b3 96 91 0f 99 4e 45 d3 31 4b 63 4d 47 0d f6 3b ea d5 06 08 c9 60 85 f7 ca 04 25 25 9f d1 eb e0 30 31 ee e2 c8 60 5c 26 20 9b 40 82 ca bc 08 da b0 e5 57 6c c7 37 d9 13 d3 66 94 a2 02 c8 Data Ascii: J/w_/K!_^~)?ww_nzj;X_rK__>W8hW?pr<^}x~p;.XWj@FUi%2'`@TWa$$Y0,1dNE1KcMG;`%%01`\& @Wl7f
2022-04-01 15:32:17 UTC	1393	IN	Data Raw: 5d 60 c4 24 86 5a 22 50 76 a3 9d 09 c2 58 61 80 31 5b de 09 1f d7 40 b6 42 55 3d 6c 6f 80 83 85 4c 08 e3 be 83 df 3c 6c 95 58 00 2b 52 42 5c b4 a3 e9 e8 90 f5 00 4c fc b4 1c 95 ad 07 ab 8d 6f 6f 8d 54 81 3a aa a3 88 45 b7 9f db fc b8 cd 34 1c a4 2f c8 d3 56 ad 05 64 e8 c5 c2 1d 97 6b ff e8 92 ca 4d fa c0 82 a0 9b cd 2a c5 b6 b8 32 0a bc d8 f0 a7 fd f9 1d 53 75 85 47 b6 62 5b 97 15 31 5f ec 34 e8 4b 82 df 3b dd f5 26 a3 7f 47 af 7c 4f 33 bc 69 98 32 ae b8 bf d7 fd c4 f6 f6 dd cd f5 fd ea 73 79 fb f1 fa fa 0e db dc 56 69 d7 74 4c 2d f0 51 c0 2e ca 67 19 00 85 20 ac 64 d1 02 96 dd 08 6b 75 1c 99 59 5b 6d c2 d8 10 64 d5 21 60 db 48 3b c1 17 9b 72 85 d9 7a 55 d3 94 b3 da 5b 88 6f ed 83 75 3a 28 eb d8 8e 03 44 7d 1d 23 9d 94 a5 77 f7 49 08 6d 8c f6 c4 ac 17 7b Data Ascii: ]`$Z"PvXa1[@BU=loL<lX+RB\LooT:E4/VdkM*2SuGb[1_4K;&G\|O3i2syVitL-Q.g dkuY[md!`H;rzU[ou:(D}#wIm{
2022-04-01 15:32:17 UTC	1394	IN	Data Raw: 12 a8 5f c5 66 cd c3 99 c5 91 4d 0d 49 77 54 3b 27 68 d1 9c 97 d4 bf 7b 33 52 9b 72 ba 09 24 e6 1f 9c a8 95 56 1a 6f 24 00 7c 40 f9 19 f8 30 37 d3 e6 d4 62 1c 03 d3 94 36 68 11 94 87 e9 3b b5 67 77 22 7d 31 81 0d 1f 30 71 80 3c ec a4 b4 42 54 d1 c3 35 69 38 22 ec 33 e1 aa 6d 2e 51 6d bb 18 e0 59 66 cf 0b 0c 0f 70 d9 d8 d4 a2 fb 54 a1 a3 e3 76 9c 26 87 3b e2 9e 47 db bf 69 0a 4c a8 7a 35 e0 b4 32 78 98 5f f0 c0 fe bf 7b 6e 0d 7a 41 c1 15 1a 87 ac ed aa c2 65 ab 73 76 7b 28 59 ef 09 08 94 0f 15 ea ed f9 b8 9e b5 26 fe 56 14 e4 a7 82 b2 0f 86 9d 94 7e 3c 9c a1 0a eb 03 a7 f1 38 22 a2 f5 35 e6 21 34 3d a9 cb cd 69 05 ec 3e 56 a7 a1 33 e1 bd f6 0a a2 05 c2 86 ed a8 fd 8e 3b 8d 4f df ce 8d 00 86 c8 e0 4e 48 3d 79 a7 f6 2c 3f 1a 0d 97 d3 c9 62 9e 4f 97 c3 a3 a3 Data Ascii: _fMIwT;'h{3Rr$Vo$\|@07b6h;gw"}10q<BT5i8"3m.QmYfpTv&;GiLz52x_{nzAesv{(Y&V~<8"5!4=i>V3;ONH=y,?bO
2022-04-01 15:32:17 UTC	1395	IN	Data Raw: 00 00 00 00 00 19 00 00 00 5f 6c 6f 63 61 6c 65 73 2f 61 72 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e e5 5c 6d 6f 1b 37 12 fe 2b 3a 5f 3e b4 45 63 f3 75 49 06 ed 01 8a b5 76 b6 b1 25 57 2f 0e 52 04 10 64 5b 4e 82 4b e2 9c ed a0 38 04 fe ef 37 bb e4 7a 87 e2 50 92 d3 24 77 c0 7d 91 e5 5d 71 c8 19 ce cb 33 33 dc fd bc c3 19 b7 ce 2a 5d 70 65 ad 16 4c 73 b3 f3 a4 f7 79 e7 fd f2 e6 66 f1 7a 09 df 77 5e 7d 62 85 5a d4 9f a2 f9 54 b6 f9 14 cd 27 df b9 fb b9 b7 c3 05 97 4e 1b 67 85 11 d2 1a ed 04 a3 a8 08 e9 69 f5 9a 3f ba f9 2c 9a 7f 84 69 fe 51 f5 a7 74 cd 15 db 5d 97 bc fb 2e 16 c9 00 bf 2c 7c 25 2c d7 f5 d0 aa 9b e9 c4 99 ff 51 0f 2d a7 21 2e 0b 74 c3 73 28 fd 02 79 0f 2d 4d 75 4b 53 12 11 6f be f3 cb 20 0c 10 43 61 0d f0 c6 24 77 cc 68 52 16 66 95 48 20 6e Data Ascii: _locales/ar/messages.json\mo7+:_>EcuIv%W/Rd[NK87zP$w}]q33*]peLsyfzw^}bZT'Ngi?,iQt].,\|%,Q-!.ts(y-MuKSo Ca$whRfH n
2022-04-01 15:32:17 UTC	1396	IN	Data Raw: ff 9a df 22 eb 45 29 6c bb 84 d4 3c 08 43 4d 27 72 ab 13 45 df b3 50 27 c7 2a a6 1d 34 06 e5 5b 82 48 b7 65 32 69 9a bf 05 ae 83 51 65 5c 62 f0 98 18 b3 0b 1c 53 71 96 ab d2 75 e0 4c 79 d9 c9 2c 84 df 50 94 40 08 8f 72 ec d9 34 b3 d7 2d 6a 1b dc d8 d2 c6 ba 8f 93 c9 a8 d0 11 b9 41 db 5d 27 d8 c3 46 11 a9 55 58 73 d1 8d 0e 1a e3 af 04 c9 62 08 91 86 3b b3 8b a4 4d 19 09 2e 0a e0 e5 a0 bd cf 2b f3 36 90 3c d5 7e 62 27 09 c5 c1 5c c8 54 99 d3 01 48 ef 23 03 72 71 56 89 38 c5 ce 33 48 36 17 d9 fd 62 43 86 be 9b 6a 30 21 d9 8b d5 5d 8f cb 54 5f a8 33 04 b2 4b ab 5f d8 13 04 7a c8 0e d9 79 0f dd 46 e2 6c 8d 5c d2 34 02 7b 58 ef 24 ae ac 98 8e ed 98 49 8b 2c 4d a2 a0 11 76 34 06 6e 78 9b 22 21 a0 a2 10 2e 75 44 a9 9d 88 a1 ec ea fe 46 da 9e 75 a6 58 b6 b8 34 18 Data Ascii: "E)l<CM'rEP'*4[He2iQe\bSquLy,P@r4-jA]'FUXsb;M.+6<~b'\TH#rqV83H6bCj0!]T_3K_zyFl\4{X$I,Mv4nx"!.uDFuX4
2022-04-01 15:32:17 UTC	1398	IN	Data Raw: 82 df 23 92 4a 4f b2 e0 0a a2 8f 83 8c 5d 58 2d 19 a1 23 cd f6 10 a1 12 ef 0f 4e 6d 70 fe 43 a4 1d 51 0e ec d7 e0 20 90 1b 29 1d 40 40 b0 3c eb 18 a1 60 94 b5 b5 81 2a ac ea 31 46 1f 1a ff c3 13 c7 15 e9 1e 0e 32 d1 6d ec 5e 90 fe 46 99 1c 01 83 f8 aa 61 62 bd e6 67 38 d7 14 c8 c1 e1 56 52 d4 fb 23 8e 4e 6f 88 8b a8 8b 8b 9b a4 a1 14 8f f1 40 a4 13 6d 62 7c 8f 0a 70 79 f5 21 ed 4d a2 9a 86 ca 60 51 0e 16 dc db 86 ea 57 54 b2 33 dd ed 10 05 d3 fe 54 da 2c 0c e2 f5 2c 49 24 77 e2 9c 6a 38 01 17 1d 38 21 4a 0b 7f a9 3f b3 9d 3c 83 2b 77 ce 14 4c f0 ba 3e 0e 88 51 01 50 c8 5b 7e 1b 71 12 44 1b f3 de 7c c7 67 46 0c 07 7f 06 41 83 01 0c 07 67 c0 c0 db ac c1 36 1b dc fd 12 09 10 87 e1 a8 b0 93 ed f2 e1 5c e7 2c 16 3c 2a da ec b6 cb b6 45 5d 73 ac d3 5d ae 18 7d Data Ascii: #JO]X-#NmpCQ )@@<`1F2m^Fabg8VR#No@mb\|py!M`QWT3T,,I$wj88!J?<+wL>QP[~qD\|gFAg6\,<E]s]}
2022-04-01 15:32:17 UTC	1399	IN	Data Raw: 3c 1e 37 ad 8e 4b 58 70 62 78 44 7b bc 1d 78 dc 44 b3 61 b9 3f 0d ab 4e e4 43 bc 83 05 0d be f7 90 3e 2e f7 f7 f7 cb 93 69 ff e9 51 62 3b d4 f1 85 3c 9d c3 d1 28 59 09 95 5a e5 29 9c 94 e3 03 e0 2a 61 87 78 5f ca 1a 22 a3 51 12 c1 88 34 3c 4f 60 36 ac 00 2a 1c 1d 55 87 15 21 13 ea c0 32 45 6b 50 4d f6 fb e3 41 bd 53 07 d5 f8 b8 4f 99 22 f5 44 06 45 eb a0 1a 96 8d 7b 99 83 65 0f 89 e0 43 f5 44 29 42 0d 8d 4c 90 27 aa 7c 14 89 61 3f 85 5f e9 cb 1e a8 91 a3 e7 a9 8b 4f 1f 5e a6 46 8e cb da c1 12 7c 53 87 bc 29 02 99 e1 d4 43 ef b9 e1 8d a9 25 be 94 c8 29 b2 04 a8 f8 40 9d 7b ca 12 98 cc c0 52 53 6f 48 65 e5 14 8d 06 0f 3d 9d 1d ce 47 e3 79 59 03 9b 54 1d d3 07 6b b2 84 6a fd 1e 9d 96 29 10 26 de 73 95 25 72 50 f6 a7 33 88 55 35 e0 2b 09 af 9b 1e 5d cf 92 82 Data Ascii: <7KXpbxD{xDa?NC>.iQb;<(YZ)ax_"Q4<O`6U!2EkPMASO"DE{eCD)BL'\|a?_O^F\|S)C%)@{RSoHe=GyYTkj)&s%rP3U5+]
2022-04-01 15:32:17 UTC	1400	IN	Data Raw: 3f ff 7c f3 af c5 f5 be 0a 75 34 7d bb d3 b9 9d 5f bf 5f dc c2 fa d9 f9 a7 f9 e7 7f bc dd 69 09 57 37 e9 5c 7c 9a df dc c0 97 d7 8b 7f 7e fd 78 bd 78 f7 2c 72 04 0b 3f bf 7f 76 f3 e1 ea 5f f0 e5 ff dc 5e 7d d9 bb f9 7a 79 f9 f1 e2 23 6c ee 70 b1 78 77 3e bf a8 48 d5 22 00 27 67 0b ab 0c dc b3 d0 4a 14 4e f2 a6 87 23 d5 e5 bd b7 4b 4c 2f 89 a7 f4 5b ec 8e 1b 42 17 cb 7a 84 3d 53 ab 7d cf b7 d6 18 f6 40 e5 ba 13 57 f1 c4 19 89 b0 27 8e cf f9 11 8f c3 06 a9 45 b0 c2 7b 65 82 92 92 0f 89 24 74 47 4f 58 44 2a c1 b8 42 80 e7 03 8f 5a 78 11 b4 61 a9 24 91 27 fe b7 89 e5 7b 74 7a 8d bf 55 2a c0 fd 44 80 58 6e 9d 52 70 47 02 d8 be 9d 82 e8 fb 07 7d 90 fd 64 bc fb e5 d3 d7 eb f9 a7 dd ab cb cb 9b c5 ed 73 d9 f9 55 7c ab 1d b2 c0 9b a9 3f 35 8d 40 0d 8b 77 bf ca ad Data Ascii: ?\|u4}__iW7\\|~xx,r?v_^}zy#lpxw>H"'gJN#KL/[Bz=S}@W'E{e$tGOXDBZxa$'{tzUDXnRpG}dsU\|?5@w
2022-04-01 15:32:17 UTC	1401	IN	Data Raw: 78 f1 d9 e7 05 48 09 e2 80 80 31 11 d6 93 f5 22 a5 7e 86 86 7d 26 e5 48 83 dc 8f 3d 9d 00 8a 5b 68 13 82 f0 ca 5a 25 f9 3a e0 3b c2 36 16 16 8e 6d f8 5b 1c ff 9b d2 9d 29 aa 52 38 a8 81 85 0f 5d 08 50 8b 15 da b0 a6 98 b9 89 b9 6c 03 60 1e c7 c0 30 eb 24 be 19 7a db b4 8a 9b 9c 54 f6 e4 db 32 ae 01 c7 13 0a 88 75 ce 14 c1 6a e3 79 db 5a 13 33 68 68 d8 2c ef a9 59 b0 42 02 5e 33 41 18 2b 8c 28 b4 5d 69 df ab 87 12 44 a4 a8 aa 41 09 0f d7 b9 50 08 61 1c 1b 09 55 ae bd 7e b1 c9 91 33 08 23 7e 91 64 e4 c9 a9 60 a8 96 cf 50 1b c2 4c e8 79 18 c6 6c 31 6b 1c 13 a8 ca 88 51 d1 92 03 a3 29 15 aa 26 af c9 77 b8 d2 1d c6 6a 99 82 5b ac d6 3c 14 16 6f 5b 26 e0 b2 b2 ad 23 e9 2e cd 35 18 8f 8d 33 a7 d4 3f 27 5a b3 3c 0e 22 a9 66 e0 ae 21 ed 58 19 a2 c2 26 f1 18 f7 f3 Data Ascii: xH1"~}&H=[hZ%:;6m[)R8]Pl`0$zT2ujyZ3hh,YB^3A+(]iDAPaU~3#~d`PLyl1kQ)&wj[<o[&#.53?'Z<"f!X&
2022-04-01 15:32:17 UTC	1403	IN	Data Raw: ee 5a 6e 2d f3 dd d3 28 ae c2 15 ca 28 07 19 8e 85 fb 49 c9 76 7e d5 7f 1a 12 b7 0a 74 f0 fd 49 ee c7 7b 62 bc 16 44 15 77 ab 2e b8 04 89 28 a5 bd 55 7c 4d 0e 17 85 68 be b5 99 1b cf 3e 63 4f 93 74 66 e8 23 b2 eb ab c2 a1 06 36 ab fe 98 08 7e 6d b9 fe 01 8f 12 ae 7e 19 80 87 e4 3c 84 e0 ea 52 26 90 97 2b 81 14 e9 2b b5 36 83 6f db d0 d5 75 d2 eb bd 97 da 89 c2 0a b3 a2 01 b4 45 86 98 cc c5 33 7e 69 0b 59 61 f5 61 e4 b6 fd 33 33 3f b7 ae c2 48 f8 e7 15 56 3c 78 90 0a 7c 7b ed 9c 0e c1 04 be aa 90 ab 4a 78 63 4d 30 85 91 c2 d7 85 52 f3 03 fc 7b 02 86 c9 b5 e9 5c 64 0b 89 97 55 08 3f 98 a2 cf 63 1c 14 e4 85 14 5b 14 73 9b 20 d1 08 c1 4a 2b 8d 07 68 a2 b5 f6 45 01 66 b8 e2 69 58 32 a2 d2 8a d2 6a e1 a5 0d 5a 04 e5 95 86 20 b0 aa 01 fe 50 27 f2 b0 97 d2 78 d0 Data Ascii: Zn-((Iv~tI{bDw.(U\|Mh>cOtf#6~m~<R&++6ouE3~iYaa33?HV<x\|{JxcM0R{\dU?c[s J+hEfiX2jZ P'x
2022-04-01 15:32:17 UTC	1404	IN	Data Raw: bc e4 94 8c 1b 43 e4 08 bd 19 4e 21 43 1f 8c 5f 33 e6 c3 bc a0 10 91 78 d9 1d 1c 01 74 99 f5 07 5d 30 9b 33 c2 01 d7 34 67 97 9f 81 b5 51 e8 c4 3c b3 ce ac 8e 19 00 4d 15 e9 2c 36 b3 7a d2 9f 1c 97 33 62 18 cc 1b 62 d1 e2 26 2d 84 94 25 02 86 83 ee 69 e5 c5 c8 0e 98 e7 a0 be 53 01 88 4a c4 c5 4c 33 b4 d7 9f 76 a7 63 b2 80 7b 05 e3 f7 05 c7 5d ea be 98 d7 69 b6 d7 8f cb 92 84 67 ae 84 df 5e 3f 1d 70 5b e0 9a b0 ed 8a b3 e1 f1 f4 84 ac e0 5e 7e 7e 77 f7 6f 50 4b 07 08 62 6e ee ba 6a 12 00 00 a8 61 00 00 50 4b 03 04 14 00 08 08 08 00 2a 8c 04 51 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 5f 6c 6f 63 61 6c 65 73 2f 62 6e 2f 03 00 50 4b 07 08 00 00 00 00 02 00 00 00 00 00 00 00 50 4b 03 04 14 00 08 08 08 00 29 8c 04 51 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: CN!C_3xt]034gQ<M,6z3bb&-%iSJL3vc{]ig^?p[^~~woPKbnjaPK*Q_locales/bn/PKPK)Q
2022-04-01 15:32:17 UTC	1405	IN	Data Raw: e7 e2 50 12 43 62 8a 7c 0a 64 7f 9d d4 01 01 60 8a ab d7 68 33 3e 1e c9 43 14 2b 44 a1 75 01 27 52 5a 6b c5 46 41 81 3f 92 97 89 8a 14 46 42 38 5c 04 08 42 65 01 d1 14 cb 18 e4 ca 23 24 af 64 56 64 0d 61 0d f0 e3 9d 53 ce 1b 29 b4 00 f2 2c 61 06 7d 4c 86 67 c8 bd e0 48 35 c5 8c 38 d8 a8 04 e6 56 43 62 89 e2 5c 2e 16 79 f2 e4 49 da b6 86 bb 02 5c 5a d8 b6 04 ad 31 6c 6c b9 27 63 4b e1 9b 41 ac 8f a7 8a 89 08 88 ca 15 00 96 f0 37 00 7f 42 86 e9 49 87 b0 c7 dc 90 83 a5 ef 23 5d 03 5e 43 49 10 a9 0d 3a d4 26 c3 aa 44 27 65 c2 ac 5a a3 a8 2e 31 3a 09 d3 1a 25 0c 6c 17 52 28 a1 35 f0 87 17 66 e2 44 5a e3 20 75 86 68 09 8e ea 40 b1 00 20 d8 35 9d a8 01 a1 4a 2b 99 86 98 11 10 88 07 48 94 0a 50 2b c8 95 1c af ec be 93 df 27 14 f8 af 86 9a e0 25 df de f8 c7 67 ed Data Ascii: PCb\|d`h3>C+Du'RZkFA?FB8\Be#$dVdaS),a}LgH58VCb\.yI\Z1ll'cKA7BI#]^CI:&D'eZ.1:%lR(5fDZ uh@ 5J+HP+'%g
2022-04-01 15:32:17 UTC	1407	IN	Data Raw: 10 41 21 8c 64 fb cf 07 26 6e 08 05 99 36 f9 83 39 f0 80 33 40 24 b4 3b 66 b1 d2 61 e1 b8 c1 6b f8 17 e2 47 29 02 7f d6 4e 5d 68 cf c0 26 45 a5 3d ed 2b ec 6d 3b 33 98 87 e0 2f 97 43 61 d8 ec 44 28 68 e3 06 69 12 e6 67 0a f2 ac 71 56 68 e3 00 08 44 3d f8 65 dc b7 64 ef 6d 1d 05 7d 55 e5 d8 d0 f9 fe e9 7c 72 76 df d3 e3 26 27 ee 50 6d 45 ed ad 53 42 42 2c a9 02 c4 45 2e f0 a3 ce 58 bc 34 c9 3f a8 3f 95 6f d0 c7 0e 2d 53 be a5 ad 20 54 a0 6d 65 f6 63 3c 88 0b a0 aa 3a 14 a0 bb 5e 58 01 d9 e2 43 a2 24 60 da c9 79 bc 51 01 59 15 d8 46 5d bb 01 15 50 c1 f2 23 9d c8 41 87 4b ac d9 f4 fb de f6 3f ed 6c 06 52 17 e4 e1 52 85 c4 86 ba c1 6f 25 58 29 64 77 5a 83 b1 de 3f d9 48 43 62 0d e0 2b e0 1a 78 38 6f 00 e5 24 ab 00 7f fe 6a 0b 66 65 ae 79 81 3d d7 65 2e d5 c9 Data Ascii: A!d&n693@$;fakG)N]h&E=+m;3/CaD(higqVhD=edm}U\|rv&'PmESBB,E.X4??o-S Tmec<:^XC$`yQYF]P#AK?lRRo%X)dwZ?HCb+x8o$jfey=e.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49822	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:17 UTC	1408	OUT	GET /logon/LogonPoint/receiver/images/1x/search_close.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:18 UTC	1408	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:06 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "1c6-5c74025d36a80" Accept-Ranges: bytes Content-Length: 454 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:18 UTC	1409	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0f 00 00 00 0e 08 04 00 00 00 5a 83 8e 64 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 00 e1 49 44 41 54 18 d3 5d d0 bd 4a 03 51 10 86 e1 67 0f 36 bb 58 08 fe 34 96 b9 88 80 a5 69 42 02 61 6b 2d c5 8b 10 52 79 05 e9 a3 a5 16 db 24 04 0c 29 d4 52 f0 1a a2 56 42 40 51 52 84 6c 61 a1 c5 1e 42 cc 57 0c 33 f3 c2 f0 32 49 21 a6 ed dc 91 7d 9f 9e f4 dd 55 cb a4 80 1d 37 5a d6 33 76 6a 4e 40 66 b2 01 69 99 c8 2a dc 55 c7 8b 32 a2 d2 14 75 5d 92 62 db 87 14 27 be 0c a5 4a b9 5d b7 28 1d 04 0d 29 b8 46 ee 5b 8e 2b 90 6a 04 b5 78 Data Ascii: PNGIHDRZdgAMAa cHRMz&u0`:pQ<bKGDIDAT]JQg6X4iBak-Ry$)RVB@QRlaBW32I!}U7Z3vjN@fi*U2u]b'J]()F[+jx

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49823	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:17 UTC	1408	OUT	GET /logon/LogonPoint/receiver/images/1x/TasksIcon.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:18 UTC	1409	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:06 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "1cf-5c74025d36a80" Accept-Ranges: bytes Content-Length: 463 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:18 UTC	1409	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 01 96 49 44 41 54 58 85 ed 95 bd 4a 03 51 10 85 4f c4 c2 9f 22 69 d2 a9 58 a4 0d 28 08 01 09 18 16 4c 69 67 63 69 27 08 3e 85 0f 60 a5 2f 21 08 f6 3e 40 5a 1b 8b 88 09 26 55 0a 13 51 0b 11 3f 8b bd ab 37 c9 dd 1f dd 84 05 c9 81 81 dd d9 d9 39 1f 33 97 5d 69 a6 99 32 56 2e b8 00 36 a6 d0 7f 20 e9 c1 5c 57 24 5d 48 da 97 d4 cc e5 72 c3 95 4c 5e 6f c0 36 20 a0 02 0c 4c be 03 94 c6 50 a7 60 ee 39 cc 03 35 02 df 79 c7 d8 1e 25 7d a6 1c fd a5 a4 1b 49 9e a4 6b 49 4b d6 b3 ae a4 83 a8 09 14 0c 79 54 1c 02 e5 98 1a cf 4c c2 56 07 28 01 e3 c8 0e 80 35 60 dd c4 82 d5 f8 d8 d4 f5 80 ad 10 f3 ba c3 bc 09 ac 06 35 49 00 fa 56 ae 66 72 27 23 4d 07 f8 3b b6 cd f7 80 Data Ascii: PNGIHDR szzIDATXJQO"iX(Ligci'>`/!>@Z&UQ?793]i2V.6 \W$]HrL^o6 LP`95y%}IkIKyTLV(5`5IVfr'#M;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	49826	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:18 UTC	1410	OUT	GET /logon/LogonPoint/receiver/images/1x/bundle_white_overlay.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:19 UTC	1410	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:07 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "c0-5c74025d36a80" Accept-Ranges: bytes Content-Length: 192 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:19 UTC	1411	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 28 08 06 00 00 00 3f b6 90 77 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c2 00 00 0e c2 01 15 28 4a 80 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 30 2e 35 65 85 32 65 00 00 00 3e 49 44 41 54 18 57 63 18 28 f0 ff ff 7f 26 86 7f ff fe 71 83 08 31 10 a1 02 22 8c 40 84 33 88 08 02 11 a9 20 a2 8c e1 ef df bf dd 20 62 21 88 d8 06 22 4e 81 88 3b 20 e2 35 90 f8 fb 09 00 2f d4 36 dd 79 59 76 40 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR(?wgAMAapHYs(JtEXtSoftwarepaint.net 4.0.5e2e>IDATWc(&q1"@3 b!"N; 5/6yYv@IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	49828	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:18 UTC	1410	OUT	GET /logon/LogonPoint/receiver/images/1x/bundle_arrow_button.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:19 UTC	1411	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:07 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "5ea-5c74025d36a80" Accept-Ranges: bytes Content-Length: 1514 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:19 UTC	1411	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2c 00 00 00 2c 08 06 00 00 00 1e 84 5a 01 00 00 00 20 63 48 52 4d 00 00 7a 25 00 00 80 83 00 00 f9 ff 00 00 80 e9 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 6f 92 5f c5 46 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 30 2e 35 65 85 32 65 00 00 05 4c 49 44 41 54 58 47 ed 58 5d 48 a4 55 18 b6 ff d2 da 5a c7 d1 dc 75 a6 c2 ca 4d 31 17 74 8b 6a c5 8c 88 f6 42 e8 2a 21 64 61 41 92 c2 1a 30 ba da 0b 41 ec 46 44 54 f0 2e 35 2f 84 4c 03 91 2c 85 2e 42 21 4b 49 d3 48 47 04 c5 c5 a5 8c c4 bf 75 c6 71 66 b4 e7 19 ce 5b 67 c5 66 be 33 fb cd d4 c2 3e f0 e2 38 73 be f7 7d ce f3 3d e7 3d e7 fb 52 ee e0 36 c3 Data Ascii: PNGIHDR,,Z cHRMz%u0`:o_FpHYs~tEXtSoftwarepaint.net 4.0.5e2eLIDATXGX]HUZuM1tjB*!daA0AFDT.5/L,.B!KIHGuqf[gf3>8s}==R6

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	49831	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:19 UTC	1413	OUT	GET /logon/LogonPoint/receiver/images/1x/img_favorites_empty.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:20 UTC	1413	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:08 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "c69-5c74025d36a80" Accept-Ranges: bytes Content-Length: 3177 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:20 UTC	1414	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 75 00 00 00 75 08 06 00 00 00 70 04 ae bc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 30 2e 35 65 85 32 65 00 00 0b bb 49 44 41 54 78 5e ed 5d 4d 8f 14 c7 19 46 c4 49 2e 39 d8 97 f8 44 4e b1 64 c8 0f b0 8f fc 00 4c fe 41 b8 10 db 57 4b 88 1c ec a3 a5 70 b5 14 2b fe 05 39 70 0a 12 48 39 1b 2b 0c b0 7c 2e b0 df 0b ec 42 d8 65 60 66 98 d9 5d 16 ed b2 93 e7 69 de b1 7b 6a de 99 e9 ee aa ea 9a ee e9 47 7a 34 bb d3 dd 55 ef Data Ascii: PNGIHDRuupgAMAa cHRMz&u0`:pQ<pHYsodtEXtSoftwarepaint.net 4.0.5e2eIDATx^]MFI.9DNdLAWKp+9pH9+\|.Be`f]i{jGz4U

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49779	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:03 UTC	49	OUT	GET /logon/LogonPoint/receiver/js/external/jquery.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:03 UTC	52	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:34:28 GMT ETag: "1a008-5c74029486d00" Accept-Ranges: bytes Content-Length: 106504 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:03 UTC	52	IN	Data Raw: 76 61 72 20 24 6a 73 63 6f 6d 70 3d 7b 73 63 6f 70 65 3a 7b 7d 2c 67 65 74 47 6c 6f 62 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 3d 3d 3d 63 3f 63 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3f 67 6c 6f 62 61 6c 3a 63 7d 7d 3b 24 6a 73 63 6f 6d 70 2e 67 6c 6f 62 61 6c 3d 24 6a 73 63 6f 6d 70 2e 67 65 74 47 6c 6f 62 61 6c 28 74 68 69 73 29 3b 24 6a 73 63 6f 6d 70 2e 69 6e 69 74 53 79 6d 62 6f 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 24 6a 73 63 6f 6d 70 2e 67 6c 6f 62 61 6c 2e 53 79 6d 62 6f 6c 7c 7c 28 24 6a 73 63 6f 6d 70 2e 67 6c 6f 62 61 6c 2e 53 79 6d 62 6f 6c 3d 24 6a 73 63 6f 6d 70 2e 53 79 6d Data Ascii: var $jscomp={scope:{},getGlobal:function(c){return"undefined"!=typeof window&&window===c?c:"undefined"!=typeof global?global:c}};$jscomp.global=$jscomp.getGlobal(this);$jscomp.initSymbol=function(){$jscomp.global.Symbol\|\|($jscomp.global.Symbol=$jscomp.Sym
2022-04-01 15:32:03 UTC	59	IN	Data Raw: 63 6f 6d 70 2e 4d 61 70 2e 45 6e 74 72 79 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 24 6a 73 63 6f 6d 70 2e 4d 61 70 2e 41 53 53 55 4d 45 5f 4e 4f 5f 4e 41 54 49 56 45 3d 21 31 3b 24 6a 73 63 6f 6d 70 2e 4d 61 70 24 69 6e 73 74 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 24 6a 73 63 6f 6d 70 2e 69 6e 69 74 53 79 6d 62 6f 6c 28 29 3b 24 6a 73 63 6f 6d 70 2e 69 6e 69 74 53 79 6d 62 6f 6c 49 74 65 72 61 74 6f 72 28 29 3b 21 24 6a 73 63 6f 6d 70 2e 4d 61 70 2e 41 53 53 55 4d 45 5f 4e 4f 5f 4e 41 54 49 56 45 26 26 24 6a 73 63 6f 6d 70 2e 4d 61 70 2e 63 68 65 63 6b 42 72 6f 77 73 65 72 43 6f 6e 66 6f 72 6d 61 6e 63 65 5f 28 29 3f 24 6a 73 63 6f 6d 70 2e 4d 61 70 3d 24 6a 73 63 6f 6d 70 2e 67 6c 6f 62 61 6c 2e 4d 61 70 3a 28 24 6a 73 63 6f 6d 70 2e 69 6e 69 Data Ascii: comp.Map.Entry_=function(){};$jscomp.Map.ASSUME_NO_NATIVE=!1;$jscomp.Map$install=function(){$jscomp.initSymbol();$jscomp.initSymbolIterator();!$jscomp.Map.ASSUME_NO_NATIVE&&$jscomp.Map.checkBrowserConformance_()?$jscomp.Map=$jscomp.global.Map:($jscomp.ini
2022-04-01 15:32:03 UTC	114	IN	Data Raw: 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 61 2b 22 22 3a 22 6f 62 6a 65 63 74 22 3d 3d 3d 0a 74 79 70 65 6f 66 20 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 61 3f 42 61 5b 24 61 2e 63 61 6c 6c 28 61 29 5d 7c 7c 22 6f 62 6a 65 63 74 22 3a 74 79 70 65 6f 66 20 61 7d 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 76 61 72 20 62 3d 21 21 61 26 26 22 6c 65 6e 67 74 68 22 69 6e 20 61 26 26 61 2e 6c 65 6e 67 74 68 2c 64 3d 6e 28 61 29 3b 72 65 74 75 72 6e 20 77 28 61 29 7c 7c 58 28 61 29 3f 21 31 3a 22 61 72 72 61 79 22 3d 3d 3d 64 7c 7c 30 3d 3d 3d 62 7c 7c 22 6e 75 6d 62 Data Ascii: .appendChild(e).parentNode.removeChild(e)}function n(a){return null==a?a+"":"object"===typeof a\|\|"function"===typeof a?Ba[$a.call(a)]\|\|"object":typeof a}function q(a){var b=!!a&&"length"in a&&a.length,d=n(a);return w(a)\|\|X(a)?!1:"array"===d\|\|0===b\|\|"numb
2022-04-01 15:32:03 UTC	122	IN	Data Raw: 20 6e 61 3d 44 61 74 65 2e 6e 6f 77 28 29 7d 66 75 6e 63 74 69 6f 6e 20 48 61 28 61 2c 62 29 7b 76 61 72 20 64 2c 6b 3d 30 2c 65 3d 7b 68 65 69 67 68 74 3a 61 7d 3b 66 6f 72 28 62 3d 62 3f 31 3a 30 3b 34 3e 6b 3b 6b 2b 3d 32 2d 62 29 64 3d 48 5b 6b 5d 2c 65 5b 22 6d 61 72 67 69 6e 22 2b 64 5d 3d 65 5b 22 70 61 64 64 69 6e 67 22 2b 64 5d 3d 61 3b 62 26 26 28 65 2e 6f 70 61 63 69 74 79 3d 65 2e 77 69 64 74 68 3d 61 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 74 62 28 61 2c 62 2c 64 29 7b 66 6f 72 28 76 61 72 20 6b 2c 65 3d 28 4d 2e 74 77 65 65 6e 65 72 73 5b 62 5d 7c 7c 5b 5d 29 2e 63 6f 6e 63 61 74 28 4d 2e 74 77 65 65 6e 65 72 73 5b 22 2a 22 5d 29 2c 63 3d 30 2c 70 3d 65 2e 6c 65 6e 67 74 68 3b 63 3c 70 3b 63 2b 2b 29 69 66 28 6b 3d 65 5b Data Ascii: na=Date.now()}function Ha(a,b){var d,k=0,e={height:a};for(b=b?1:0;4>k;k+=2-b)d=H[k],e["margin"+d]=e["padding"+d]=a;b&&(e.opacity=e.width=a);return e}function tb(a,b,d){for(var k,e=(M.tweeners[b]\|\|[]).concat(M.tweeners["*"]),c=0,p=e.length;c<p;c++)if(k=e[
2022-04-01 15:32:03 UTC	129	IN	Data Raw: 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 6f 61 2e 61 70 70 6c 79 28 64 2c 6d 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 6b 29 29 2c 64 7d 63 61 74 63 68 28 74 29 7b 54 28 61 2c 21 30 29 7d 66 69 6e 61 6c 6c 79 7b 67 3d 3d 3d 44 26 26 62 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 7d 7d 7d 72 65 74 75 72 6e 20 4e 28 61 2e 72 65 70 6c 61 63 65 28 55 2c 0a 22 24 31 22 29 2c 62 2c 64 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 64 2c 65 29 7b 62 2e 70 75 73 68 28 64 2b 22 20 22 29 3e 41 2e 63 61 63 68 65 4c 65 6e 67 74 68 26 26 64 65 6c 65 74 65 20 61 5b 62 2e 73 68 69 66 74 28 29 5d 3b 72 65 74 75 72 6e 20 61 5b 64 2b 22 20 22 5d 3d 65 7d 76 61 72 20 62 3d 5b 5d 3b 72 65 74 75 72 6e Data Ascii: ,")}try{return oa.apply(d,m.querySelectorAll(k)),d}catch(t){T(a,!0)}finally{g===D&&b.removeAttribute("id")}}}return N(a.replace(U,"$1"),b,d,e)}function d(){function a(d,e){b.push(d+" ")>A.cacheLength&&delete a[b.shift()];return a[d+" "]=e}var b=[];return
2022-04-01 15:32:03 UTC	172	IN	Data Raw: 62 75 74 65 28 22 63 6c 61 73 73 4e 61 6d 65 22 29 7d 29 3b 79 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 3d 63 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 42 2e 63 72 65 61 74 65 43 6f 6d 6d 65 6e 74 28 22 22 29 29 3b 72 65 74 75 72 6e 21 61 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 2a 22 29 2e 6c 65 6e 67 74 68 7d 29 3b 79 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3d 57 2e 74 65 73 74 28 42 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 3b 79 2e 67 65 74 42 79 49 64 3d 63 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 52 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 2e 69 64 3d 0a 44 3b 72 65 74 75 72 6e 21 42 2e 67 65 74 45 6c Data Ascii: bute("className")});y.getElementsByTagName=c(function(a){a.appendChild(B.createComment(""));return!a.getElementsByTagName("*").length});y.getElementsByClassName=W.test(B.getElementsByClassName);y.getById=c(function(a){R.appendChild(a).id=D;return!B.getEl
2022-04-01 15:32:03 UTC	180	IN	Data Raw: 74 3d 66 5b 44 5d 7c 7c 28 66 5b 44 5d 3d 7b 7d 29 2c 74 3d 74 5b 66 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 74 5b 66 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 2c 6d 3d 74 5b 61 5d 7c 7c 5b 5d 2c 6d 3d 28 68 3d 6d 5b 30 5d 3d 3d 3d 62 61 26 26 6d 5b 31 5d 29 26 26 6d 5b 32 5d 2c 66 3d 68 26 26 6e 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 68 5d 3b 66 3d 2b 2b 68 26 26 66 26 26 66 5b 64 5d 7c 7c 28 6d 3d 68 3d 30 29 7c 7c 72 2e 70 6f 70 28 29 3b 29 7b 69 66 28 31 3d 3d 3d 66 2e 6e 6f 64 65 54 79 70 65 26 26 2b 2b 6d 26 26 66 3d 3d 3d 62 29 7b 74 5b 61 5d 3d 5b 62 61 2c 68 2c 6d 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 66 3d 62 2c 74 3d 66 5b 44 5d 7c 7c 28 66 5b 44 5d 3d 7b 7d 29 2c 74 3d 74 5b 66 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 74 5b Data Ascii: t=f[D]\|\|(f[D]={}),t=t[f.uniqueID]\|\|(t[f.uniqueID]={}),m=t[a]\|\|[],m=(h=m[0]===ba&&m[1])&&m[2],f=h&&n.childNodes[h];f=++h&&f&&f[d]\|\|(m=h=0)\|\|r.pop();){if(1===f.nodeType&&++m&&f===b){t[a]=[ba,h,m];break}}else if(p&&(f=b,t=f[D]\|\|(f[D]={}),t=t[f.uniqueID]\|\|(t[
2022-04-01 15:32:03 UTC	188	IN	Data Raw: 73 2e 61 64 64 28 6e 75 6c 6c 3d 3d 61 3f 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 3a 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 2e 66 69 6c 74 65 72 28 61 29 29 7d 7d 29 3b 0a 65 2e 65 61 63 68 28 7b 70 61 72 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 28 61 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 29 26 26 31 31 21 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 3f 61 3a 6e 75 6c 6c 7d 2c 70 61 72 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 68 61 28 61 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 29 7d 2c 70 61 72 65 6e 74 73 55 6e 74 69 6c 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 29 7b 72 65 74 75 72 6e 20 68 61 28 61 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 2c 64 29 7d 2c 6e 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: s.add(null==a?this.prevObject:this.prevObject.filter(a))}});e.each({parent:function(a){return(a=a.parentNode)&&11!==a.nodeType?a:null},parents:function(a){return ha(a,"parentNode")},parentsUntil:function(a,b,d){return ha(a,"parentNode",d)},next:function(
2022-04-01 15:32:03 UTC	196	IN	Data Raw: 78 2e 72 65 6d 6f 76 65 28 61 2c 5b 62 2b 22 71 75 65 75 65 22 2c 64 5d 29 7d 29 7d 29 7d 7d 29 3b 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 64 3d 32 3b 22 73 74 72 69 6e 67 22 21 3d 3d 74 79 70 65 6f 66 20 61 26 26 28 62 3d 61 2c 61 3d 22 66 78 22 2c 64 2d 2d 29 3b 72 65 74 75 72 6e 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 64 3f 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 61 29 3a 76 6f 69 64 20 30 3d 3d 3d 62 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 64 3d 65 2e 71 75 65 75 65 28 74 68 69 73 2c 61 2c 62 29 3b 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 61 29 3b 22 66 78 22 3d 3d 3d 61 26 26 22 69 6e 70 72 Data Ascii: x.remove(a,[b+"queue",d])})})}});e.fn.extend({queue:function(a,b){var d=2;"string"!==typeof a&&(b=a,a="fx",d--);return arguments.length<d?e.queue(this[0],a):void 0===b?this:this.each(function(){var d=e.queue(this,a,b);e._queueHooks(this,a);"fx"===a&&"inpr
2022-04-01 15:32:03 UTC	203	IN	Data Raw: 29 3b 72 65 74 75 72 6e 21 31 7d 2c 74 72 69 67 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 43 61 28 74 68 69 73 2c 61 29 3b 72 65 74 75 72 6e 21 30 7d 2c 64 65 6c 65 67 61 74 65 54 79 70 65 3a 62 7d 7d 29 3b 65 2e 65 61 63 68 28 7b 6d 6f 75 73 65 65 6e 74 65 72 3a 22 6d 6f 75 73 65 6f 76 65 72 22 2c 6d 6f 75 73 65 6c 65 61 76 65 3a 22 6d 6f 75 73 65 6f 75 74 22 2c 70 6f 69 6e 74 65 72 65 6e 74 65 72 3a 22 70 6f 69 6e 74 65 72 6f 76 65 72 22 2c 0a 70 6f 69 6e 74 65 72 6c 65 61 76 65 3a 22 70 6f 69 6e 74 65 72 6f 75 74 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 65 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 5b 61 5d 3d 7b 64 65 6c 65 67 61 74 65 54 79 70 65 3a 62 2c 62 69 6e 64 54 79 70 65 3a 62 2c 68 61 6e 64 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 61 Data Ascii: );return!1},trigger:function(){Ca(this,a);return!0},delegateType:b}});e.each({mouseenter:"mouseover",mouseleave:"mouseout",pointerenter:"pointerover",pointerleave:"pointerout"},function(a,b){e.event.special[a]={delegateType:b,bindType:b,handle:function(a
2022-04-01 15:32:03 UTC	211	IN	Data Raw: 66 5b 62 5b 68 5d 5d 3d 65 2e 63 73 73 28 61 2c 62 5b 68 5d 2c 21 31 2c 63 29 3b 72 65 74 75 72 6e 20 66 7d 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 63 3f 65 2e 73 74 79 6c 65 28 61 2c 62 2c 63 29 3a 65 2e 63 73 73 28 61 2c 62 29 7d 2c 61 2c 62 2c 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7d 7d 29 3b 65 2e 54 77 65 65 6e 3d 45 3b 45 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 45 2c 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 2c 63 2c 6c 2c 67 29 7b 74 68 69 73 2e 65 6c 65 6d 3d 61 3b 74 68 69 73 2e 70 72 6f 70 3d 64 3b 74 68 69 73 2e 65 61 73 69 6e 67 3d 6c 7c 7c 65 2e 65 61 73 69 6e 67 2e 5f 64 65 66 61 75 6c 74 3b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 3d 62 3b 74 68 69 73 2e 73 74 61 72 74 3d Data Ascii: f[b[h]]=e.css(a,b[h],!1,c);return f}return void 0!==c?e.style(a,b,c):e.css(a,b)},a,b,1<arguments.length)}});e.Tween=E;E.prototype={constructor:E,init:function(a,b,d,c,l,g){this.elem=a;this.prop=d;this.easing=l\|\|e.easing._default;this.options=b;this.start=
2022-04-01 15:32:03 UTC	273	IN	Data Raw: 74 69 6f 6e 28 61 29 7b 28 61 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 29 26 26 61 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 29 61 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 61 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 7d 7d 29 3b 65 2e 65 61 63 68 28 22 74 61 62 49 6e 64 65 78 20 72 65 61 64 4f 6e 6c 79 20 6d 61 78 4c 65 6e 67 74 68 20 63 65 6c 6c 53 70 61 63 69 6e 67 20 63 65 6c 6c 50 61 64 64 69 6e 67 20 72 6f 77 53 70 61 6e 20 63 6f 6c 53 70 61 6e 20 75 73 65 4d 61 Data Ascii: tion(a){(a=a.parentNode)&&a.parentNode&&a.parentNode.selectedIndex;return null},set:function(a){if(a=a.parentNode)a.selectedIndex,a.parentNode&&a.parentNode.selectedIndex}});e.each("tabIndex readOnly maxLength cellSpacing cellPadding rowSpan colSpan useMa
2022-04-01 15:32:03 UTC	280	IN	Data Raw: 7c 7c 22 48 45 41 44 22 3d 3d 3d 72 2e 74 79 70 65 3f 76 3d 22 6e 6f 63 6f 6e 74 65 6e 74 22 3a 33 30 34 3d 3d 3d 61 3f 76 3d 22 6e 6f 74 6d 6f 64 69 66 69 65 64 22 3a 28 76 3d 77 2e 73 74 61 74 65 2c 6d 3d 77 2e 64 61 74 61 2c 70 3d 77 2e 65 72 72 6f 72 2c 68 3d 21 70 29 3b 65 6c 73 65 20 69 66 28 70 3d 0a 76 2c 61 7c 7c 21 76 29 76 3d 22 65 72 72 6f 72 22 2c 30 3e 61 26 26 28 61 3d 30 29 3b 79 2e 73 74 61 74 75 73 3d 61 3b 79 2e 73 74 61 74 75 73 54 65 78 74 3d 28 62 7c 7c 76 29 2b 22 22 3b 68 3f 43 2e 72 65 73 6f 6c 76 65 57 69 74 68 28 78 2c 5b 6d 2c 76 2c 79 5d 29 3a 43 2e 72 65 6a 65 63 74 57 69 74 68 28 78 2c 5b 79 2c 76 2c 70 5d 29 3b 79 2e 73 74 61 74 75 73 43 6f 64 65 28 45 29 3b 45 3d 76 6f 69 64 20 30 3b 75 26 26 7a 2e 74 72 69 67 67 65 72 28 Data Ascii: \|\|"HEAD"===r.type?v="nocontent":304===a?v="notmodified":(v=w.state,m=w.data,p=w.error,h=!p);else if(p=v,a\|\|!v)v="error",0>a&&(a=0);y.status=a;y.statusText=(b\|\|v)+"";h?C.resolveWith(x,[m,v,y]):C.rejectWith(x,[y,v,p]);y.statusCode(E);E=void 0;u&&z.trigger(
2022-04-01 15:32:03 UTC	288	IN	Data Raw: 28 63 3d 5a 28 61 2e 73 6c 69 63 65 28 6e 29 29 2c 61 3d 61 2e 73 6c 69 63 65 28 30 2c 6e 29 29 3b 77 28 62 29 3f 28 64 3d 62 2c 62 3d 76 6f 69 64 20 30 29 3a 62 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 74 79 70 65 6f 66 20 62 26 26 28 66 3d 22 50 4f 53 54 22 29 3b 30 3c 68 2e 6c 65 6e 67 74 68 26 26 65 2e 61 6a 61 78 28 7b 75 72 6c 3a 61 2c 74 79 70 65 3a 66 7c 7c 22 47 45 54 22 2c 64 61 74 61 54 79 70 65 3a 22 68 74 6d 6c 22 2c 64 61 74 61 3a 62 7d 29 2e 64 6f 6e 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 3d 61 72 67 75 6d 65 6e 74 73 3b 68 2e 68 74 6d 6c 28 63 3f 65 28 22 3c 64 69 76 3e 22 29 2e 61 70 70 65 6e 64 28 65 2e 70 61 72 73 65 48 54 4d 4c 28 61 29 29 2e 66 69 6e 64 28 63 29 3a 61 29 7d 29 2e 61 6c 77 61 79 73 28 64 26 26 66 75 6e 63 74 69 6f Data Ascii: (c=Z(a.slice(n)),a=a.slice(0,n));w(b)?(d=b,b=void 0):b&&"object"===typeof b&&(f="POST");0<h.length&&e.ajax({url:a,type:f\|\|"GET",dataType:"html",data:b}).done(function(a){g=arguments;h.html(c?e("<div>").append(e.parseHTML(a)).find(c):a)}).always(d&&functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	49832	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:19 UTC	1413	OUT	GET /logon/LogonPoint/receiver/images/1x/spinner.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:20 UTC	1417	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:08 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "7ed-5c74025d36a80" Accept-Ranges: bytes Content-Length: 2029 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:20 UTC	1417	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 16 08 06 00 00 00 36 08 39 9e 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 78 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 35 37 37 32 2c 20 32 30 31 34 2f 30 31 2f 31 33 2d 31 39 3a 34 34 3a 30 30 20 20 Data Ascii: PNGIHDRd69tEXtSoftwareAdobe ImageReadyqe<xiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	49833	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:20 UTC	1419	OUT	GET /logon/LogonPoint/receiver/images/common/ReceiverFullScreenBackground.jpg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:21 UTC	1420	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:09 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "c676-5c74025d36a80" Accept-Ranges: bytes Content-Length: 50806 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/jpeg Connection: close
2022-04-01 15:32:21 UTC	1420	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 01 00 01 00 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 ff c0 00 11 08 06 40 0a 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1b 00 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff c4 00 24 10 01 01 01 01 00 01 04 03 01 01 01 01 01 00 00 00 00 11 01 02 03 12 21 31 51 04 41 71 61 22 81 32 91 ff c4 00 19 01 01 01 01 01 01 01 Data Ascii: JFIFC%# , #&')*)-0-(0%()(C(((((((((((((((((((((((((((((((((((((((((((((((((((@"$!1QAqa"2
2022-04-01 15:32:21 UTC	1427	IN	Data Raw: 89 3f c1 58 84 6e 62 40 66 24 6e 6a 03 30 6a 10 18 89 1b 89 05 64 8d 44 80 cc 1a 88 a3 31 23 71 20 31 06 88 2b 10 6a 24 51 92 35 12 08 cc 46 d2 0a c8 b1 20 24 4d c6 85 18 88 e9 13 70 1c e0 d6 e7 d2 28 88 d4 41 52 23 48 09 11 a8 80 89 1a 88 a3 31 1b 4d c1 59 46 a2 05 44 8d 44 15 05 48 09 11 a4 15 91 a8 90 11 22 8a 88 2a 00 91 40 64 50 19 dc 46 81 59 17 73 e9 00 45 05 44 69 20 21 00 54 22 90 19 15 20 00 02 23 49 01 00 55 11 40 41 62 00 00 00 0a 00 02 6e 28 0c 0d c6 77 04 40 00 00 00 00 00 07 0f 26 de b5 db ad 9c ee b8 26 88 29 11 50 58 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 f5 20 3c 5c 40 08 00 08 00 a0 a8 03 42 55 14 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?Xnb@f$nj0jdD1#q 1+j$Q5F $Mp(AR#H1MYFDDH"*@dPFYsEDi !T" #IU@Abn(w@&&)PX <\@BU
2022-04-01 15:32:21 UTC	1436	IN	Data Raw: aa 0a 25 51 05 40 14 00 15 17 00 69 95 15 40 41 40 05 0c 04 68 4c 54 17 15 14 17 15 31 41 5b f1 6c ea 7d b1 86 6c da 83 d5 8b 8c f3 b7 2b 58 a8 d6 09 8a 8a d2 e2 2e 22 2a e2 2e 20 b8 d2 62 a0 b8 b8 8b 80 d6 2e 22 e2 2a e2 a6 35 88 0a 62 e2 0b 9f 0d 62 34 06 35 89 8a c8 e9 e2 cf 7a eb 8c f8 f2 72 de 02 e2 98 b8 88 63 59 86 63 48 a6 2e 0b 88 2e 2e 0a 80 a6 62 80 a3 59 88 19 8a b9 82 04 51 73 10 33 14 69 15 22 99 8d 66 01 98 a2 c4 13 31 62 88 02 e6 2c 04 82 a8 24 22 90 11 56 11 04 23 50 11 98 b1 40 48 46 88 0c c2 35 08 0c c2 35 05 18 84 68 06 60 d1 04 65 23 51 22 8c ee 23 68 0c 8b 12 28 91 96 c1 18 88 d6 e2 2a 33 b8 91 b8 80 c2 37 b8 91 46 37 11 b8 ce e2 8c 44 8d ee 26 aa 30 9b 8d a0 30 8d 6e 22 d1 9d c6 5b 4d 51 8d 46 e2 2a 31 b8 8d b3 b8 a3 2c ee 46 f5 15 Data Ascii: %Q@i@A@hLT1A[l}l+X.". b."5bb45zrcYcH...bYQs3i"f1b,$"V#P@HF55h`e#Q"#h(37F7D&00n"[MQF1,F
2022-04-01 15:32:21 UTC	1444	IN	Data Raw: d6 75 55 35 15 15 13 59 6b 7e 19 54 4d 45 4d 51 94 d6 99 d5 19 d4 d6 b5 35 51 8d 1a d6 54 67 7e 53 57 53 54 65 35 53 54 67 53 5a d4 54 63 59 d6 ba 45 19 d6 75 a6 75 51 35 35 51 46 75 35 75 35 44 df 86 35 bd 67 55 23 3a 8d 6a 6a 8c b3 d3 5a 9b f0 a3 2c eb 4c ea 89 a8 a8 0c ea 35 ac 82 26 aa 6a 8c a7 4d 6a 6a 8c b2 d4 4d c0 44 54 51 35 8d f9 74 d6 75 70 67 51 52 28 9a cb 5a 9a 82 24 51 44 4d 50 19 22 ea 0a 82 ea 08 ce a3 5b 95 05 40 14 41 58 f3 6f a7 c7 b3 e7 e0 58 f2 79 3a f5 77 ba c8 22 a4 14 04 16 00 82 80 80 44 50 58 b0 19 58 b0 82 a0 aa 09 05 10 02 28 22 80 02 c5 88 a9 16 0a 00 45 41 22 8b 01 17 31 62 82 45 22 a2 a4 51 60 22 c5 82 04 16 2c 04 22 91 00 58 b0 19 8b 15 41 21 14 80 91 48 b1 04 16 10 10 58 40 41 61 01 05 84 04 16 10 19 22 c2 28 91 23 40 31 Data Ascii: uU5Yk~TMEMQ5QTg~SWSTe5STgSZTcYEuuQ55QFu5u5D5gU#:jjZ,L5&jMjjMDTQ5tupgQR(Z$QDMP"[@AXoXy:w"DPXX("EA"1bE"Q`","XA!HX@Aa"(#@1
2022-04-01 15:32:21 UTC	1451	IN	Data Raw: 00 2a 28 0b 11 70 d4 00 41 73 2e e6 3d 19 ed 8e 5e 1c bd 5f a7 60 0c 50 05 c4 50 00 41 55 95 aa 8a a8 22 aa e3 35 44 68 40 1a 75 f1 ed e5 c6 b7 e3 df 7f e8 ae c2 08 2d 54 01 ac d6 b3 58 01 d0 ac 66 b5 51 1a 5a ca d1 5a aa c2 d4 1b a3 35 50 6b 35 ac d7 3a a0 e9 56 b9 d6 b3 51 5b ab 58 5a 83 75 6b 05 06 ea d6 2a 83 75 6b 15 6a 0d e6 b5 5c ab 59 a2 ba 51 8a b5 06 f3 56 b1 56 a2 b7 57 35 8a a8 37 9d 35 5c aa d4 57 4a b5 ce ad 06 ea d6 2a d0 6e ae 6b 15 51 5b a5 62 ad 15 ba 56 2a d4 1a ab 58 ab 45 6a ad 62 ad 41 aa b5 8a b4 56 a9 59 a5 06 a9 52 95 22 ad 5a c8 2b 54 ac d2 83 54 ac 80 d2 25 05 51 29 45 51 2a 50 68 ac d5 a0 51 29 41 44 a9 45 5a 33 75 37 54 6a e3 3b a8 01 40 15 03 52 80 20 a1 a8 6e b2 a9 16 a1 50 55 67 55 34 04 11 52 06 9a 82 a6 82 55 48 86 80 88 Data Ascii: (pAs.=^_`PPAU"5Dh@u-TXfQZZ5Pk5:VQ[XZukukj\YQVVW575\WJnkQ[bVXEjbAVYR"Z+TT%Q)EQ*PhQ)ADEZ3u7Tj;@R nPUgU4RUH
2022-04-01 15:32:21 UTC	1459	IN	Data Raw: 40 16 88 08 d0 85 05 28 02 88 50 50 10 16 a0 0a 22 82 d5 64 44 6a ab 35 41 56 a0 0a 22 d0 16 a0 83 4a c2 d0 68 4a a8 00 0a b4 cd 40 1a aa cd 10 68 a9 54 14 40 15 6b 35 41 68 80 28 8b 40 0a 51 45 a9 4a 88 b4 a9 4a a2 d2 a5 4a 2b 54 ac 82 2d 4a 14 01 28 05 10 aa 2a 15 01 50 a8 a8 05 4a 0a 88 55 0a 82 6e aa 05 40 04 dd 2b 2a 02 68 a8 25 35 35 50 a8 26 a8 20 80 6e a0 95 50 a8 26 ea 86 ea 06 aa 25 04 d5 1f 79 41 f3 5d c0 a2 06 28 00 62 c0 01 40 20 08 0a 62 82 28 00 00 00 00 00 01 08 10 08 40 02 10 20 10 81 01 45 19 1a 88 2a 23 49 a0 80 00 8a 28 80 00 8a 02 0a 9a a4 12 28 08 8d 32 a0 40 04 89 ab a2 88 02 89 a8 d3 22 40 00 88 68 28 81 05 13 51 41 10 d0 51 13 f6 ad f8 b9 bd df a0 8e 99 93 33 15 48 35 19 d0 82 a2 23 4c 89 0d 43 45 22 0a 82 44 45 14 4d 4d 54 d5 22 Data Ascii: @(PP"dDj5AV"JhJ@hT@k5Ah(@QEJJJ+T-J(PJUn@+h%55P& nP&%yA](b@ b(@ E*#I((2@"@h(QAQ3H5#LCE"DEMMT"
2022-04-01 15:32:21 UTC	1467	IN	Data Raw: 20 22 a2 26 aa 2a 26 a6 b5 a8 a8 ca 6b 49 a3 28 9a a6 aa 33 a8 a8 a8 9a 1a 2a 20 ba ce 88 86 82 b3 a8 02 a2 6a 6a 8a 8c b7 f2 c3 5c 88 a0 34 22 35 a8 32 ca 6b 48 a8 80 00 00 89 a2 a2 a6 a2 34 82 22 29 aa 88 00 80 0a 06 80 20 6a 51 95 12 94 14 4a 50 54 d2 94 10 05 40 00 00 00 00 16 a0 0b 44 11 1a 19 5a 0a 25 01 40 00 00 00 00 01 40 00 a5 00 51 00 51 29 41 40 02 ad 41 05 10 22 d5 12 ad 0a a5 4a 02 d1 04 56 86 56 82 89 4a 0b 56 a3 3e 4d f4 f3 a0 e3 df 57 ad d4 a9 4a 8c ad 10 45 68 64 11 a1 0a 2a 89 4a 0a 25 28 28 94 a0 a2 28 00 01 4a 00 a2 02 2a d6 6a d4 14 40 14 28 02 a0 0b 44 01 a1 91 20 d0 80 28 94 a0 a2 52 82 d5 66 80 d0 85 11 42 80 55 a8 05 51 04 82 89 56 80 14 05 a5 40 55 a2 02 34 32 a2 a8 94 a2 28 94 a0 a5 4a 50 5a 54 a5 05 a5 4a 02 d2 a0 0b 4a 85 15 Data Ascii: "&&kI(3 jj\4"52kH4") jQJPT@DZ%@@QQ)A@A"JVVJV>MWJEhdJ%(((Jj@(D (RfBUQV@U42(JPZTJJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	49834	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:20 UTC	1419	OUT	GET /logon/LogonPoint/receiver/images/1x/ico_close.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:21 UTC	1435	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:09 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "1f2-5c74025d36a80" Accept-Ranges: bytes Content-Length: 498 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:21 UTC	1435	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 06 00 00 00 1f f3 ff 61 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 30 2e 35 65 85 32 65 00 00 01 44 49 44 41 54 38 4f 8d 93 dd 4e c3 30 0c 85 fb 12 80 80 21 c4 a8 04 12 08 b1 97 6f d3 9f 11 a5 da 45 2f e0 8a 75 c0 0d 43 08 ae 78 08 f8 9c 39 28 a8 55 e9 91 ac 7a f6 39 76 9c 78 49 51 14 d7 65 59 de e5 79 7e 98 4c 84 b5 36 45 b3 04 17 09 8e ad aa ea 1b eb 9c 73 ff 16 41 7c 09 f7 55 35 26 91 ce 38 1b 0d Data Ascii: PNGIHDRagAMAa cHRMz&u0`:pQ<pHYsodtEXtSoftwarepaint.net 4.0.5e2eDIDAT8ON0!oE/uCx9(Uz9vxIQeYy~L6EsA\|U5&8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	49835	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:21 UTC	1471	OUT	GET /logon/LogonPoint/receiver/images/1x/CitrixReceiver_WebScreen.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: emsonline.tritech.com
2022-04-01 15:32:22 UTC	1471	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:31:10 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:33:30 GMT ETag: "8cc-5c74025d36a80" Accept-Ranges: bytes Content-Length: 2252 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Type: image/png Connection: close
2022-04-01 15:32:22 UTC	1471	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 82 00 00 00 34 08 06 00 00 00 46 90 e0 95 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 44 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 82 a0 03 00 04 00 00 00 01 00 00 00 34 00 00 00 00 79 f5 3a 64 00 00 08 36 49 44 41 54 78 01 ed 98 09 6c 55 55 10 86 29 94 55 a1 2c 61 55 11 17 10 91 ad 06 59 54 08 51 41 76 14 11 8d 51 88 20 02 61 d1 10 63 44 82 b8 44 40 14 49 5c 10 45 45 44 01 91 b0 15 d9 dd 10 34 8a 58 36 05 a1 50 40 d6 22 46 04 d9 05 bf ff 72 cf f3 be f6 f5 b5 f0 8a 2d 79 33 c9 f7 66 ce 9c 39 73 ef 9d 73 ee 39 b7 2d 54 c8 c4 2a 60 15 b0 0a 58 05 ac 02 56 01 ab 80 55 c0 2a 60 Data Ascii: PNGIHDR4FsRGBDeXIfMMi4y:d6IDATxlUU)U,aUYTQAvQ acDD@I\EED4X6P@"Fr-y3f9ss9-T`XVU*`

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49777	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:03 UTC	50	OUT	GET /logon/LogonPoint/receiver/js/external/jquery-ui.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:03 UTC	75	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:34:37 GMT ETag: "3d738-5c74029d1c140" Accept-Ranges: bytes Content-Length: 251704 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:03 UTC	75	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 64 29 3a 64 28 6a 51 75 65 72 79 29 7d 29 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 66 75 6e 63 74 69 6f 6e 20 57 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3b 61 2e 6c 65 6e 67 74 68 26 26 61 5b 30 5d 21 3d 3d 64 6f 63 75 6d 65 6e 74 3b 29 7b 62 3d 61 2e 63 73 73 28 22 70 6f 73 69 74 69 6f 6e 22 29 3b 69 66 28 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 62 7c 7c 22 72 65 6c 61 74 69 76 65 22 3d 3d 3d 62 7c 7c 22 66 69 78 65 64 22 3d 3d 3d 62 29 69 66 28 62 3d 70 61 72 73 65 49 6e 74 28 61 2e 63 73 73 28 22 7a 49 6e 64 65 78 22 29 2c 31 30 29 2c 21 69 73 4e 61 Data Ascii: (function(d){"function"===typeof define&&define.amd?define(["jquery"],d):d(jQuery)})(function(d){function W(a){for(var b;a.length&&a[0]!==document;){b=a.css("position");if("absolute"===b\|\|"relative"===b\|\|"fixed"===b)if(b=parseInt(a.css("zIndex"),10),!isNa
2022-04-01 15:32:03 UTC	83	IN	Data Raw: 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 5b 61 5d 29 3b 66 6f 72 28 67 3d 30 3b 67 3c 66 2e 6c 65 6e 67 74 68 2d 31 3b 67 2b 2b 29 65 5b 66 5b 67 5d 5d 3d 65 5b 66 5b 67 5d 5d 7c 7c 7b 7d 2c 65 3d 65 5b 66 5b 67 5d 5d 3b 61 3d 66 2e 70 6f 70 28 29 3b 69 66 28 31 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 5b 61 5d 3f 6e 75 6c 6c 3a 65 5b 61 5d 3b 65 5b 61 5d 3d 62 7d 65 6c 73 65 7b 69 66 28 31 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 5b 61 5d 3f 6e 75 6c 6c 3a 74 68 69 73 2e 6f 70 74 69 6f 6e 73 5b 61 5d 3b 63 5b 61 5d 3d 62 7d 74 68 69 73 2e 5f 73 65 74 4f 70 74 69 6f 6e 73 28 63 29 3b 72 Data Ascii: ,this.options[a]);for(g=0;g<f.length-1;g++)e[f[g]]=e[f[g]]\|\|{},e=e[f[g]];a=f.pop();if(1===arguments.length)return void 0===e[a]?null:e[a];e[a]=b}else{if(1===arguments.length)return void 0===this.options[a]?null:this.options[a];c[a]=b}this._setOptions(c);r
2022-04-01 15:32:03 UTC	137	IN	Data Raw: 7b 66 69 74 3a 7b 6c 65 66 74 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 62 2e 77 69 74 68 69 6e 2c 64 3d 63 2e 69 73 57 69 6e 64 6f 77 3f 63 2e 73 63 72 6f 6c 6c 4c 65 66 74 3a 63 2e 6f 66 66 73 65 74 2e 6c 65 66 74 2c 65 3d 63 2e 77 69 64 74 68 2c 67 3d 61 2e 6c 65 66 74 2d 62 2e 63 6f 6c 6c 69 73 69 6f 6e 50 6f 73 69 74 69 6f 6e 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 63 3d 64 2d 67 2c 68 3d 67 2b 62 2e 63 6f 6c 6c 69 73 69 6f 6e 57 69 64 74 68 2d 0a 65 2d 64 3b 62 2e 63 6f 6c 6c 69 73 69 6f 6e 57 69 64 74 68 3e 65 3f 30 3c 63 26 26 30 3e 3d 68 3f 28 64 3d 61 2e 6c 65 66 74 2b 63 2b 62 2e 63 6f 6c 6c 69 73 69 6f 6e 57 69 64 74 68 2d 65 2d 64 2c 61 2e 6c 65 66 74 2b 3d 63 2d 64 29 3a 61 2e 6c 65 66 74 3d 30 3c 68 26 26 30 3e 3d 63 3f 64 Data Ascii: {fit:{left:function(a,b){var c=b.within,d=c.isWindow?c.scrollLeft:c.offset.left,e=c.width,g=a.left-b.collisionPosition.marginLeft,c=d-g,h=g+b.collisionWidth-e-d;b.collisionWidth>e?0<c&&0>=h?(d=a.left+c+b.collisionWidth-e-d,a.left+=c-d):a.left=0<h&&0>=c?d
2022-04-01 15:32:03 UTC	145	IN	Data Raw: 28 22 22 3d 3d 3d 68 7c 7c 22 74 72 61 6e 73 70 61 72 65 6e 74 22 3d 3d 3d 68 29 26 26 67 26 26 67 2e 73 74 79 6c 65 3b 29 74 72 79 7b 68 3d 61 2e 63 73 73 28 67 2c 22 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 29 2c 67 3d 67 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 63 61 74 63 68 28 6c 29 7b 7d 65 3d 65 2e 62 6c 65 6e 64 28 68 26 26 22 74 72 61 6e 73 70 61 72 65 6e 74 22 21 3d 3d 68 3f 68 3a 22 5f 64 65 66 61 75 6c 74 22 29 7d 65 3d 65 2e 74 6f 52 67 62 61 53 74 72 69 6e 67 28 29 7d 74 72 79 7b 62 2e 73 74 79 6c 65 5b 63 5d 3d 65 7d 63 61 74 63 68 28 6c 29 7b 7d 7d 7d 3b 61 2e 66 78 2e 73 74 65 70 5b 63 5d 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 2e 63 6f 6c 6f 72 49 6e 69 74 7c 7c 28 62 2e 73 74 61 72 74 3d 6b 28 62 2e 65 6c 65 6d 2c 63 29 2c 62 2e 65 Data Ascii: (""===h\|\|"transparent"===h)&&g&&g.style;)try{h=a.css(g,"backgroundColor"),g=g.parentNode}catch(l){}e=e.blend(h&&"transparent"!==h?h:"_default")}e=e.toRgbaString()}try{b.style[c]=e}catch(l){}}};a.fx.step[c]=function(b){b.colorInit\|\|(b.start=k(b.elem,c),b.e
2022-04-01 15:32:03 UTC	153	IN	Data Raw: 28 61 2c 62 2c 63 2c 68 29 7b 68 3d 68 7c 7c 7b 7d 3b 64 2e 65 61 63 68 28 62 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 64 29 7b 76 61 72 20 65 3d 61 2e 63 73 73 55 6e 69 74 28 64 29 3b 30 3c 65 5b 30 5d 26 26 28 68 5b 64 5d 3d 65 5b 30 5d 2a 63 2b 65 5b 31 5d 29 7d 29 3b 72 65 74 75 72 6e 20 68 7d 7d 29 3b 64 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 65 66 66 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 66 28 29 7b 6c 2e 72 65 6d 6f 76 65 44 61 74 61 28 22 75 69 2d 65 66 66 65 63 74 73 2d 61 6e 69 6d 61 74 65 64 22 29 3b 64 2e 65 66 66 65 63 74 73 2e 63 6c 65 61 6e 55 70 28 6c 29 3b 22 68 69 64 65 22 3d 3d 3d 63 2e 6d 6f 64 65 26 26 6c 2e 68 69 64 65 28 29 3b 6b 28 29 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: (a,b,c,h){h=h\|\|{};d.each(b,function(b,d){var e=a.cssUnit(d);0<e[0]&&(h[d]=e[0]*c+e[1])});return h}});d.fn.extend({effect:function(){function b(a){function f(){l.removeData("ui-effects-animated");d.effects.cleanUp(l);"hide"===c.mode&&l.hide();k()}function
2022-04-01 15:32:03 UTC	160	IN	Data Raw: 69 6f 6e 28 6c 2c 6e 2c 65 2c 77 29 2c 78 3d 64 2e 65 66 66 65 63 74 73 2e 73 65 74 54 72 61 6e 73 69 74 69 6f 6e 28 6c 2c 6e 2c 63 2c 78 29 29 2c 67 21 3d 3d 66 26 26 28 77 3d 64 2e 65 66 66 65 63 74 73 2e 73 65 74 54 72 61 6e 73 69 74 69 6f 6e 28 6c 2c 70 2c 67 2c 77 29 2c 78 3d 64 2e 65 66 66 65 63 74 73 2e 73 65 74 54 72 61 6e 73 69 74 69 6f 6e 28 6c 2c 70 2c 66 2c 78 29 29 3b 22 63 6f 6e 74 65 6e 74 22 21 3d 3d 74 26 26 22 62 6f 74 68 22 21 3d 3d 74 7c 7c 65 3d 3d 3d 63 7c 7c 28 77 3d 64 2e 65 66 66 65 63 74 73 2e 73 65 74 54 72 61 6e 73 69 74 69 6f 6e 28 6c 2c 6d 2c 65 2c 77 29 2c 78 3d 64 2e 65 66 66 65 63 74 73 2e 73 65 74 54 72 61 6e 73 69 74 69 6f 6e 28 6c 2c 6d 2c 63 2c 78 29 29 3b 68 26 26 28 68 3d 64 2e 65 66 66 65 63 74 73 2e 67 65 74 42 61 Data Ascii: ion(l,n,e,w),x=d.effects.setTransition(l,n,c,x)),g!==f&&(w=d.effects.setTransition(l,p,g,w),x=d.effects.setTransition(l,p,f,x));"content"!==t&&"both"!==t\|\|e===c\|\|(w=d.effects.setTransition(l,m,e,w),x=d.effects.setTransition(l,m,c,x));h&&(h=d.effects.getBa
2022-04-01 15:32:03 UTC	219	IN	Data Raw: 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 68 65 61 64 65 72 3a 74 68 69 73 2e 61 63 74 69 76 65 2c 70 61 6e 65 6c 3a 74 68 69 73 2e 61 63 74 69 76 65 2e 6c 65 6e 67 74 68 3f 74 68 69 73 2e 61 63 74 69 76 65 2e 6e 65 78 74 28 29 3a 64 28 29 7d 7d 2c 5f 63 72 65 61 74 65 49 63 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 62 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 69 63 6f 6e 73 3b 62 26 26 28 61 3d 64 28 22 3c 73 70 61 6e 3e 22 29 2c 74 68 69 73 2e 5f 61 64 64 43 6c 61 73 73 28 61 2c 0a 22 75 69 2d 61 63 63 6f 72 64 69 6f 6e 2d 68 65 61 64 65 72 2d 69 63 6f 6e 22 2c 22 75 69 2d 69 63 6f 6e 20 22 2b 62 2e 68 65 61 64 65 72 29 2c 61 2e 70 72 65 70 65 6e 64 54 6f 28 74 68 69 73 2e 68 65 61 64 65 72 73 29 2c 61 3d 74 68 69 Data Ascii: a:function(){return{header:this.active,panel:this.active.length?this.active.next():d()}},_createIcons:function(){var a,b=this.options.icons;b&&(a=d("<span>"),this._addClass(a,"ui-accordion-header-icon","ui-icon "+b.header),a.prependTo(this.headers),a=thi
2022-04-01 15:32:03 UTC	226	IN	Data Raw: 74 72 28 7b 72 6f 6c 65 3a 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 72 6f 6c 65 2c 74 61 62 49 6e 64 65 78 3a 30 7d 29 3b 74 68 69 73 2e 5f 61 64 64 43 6c 61 73 73 28 22 75 69 2d 6d 65 6e 75 22 2c 0a 22 75 69 2d 77 69 64 67 65 74 20 75 69 2d 77 69 64 67 65 74 2d 63 6f 6e 74 65 6e 74 22 29 3b 74 68 69 73 2e 5f 6f 6e 28 7b 22 6d 6f 75 73 65 64 6f 77 6e 20 2e 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 22 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 7d 2c 22 63 6c 69 63 6b 20 2e 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 22 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 64 28 61 2e 74 61 72 67 65 74 29 2c 63 3d 64 28 64 2e 75 69 2e 73 61 66 65 41 63 74 69 76 65 45 6c 65 6d 65 6e 74 28 74 68 69 73 2e 64 6f 63 75 6d 65 Data Ascii: tr({role:this.options.role,tabIndex:0});this._addClass("ui-menu","ui-widget ui-widget-content");this._on({"mousedown .ui-menu-item":function(a){a.preventDefault()},"click .ui-menu-item":function(a){var b=d(a.target),c=d(d.ui.safeActiveElement(this.docume
2022-04-01 15:32:03 UTC	234	IN	Data Raw: 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 62 3d 0a 64 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 30 3e 62 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2d 63 2d 66 7d 29 2c 74 68 69 73 2e 66 6f 63 75 73 28 61 2c 62 29 29 3a 74 68 69 73 2e 66 6f 63 75 73 28 61 2c 74 68 69 73 2e 61 63 74 69 76 65 4d 65 6e 75 2e 66 69 6e 64 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 69 74 65 6d 73 29 5b 74 68 69 73 2e 61 63 74 69 76 65 3f 22 6c 61 73 74 22 3a 22 66 69 72 73 74 22 5d 28 29 29 29 3a 74 68 69 73 2e 6e 65 78 74 28 61 29 7d 2c 70 72 65 76 69 6f 75 73 50 61 67 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 2c 66 3b 74 68 69 73 2e 61 63 74 69 76 65 3f 74 68 69 73 2e 69 73 46 69 72 73 74 49 74 65 6d 28 29 7c 7c 28 74 68 69 73 2e 5f 68 61 73 53 63 72 Data Ascii: .each(function(){b=d(this);return 0>b.offset().top-c-f}),this.focus(a,b)):this.focus(a,this.activeMenu.find(this.options.items)[this.active?"last":"first"]())):this.next(a)},previousPage:function(a){var b,c,f;this.active?this.isFirstItem()\|\|(this._hasScr
2022-04-01 15:32:03 UTC	242	IN	Data Raw: 70 65 6e 64 54 6f 28 61 29 7d 2c 5f 6d 6f 76 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 74 68 69 73 2e 6d 65 6e 75 2e 65 6c 65 6d 65 6e 74 2e 69 73 28 22 3a 76 69 73 69 62 6c 65 22 29 29 69 66 28 74 68 69 73 2e 6d 65 6e 75 2e 69 73 46 69 72 73 74 49 74 65 6d 28 29 26 26 2f 5e 70 72 65 76 69 6f 75 73 2f 2e 74 65 73 74 28 61 29 7c 7c 74 68 69 73 2e 6d 65 6e 75 2e 69 73 4c 61 73 74 49 74 65 6d 28 29 26 26 2f 5e 6e 65 78 74 2f 2e 74 65 73 74 28 61 29 29 74 68 69 73 2e 69 73 4d 75 6c 74 69 4c 69 6e 65 7c 7c 74 68 69 73 2e 5f 76 61 6c 75 65 28 74 68 69 73 2e 74 65 72 6d 29 2c 74 68 69 73 2e 6d 65 6e 75 2e 62 6c 75 72 28 29 3b 65 6c 73 65 20 74 68 69 73 2e 6d 65 6e 75 5b 61 5d 28 62 29 3b 65 6c 73 65 20 74 68 69 73 2e 73 65 61 72 63 68 28 6e 75 6c Data Ascii: pendTo(a)},_move:function(a,b){if(this.menu.element.is(":visible"))if(this.menu.isFirstItem()&&/^previous/.test(a)\|\|this.menu.isLastItem()&&/^next/.test(a))this.isMultiLine\|\|this._value(this.term),this.menu.blur();else this.menu[a](b);else this.search(nul
2022-04-01 15:32:03 UTC	249	IN	Data Raw: 43 6c 61 73 73 28 74 68 69 73 2e 69 63 6f 6e 2c 6e 75 6c 6c 2c 22 75 69 2d 69 63 6f 6e 2d 62 6c 61 6e 6b 22 2c 21 61 29 3b 22 72 61 64 69 6f 22 3d 3d 3d 74 68 69 73 2e 74 79 70 65 26 26 74 68 69 73 2e 5f 67 65 74 52 61 64 69 6f 47 72 6f 75 70 28 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 64 28 74 68 69 73 29 2e 63 68 65 63 6b 62 6f 78 72 61 64 69 6f 28 22 69 6e 73 74 61 6e 63 65 22 29 3b 61 26 26 61 2e 5f 72 65 6d 6f 76 65 43 6c 61 73 73 28 61 2e 6c 61 62 65 6c 2c 22 75 69 2d 63 68 65 63 6b 62 6f 78 72 61 64 69 6f 2d 63 68 65 63 6b 65 64 22 2c 22 75 69 2d 73 74 61 74 65 2d 61 63 74 69 76 65 22 29 7d 29 7d 2c 0a 5f 64 65 73 74 72 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 75 6e 62 69 6e 64 46 6f 72 6d 52 65 73 Data Ascii: Class(this.icon,null,"ui-icon-blank",!a);"radio"===this.type&&this._getRadioGroup().each(function(){var a=d(this).checkboxradio("instance");a&&a._removeClass(a.label,"ui-checkboxradio-checked","ui-state-active")})},_destroy:function(){this._unbindFormRes
2022-04-01 15:32:03 UTC	257	IN	Data Raw: 79 44 6f 77 6e 29 2e 6f 6e 28 22 6b 65 79 70 72 65 73 73 22 2c 74 68 69 73 2e 5f 64 6f 4b 65 79 50 72 65 73 73 29 2e 6f 6e 28 22 6b 65 79 75 70 22 2c 74 68 69 73 2e 5f 64 6f 4b 65 79 55 70 29 2c 74 68 69 73 2e 5f 61 75 74 6f 53 69 7a 65 28 62 29 2c 64 2e 64 61 74 61 28 61 2c 22 64 61 74 65 70 69 63 6b 65 72 22 2c 62 29 2c 62 2e 73 65 74 74 69 6e 67 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 69 73 2e 5f 64 69 73 61 62 6c 65 44 61 74 65 70 69 63 6b 65 72 28 61 29 29 7d 2c 5f 61 74 74 61 63 68 6d 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 66 3b 63 3d 74 68 69 73 2e 5f 67 65 74 28 62 2c 22 61 70 70 65 6e 64 54 65 78 74 22 29 3b 76 61 72 20 65 3d 74 68 69 73 2e 5f 67 65 74 28 62 2c 22 69 73 52 54 4c 22 29 3b 62 2e 61 70 70 65 6e Data Ascii: yDown).on("keypress",this._doKeyPress).on("keyup",this._doKeyUp),this._autoSize(b),d.data(a,"datepicker",b),b.settings.disabled&&this._disableDatepicker(a))},_attachments:function(a,b){var c,f;c=this._get(b,"appendText");var e=this._get(b,"isRTL");b.appen
2022-04-01 15:32:03 UTC	265	IN	Data Raw: 21 31 7d 65 6c 73 65 20 33 36 3d 3d 3d 61 2e 6b 65 79 43 6f 64 65 26 26 61 2e 63 74 72 6c 4b 65 79 3f 64 2e 64 61 74 65 70 69 63 6b 65 72 2e 5f 73 68 6f 77 44 61 74 65 70 69 63 6b 65 72 28 74 68 69 73 29 3a 62 3d 21 31 3b 62 26 26 28 61 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 61 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 29 7d 2c 5f 64 6f 4b 65 79 50 72 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 3b 62 3d 64 2e 64 61 74 65 70 69 63 6b 65 72 2e 5f 67 65 74 49 6e 73 74 28 61 2e 74 61 72 67 65 74 29 3b 69 66 28 64 2e 64 61 74 65 70 69 63 6b 65 72 2e 5f 67 65 74 28 62 2c 22 63 6f 6e 73 74 72 61 69 6e 49 6e 70 75 74 22 29 29 72 65 74 75 72 6e 20 62 3d 64 2e 64 61 74 65 70 69 63 6b 65 72 2e 5f 70 6f 73 73 69 62 Data Ascii: !1}else 36===a.keyCode&&a.ctrlKey?d.datepicker._showDatepicker(this):b=!1;b&&(a.preventDefault(),a.stopPropagation())},_doKeyPress:function(a){var b,c;b=d.datepicker._getInst(a.target);if(d.datepicker._get(b,"constrainInput"))return b=d.datepicker._possib
2022-04-01 15:32:03 UTC	292	IN	Data Raw: 3c 61 2e 6c 65 6e 67 74 68 26 26 61 2e 63 68 61 72 41 74 28 66 2b 31 29 3d 3d 3d 62 29 26 26 66 2b 2b 3b 72 65 74 75 72 6e 20 62 7d 2c 76 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 75 28 61 29 2c 63 3d 22 40 22 3d 3d 3d 61 3f 31 34 3a 22 21 22 3d 3d 3d 61 3f 32 30 3a 0a 22 79 22 3d 3d 3d 61 26 26 63 3f 34 3a 22 6f 22 3d 3d 3d 61 3f 33 3a 32 3b 61 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 64 7b 22 2b 28 22 79 22 3d 3d 3d 61 3f 63 3a 31 29 2b 22 2c 22 2b 63 2b 22 7d 22 29 3b 61 3d 62 2e 73 75 62 73 74 72 69 6e 67 28 68 29 2e 6d 61 74 63 68 28 61 29 3b 69 66 28 21 61 29 74 68 72 6f 77 22 4d 69 73 73 69 6e 67 20 6e 75 6d 62 65 72 20 61 74 20 70 6f 73 69 74 69 6f 6e 20 22 2b 68 3b 68 2b 3d 61 5b 30 5d 2e 6c 65 6e 67 74 68 3b 72 65 74 75 72 Data Ascii: <a.length&&a.charAt(f+1)===b)&&f++;return b},v=function(a){var c=u(a),c="@"===a?14:"!"===a?20:"y"===a&&c?4:"o"===a?3:2;a=new RegExp("^\\d{"+("y"===a?c:1)+","+c+"}");a=b.substring(h).match(a);if(!a)throw"Missing number at position "+h;h+=a[0].length;retur
2022-04-01 15:32:03 UTC	300	IN	Data Raw: 73 74 4d 6f 6e 74 68 28 61 2c 31 2c 44 2c 41 29 3f 22 3c 61 20 63 6c 61 73 73 3d 27 75 69 2d 64 61 74 65 70 69 63 6b 65 72 2d 6e 65 78 74 20 75 69 2d 63 6f 72 6e 65 72 2d 61 6c 6c 27 20 64 61 74 61 2d 68 61 6e 64 6c 65 72 3d 27 6e 65 78 74 27 20 64 61 74 61 2d 65 76 65 6e 74 3d 27 63 6c 69 63 6b 27 20 74 69 74 6c 65 3d 27 22 2b 63 2b 22 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 27 75 69 2d 69 63 6f 6e 20 75 69 2d 69 63 6f 6e 2d 63 69 72 63 6c 65 2d 74 72 69 61 6e 67 6c 65 2d 22 2b 28 48 3f 22 77 22 3a 22 65 22 29 2b 22 27 3e 22 2b 63 2b 22 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 22 3a 64 3f 22 22 3a 22 3c 61 20 63 6c 61 73 73 3d 27 75 69 2d 64 61 74 65 70 69 63 6b 65 72 2d 6e 65 78 74 20 75 69 2d 63 6f 72 6e 65 72 2d 61 6c 6c 20 75 69 2d 73 74 61 74 65 2d 64 69 Data Ascii: stMonth(a,1,D,A)?"<a class='ui-datepicker-next ui-corner-all' data-handler='next' data-event='click' title='"+c+"'><span class='ui-icon ui-icon-circle-triangle-"+(H?"w":"e")+"'>"+c+"</span></a>":d?"":"<a class='ui-datepicker-next ui-corner-all ui-state-di
2022-04-01 15:32:03 UTC	308	IN	Data Raw: 69 64 67 65 74 22 3d 3d 3d 61 29 7c 7c 22 6f 70 74 69 6f 6e 22 3d 3d 3d 61 26 26 32 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 64 2e 64 61 74 65 70 69 63 6b 65 72 5b 22 5f 22 2b 61 2b 22 44 61 74 65 70 69 63 6b 65 72 22 5d 2e 61 70 70 6c 79 28 64 2e 64 61 74 65 70 69 63 6b 65 72 2c 5b 74 68 69 73 5b 30 5d 5d 2e 63 6f 6e 63 61 74 28 62 29 29 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 3f 64 2e 64 61 74 65 70 69 63 6b 65 72 5b 22 5f 22 2b 61 2b 22 44 61 74 65 70 69 63 6b 65 72 22 5d 2e 61 70 70 6c 79 28 64 2e 64 61 74 65 70 69 63 6b 65 72 2c 5b 74 68 69 73 5d 2e 63 6f Data Ascii: idget"===a)\|\|"option"===a&&2===arguments.length&&"string"===typeof arguments[1]?d.datepicker["_"+a+"Datepicker"].apply(d.datepicker,[this[0]].concat(b)):this.each(function(){"string"===typeof a?d.datepicker["_"+a+"Datepicker"].apply(d.datepicker,[this].co
2022-04-01 15:32:03 UTC	315	IN	Data Raw: 26 74 68 69 73 2e 5f 63 6c 65 61 72 28 29 3b 72 65 74 75 72 6e 21 31 7d 2c 5f 6d 6f 75 73 65 55 70 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 5f 75 6e 62 6c 6f 63 6b 46 72 61 6d 65 73 28 29 3b 64 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 26 26 64 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 61 67 53 74 6f 70 28 74 68 69 73 2c 0a 61 29 3b 74 68 69 73 2e 68 61 6e 64 6c 65 45 6c 65 6d 65 6e 74 2e 69 73 28 61 2e 74 61 72 67 65 74 29 26 26 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 74 72 69 67 67 65 72 28 22 66 6f 63 75 73 22 29 3b 72 65 74 75 72 6e 20 64 2e 75 69 2e 6d 6f 75 73 65 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 6d 6f 75 73 65 55 70 2e 63 61 6c 6c 28 74 68 69 73 2c 61 29 7d 2c 63 61 6e 63 65 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 68 Data Ascii: &this._clear();return!1},_mouseUp:function(a){this._unblockFrames();d.ui.ddmanager&&d.ui.ddmanager.dragStop(this,a);this.handleElement.is(a.target)&&this.element.trigger("focus");return d.ui.mouse.prototype._mouseUp.call(this,a)},cancel:function(){this.h
2022-04-01 15:32:03 UTC	323	IN	Data Raw: 2e 63 73 73 28 22 74 6f 70 22 29 2c 6c 65 66 74 3a 74 68 69 73 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 73 73 28 22 6c 65 66 74 22 29 7d 2c 74 68 69 73 2e 5f 6d 6f 75 73 65 53 74 6f 70 28 61 29 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 68 65 6c 70 65 72 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 5f 68 65 6c 70 65 72 29 3a 28 74 68 69 73 2e 63 61 6e 63 65 6c 48 65 6c 70 65 72 52 65 6d 6f 76 61 6c 3d 21 30 2c 74 68 69 73 2e 5f 74 72 69 67 67 65 72 28 22 64 65 61 63 74 69 76 61 74 65 22 2c 61 2c 66 29 29 7d 29 7d 2c 64 72 61 67 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 64 2e 65 61 63 68 28 63 2e 73 6f 72 74 61 62 6c 65 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 66 3d 21 31 2c 65 3d 74 68 69 73 3b 65 2e 70 6f 73 69 74 69 6f 6e 41 62 73 3d 63 Data Ascii: .css("top"),left:this.placeholder.css("left")},this._mouseStop(a),this.options.helper=this.options._helper):(this.cancelHelperRemoval=!0,this._trigger("deactivate",a,f))})},drag:function(a,b,c){d.each(c.sortables,function(){var f=!1,e=this;e.positionAbs=c
2022-04-01 15:32:03 UTC	327	IN	Data Raw: 6c 65 66 74 7d 29 7d 29 7d 2c 0a 64 72 61 67 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 66 2c 65 2c 67 2c 68 2c 6b 2c 6c 2c 6d 2c 6e 2c 70 2c 71 2c 74 3d 63 2e 6f 70 74 69 6f 6e 73 2c 72 3d 74 2e 73 6e 61 70 54 6f 6c 65 72 61 6e 63 65 2c 75 3d 62 2e 6f 66 66 73 65 74 2e 6c 65 66 74 2c 76 3d 75 2b 63 2e 68 65 6c 70 65 72 50 72 6f 70 6f 72 74 69 6f 6e 73 2e 77 69 64 74 68 2c 77 3d 62 2e 6f 66 66 73 65 74 2e 74 6f 70 2c 78 3d 77 2b 63 2e 68 65 6c 70 65 72 50 72 6f 70 6f 72 74 69 6f 6e 73 2e 68 65 69 67 68 74 3b 66 6f 72 28 70 3d 63 2e 73 6e 61 70 45 6c 65 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2d 31 3b 30 3c 3d 70 3b 70 2d 2d 29 6b 3d 63 2e 73 6e 61 70 45 6c 65 6d 65 6e 74 73 5b 70 5d 2e 6c 65 66 74 2d 63 2e 6d 61 72 67 69 6e 73 2e 6c 65 66 Data Ascii: left})})},drag:function(a,b,c){var f,e,g,h,k,l,m,n,p,q,t=c.options,r=t.snapTolerance,u=b.offset.left,v=u+c.helperProportions.width,w=b.offset.top,x=w+c.helperProportions.height;for(p=c.snapElements.length-1;0<=p;p--)k=c.snapElements[p].left-c.margins.lef
2022-04-01 15:32:03 UTC	335	IN	Data Raw: 74 79 70 65 6f 66 20 66 2e 61 73 70 65 63 74 52 61 74 69 6f 3f 66 2e 61 73 70 65 63 74 52 61 74 69 6f 3a 74 68 69 73 2e 6f 72 69 67 69 6e 61 6c 53 69 7a 65 2e 77 69 64 74 68 2f 74 68 69 73 2e 6f 72 69 67 69 6e 61 6c 53 69 7a 65 2e 68 65 69 67 68 74 7c 7c 31 3b 62 3d 64 28 22 2e 75 69 2d 72 65 73 69 7a 61 62 6c 65 2d 22 2b 74 68 69 73 2e 61 78 69 73 29 2e 63 73 73 28 22 63 75 72 73 6f 72 22 29 3b 64 28 22 62 6f 64 79 22 29 2e 63 73 73 28 22 63 75 72 73 6f 72 22 2c 22 61 75 74 6f 22 3d 3d 3d 62 3f 74 68 69 73 2e 61 78 69 73 2b 22 2d 72 65 73 69 7a 65 22 3a 62 29 3b 74 68 69 73 2e 5f 61 64 64 43 6c 61 73 73 28 22 75 69 2d 72 65 73 69 7a 61 62 6c 65 2d 72 65 73 69 7a 69 6e 67 22 29 3b 74 68 69 73 2e 5f 70 72 6f 70 61 67 61 74 65 28 22 73 74 61 72 74 22 2c 61 Data Ascii: typeof f.aspectRatio?f.aspectRatio:this.originalSize.width/this.originalSize.height\|\|1;b=d(".ui-resizable-"+this.axis).css("cursor");d("body").css("cursor","auto"===b?this.axis+"-resize":b);this._addClass("ui-resizable-resizing");this._propagate("start",a
2022-04-01 15:32:03 UTC	338	IN	Data Raw: 65 73 74 28 63 29 2c 63 3d 2f 6e 77 7c 6e 65 7c 6e 2f 2e 74 65 73 74 28 63 29 3b 67 26 26 28 61 2e 77 69 64 74 68 3d 62 2e 6d 69 6e 57 69 64 74 68 29 3b 68 26 26 28 61 2e 68 65 69 67 68 74 3d 62 2e 6d 69 6e 48 65 69 67 68 74 29 3b 64 26 26 28 61 2e 77 69 64 74 68 3d 62 2e 6d 61 78 57 69 64 74 68 29 3b 65 26 26 28 61 2e 68 65 69 67 68 74 3d 62 2e 6d 61 78 48 65 69 67 68 74 29 3b 67 26 26 6d 26 26 28 61 2e 6c 65 66 74 3d 6b 2d 62 2e 6d 69 6e 57 69 64 74 68 29 3b 64 26 26 6d 26 26 28 61 2e 6c 65 66 74 3d 6b 2d 62 2e 6d 61 78 57 69 64 74 68 29 3b 68 26 26 63 26 26 28 61 2e 74 6f 70 3d 6c 2d 62 2e 6d 69 6e 48 65 69 67 68 74 29 3b 65 26 26 63 26 26 28 61 2e 74 6f 70 3d 6c 2d 62 2e 6d 61 78 48 65 69 67 68 74 29 3b 0a 61 2e 77 69 64 74 68 7c 7c 61 2e 68 65 69 67 Data Ascii: est(c),c=/nw\|ne\|n/.test(c);g&&(a.width=b.minWidth);h&&(a.height=b.minHeight);d&&(a.width=b.maxWidth);e&&(a.height=b.maxHeight);g&&m&&(a.left=k-b.minWidth);d&&m&&(a.left=k-b.maxWidth);h&&c&&(a.top=l-b.minHeight);e&&c&&(a.top=l-b.maxHeight);a.width\|\|a.heig
2022-04-01 15:32:03 UTC	346	IN	Data Raw: 29 7d 7d 29 3b 64 2e 75 69 2e 70 6c 75 67 69 6e 2e 61 64 64 28 22 72 65 73 69 7a 61 62 6c 65 22 2c 22 67 72 69 64 22 2c 7b 72 65 73 69 7a 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 0a 62 3d 64 28 74 68 69 73 29 2e 72 65 73 69 7a 61 62 6c 65 28 22 69 6e 73 74 61 6e 63 65 22 29 2c 63 3d 62 2e 6f 70 74 69 6f 6e 73 2c 66 3d 62 2e 73 69 7a 65 2c 65 3d 62 2e 6f 72 69 67 69 6e 61 6c 53 69 7a 65 2c 67 3d 62 2e 6f 72 69 67 69 6e 61 6c 50 6f 73 69 74 69 6f 6e 2c 68 3d 62 2e 61 78 69 73 2c 6b 3d 22 6e 75 6d 62 65 72 22 3d 3d 3d 74 79 70 65 6f 66 20 63 2e 67 72 69 64 3f 5b 63 2e 67 72 69 64 2c 63 2e 67 72 69 64 5d 3a 63 2e 67 72 69 64 2c 6c 3d 6b 5b 30 5d 7c 7c 31 2c 6d 3d 6b 5b 31 5d 7c 7c 31 2c 6e 3d 4d 61 74 68 2e 72 6f 75 6e 64 28 28 66 2e 77 69 64 Data Ascii: )}});d.ui.plugin.add("resizable","grid",{resize:function(){var a,b=d(this).resizable("instance"),c=b.options,f=b.size,e=b.originalSize,g=b.originalPosition,h=b.axis,k="number"===typeof c.grid?[c.grid,c.grid]:c.grid,l=k[0]\|\|1,m=k[1]\|\|1,n=Math.round((f.wid
2022-04-01 15:32:03 UTC	354	IN	Data Raw: 44 69 61 6c 6f 67 2c 22 75 69 2d 64 69 61 6c 6f 67 2d 62 75 74 74 6f 6e 73 22 29 2c 0a 74 68 69 73 2e 75 69 44 69 61 6c 6f 67 42 75 74 74 6f 6e 50 61 6e 65 2e 61 70 70 65 6e 64 54 6f 28 74 68 69 73 2e 75 69 44 69 61 6c 6f 67 29 29 7d 2c 5f 6d 61 6b 65 44 72 61 67 67 61 62 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 72 65 74 75 72 6e 7b 70 6f 73 69 74 69 6f 6e 3a 61 2e 70 6f 73 69 74 69 6f 6e 2c 6f 66 66 73 65 74 3a 61 2e 6f 66 66 73 65 74 7d 7d 76 61 72 20 62 3d 74 68 69 73 2c 63 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 3b 74 68 69 73 2e 75 69 44 69 61 6c 6f 67 2e 64 72 61 67 67 61 62 6c 65 28 7b 63 61 6e 63 65 6c 3a 22 2e 75 69 2d 64 69 61 6c 6f 67 2d 63 6f 6e 74 65 6e 74 2c 20 2e 75 69 2d 64 69 61 6c 6f 67 2d 74 69 Data Ascii: Dialog,"ui-dialog-buttons"),this.uiDialogButtonPane.appendTo(this.uiDialog))},_makeDraggable:function(){function a(a){return{position:a.position,offset:a.offset}}var b=this,c=this.options;this.uiDialog.draggable({cancel:".ui-dialog-content, .ui-dialog-ti
2022-04-01 15:32:03 UTC	362	IN	Data Raw: 29 2c 74 68 69 73 2e 5f 72 65 6d 6f 76 65 48 6f 76 65 72 43 6c 61 73 73 28 29 2c 74 68 69 73 2e 5f 74 72 69 67 67 65 72 28 22 64 72 6f 70 22 2c 61 2c 74 68 69 73 2e 75 69 28 63 29 29 2c 74 68 69 73 2e 65 6c 65 6d 65 6e 74 29 3a 21 31 7d 2c 75 69 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 7b 64 72 61 67 67 61 62 6c 65 3a 61 2e 63 75 72 72 65 6e 74 49 74 65 6d 7c 7c 61 2e 65 6c 65 6d 65 6e 74 2c 68 65 6c 70 65 72 3a 61 2e 68 65 6c 70 65 72 2c 70 6f 73 69 74 69 6f 6e 3a 61 2e 70 6f 73 69 74 69 6f 6e 2c 6f 66 66 73 65 74 3a 61 2e 70 6f 73 69 74 69 6f 6e 41 62 73 7d 7d 2c 5f 61 64 64 48 6f 76 65 72 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 61 64 64 43 6c 61 73 73 28 22 75 69 2d 64 72 6f 70 70 61 62 6c 65 2d 68 6f 76 65 Data Ascii: ),this._removeHoverClass(),this._trigger("drop",a,this.ui(c)),this.element):!1},ui:function(a){return{draggable:a.currentItem\|\|a.element,helper:a.helper,position:a.position,offset:a.positionAbs}},_addHoverClass:function(){this._addClass("ui-droppable-hove
2022-04-01 15:32:03 UTC	369	IN	Data Raw: 20 63 2c 65 3d 64 2e 64 61 74 61 28 74 68 69 73 2c 22 73 65 6c 65 63 74 61 62 6c 65 2d 69 74 65 6d 22 29 3b 69 66 28 65 29 72 65 74 75 72 6e 20 63 3d 21 61 2e 6d 65 74 61 4b 65 79 26 26 21 61 2e 63 74 72 6c 4b 65 79 7c 7c 21 65 2e 24 65 6c 65 6d 65 6e 74 2e 68 61 73 43 6c 61 73 73 28 22 75 69 2d 73 65 6c 65 63 74 65 64 22 29 2c 62 2e 5f 72 65 6d 6f 76 65 43 6c 61 73 73 28 65 2e 24 65 6c 65 6d 65 6e 74 2c 63 3f 22 75 69 2d 75 6e 73 65 6c 65 63 74 69 6e 67 22 3a 22 75 69 2d 73 65 6c 65 63 74 65 64 22 29 2e 5f 61 64 64 43 6c 61 73 73 28 65 2e 24 65 6c 65 6d 65 6e 74 2c 63 3f 22 75 69 2d 73 65 6c 65 63 74 69 6e 67 22 3a 22 75 69 2d 75 6e 73 65 6c 65 63 74 69 6e 67 22 29 2c 0a 65 2e 75 6e 73 65 6c 65 63 74 69 6e 67 3d 21 63 2c 65 2e 73 65 6c 65 63 74 69 6e 67 Data Ascii: c,e=d.data(this,"selectable-item");if(e)return c=!a.metaKey&&!a.ctrlKey\|\|!e.$element.hasClass("ui-selected"),b._removeClass(e.$element,c?"ui-unselecting":"ui-selected")._addClass(e.$element,c?"ui-selecting":"ui-unselecting"),e.unselecting=!c,e.selecting
2022-04-01 15:32:03 UTC	370	IN	Data Raw: 65 2c 74 6f 70 3a 67 2c 77 69 64 74 68 3a 68 2d 65 2c 68 65 69 67 68 74 3a 6b 2d 67 7d 29 3b 74 68 69 73 2e 73 65 6c 65 63 74 65 65 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 64 2e 64 61 74 61 28 74 68 69 73 2c 22 73 65 6c 65 63 74 61 62 6c 65 2d 69 74 65 6d 22 29 2c 6d 3d 21 31 2c 6e 2c 70 2c 71 2c 74 3b 62 26 26 62 2e 65 6c 65 6d 65 6e 74 21 3d 3d 63 2e 65 6c 65 6d 65 6e 74 5b 30 5d 26 26 28 6e 3d 0a 62 2e 6c 65 66 74 2b 63 2e 65 6c 65 6d 65 6e 74 50 6f 73 2e 6c 65 66 74 2c 70 3d 62 2e 72 69 67 68 74 2b 63 2e 65 6c 65 6d 65 6e 74 50 6f 73 2e 6c 65 66 74 2c 71 3d 62 2e 74 6f 70 2b 63 2e 65 6c 65 6d 65 6e 74 50 6f 73 2e 74 6f 70 2c 74 3d 62 2e 62 6f 74 74 6f 6d 2b 63 2e 65 6c 65 6d 65 6e 74 50 6f 73 2e 74 6f 70 2c 22 74 6f 75 Data Ascii: e,top:g,width:h-e,height:k-g});this.selectees.each(function(){var b=d.data(this,"selectable-item"),m=!1,n,p,q,t;b&&b.element!==c.element[0]&&(n=b.left+c.elementPos.left,p=b.right+c.elementPos.left,q=b.top+c.elementPos.top,t=b.bottom+c.elementPos.top,"tou
2022-04-01 15:32:03 UTC	378	IN	Data Raw: 73 65 20 64 2e 75 69 2e 6b 65 79 43 6f 64 65 2e 4c 45 46 54 3a 74 68 69 73 2e 5f 6d 6f 76 65 28 22 70 72 65 76 22 2c 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 64 2e 75 69 2e 6b 65 79 43 6f 64 65 2e 52 49 47 48 54 3a 74 68 69 73 2e 5f 6d 6f 76 65 28 22 6e 65 78 74 22 2c 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 64 2e 75 69 2e 6b 65 79 43 6f 64 65 2e 48 4f 4d 45 3a 63 61 73 65 20 64 2e 75 69 2e 6b 65 79 43 6f 64 65 2e 50 41 47 45 5f 55 50 3a 74 68 69 73 2e 5f 6d 6f 76 65 28 22 66 69 72 73 74 22 2c 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 64 2e 75 69 2e 6b 65 79 43 6f 64 65 2e 45 4e 44 3a 63 61 73 65 20 64 2e 75 69 2e 6b 65 79 43 6f 64 65 2e 50 41 47 45 5f 44 4f 57 4e 3a 74 68 69 73 2e 5f 6d 6f 76 65 28 22 6c 61 73 74 22 2c 61 29 3b 62 72 65 61 6b 3b 64 65 Data Ascii: se d.ui.keyCode.LEFT:this._move("prev",a);break;case d.ui.keyCode.RIGHT:this._move("next",a);break;case d.ui.keyCode.HOME:case d.ui.keyCode.PAGE_UP:this._move("first",a);break;case d.ui.keyCode.END:case d.ui.keyCode.PAGE_DOWN:this._move("last",a);break;de
2022-04-01 15:32:03 UTC	385	IN	Data Raw: 73 2e 76 61 6c 75 65 3d 74 68 69 73 2e 5f 74 72 69 6d 41 6c 69 67 6e 56 61 6c 75 65 28 61 29 2c 74 68 69 73 2e 5f 72 65 66 72 65 73 68 56 61 6c 75 65 28 29 2c 74 68 69 73 2e 5f 63 68 61 6e 67 65 28 6e 75 6c 6c 2c 30 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 76 61 6c 75 65 28 29 7d 2c 76 61 6c 75 65 73 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 66 2c 65 3b 69 66 28 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 76 61 6c 75 65 73 5b 61 5d 3d 74 68 69 73 2e 5f 74 72 69 6d 41 6c 69 67 6e 56 61 6c 75 65 28 62 29 2c 74 68 69 73 2e 5f 72 65 66 72 65 73 68 56 61 6c 75 65 28 29 2c 74 68 69 73 2e 5f 63 68 61 6e 67 65 28 6e 75 6c 6c 2c 61 29 3b 65 6c 73 65 20 69 66 28 61 72 67 75 Data Ascii: s.value=this._trimAlignValue(a),this._refreshValue(),this._change(null,0);else return this._value()},values:function(a,b){var c,f,e;if(1<arguments.length)this.options.values[a]=this._trimAlignValue(b),this._refreshValue(),this._change(null,a);else if(argu
2022-04-01 15:32:03 UTC	393	IN	Data Raw: 6f 70 3a 61 2e 70 61 67 65 59 2d 74 68 69 73 2e 6f 66 66 73 65 74 2e 74 6f 70 7d 2c 70 61 72 65 6e 74 3a 74 68 69 73 2e 5f 67 65 74 50 61 72 65 6e 74 4f 66 66 73 65 74 28 29 2c 72 65 6c 61 74 69 76 65 3a 74 68 69 73 2e 5f 67 65 74 52 65 6c 61 74 69 76 65 4f 66 66 73 65 74 28 29 7d 29 3b 74 68 69 73 2e 68 65 6c 70 65 72 2e 63 73 73 28 22 70 6f 73 69 74 69 6f 6e 22 2c 22 61 62 73 6f 6c 75 74 65 22 29 3b 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 3d 74 68 69 73 2e 68 65 6c 70 65 72 2e 63 73 73 28 22 70 6f 73 69 74 69 6f 6e 22 29 3b 74 68 69 73 2e 6f 72 69 67 69 6e 61 6c 50 6f 73 69 74 69 6f 6e 3d 74 68 69 73 2e 5f 67 65 6e 65 72 61 74 65 50 6f 73 69 74 69 6f 6e 28 61 29 3b 74 68 69 73 2e 6f 72 69 67 69 6e 61 6c 50 61 67 65 58 3d 61 2e 70 61 67 65 58 3b Data Ascii: op:a.pageY-this.offset.top},parent:this._getParentOffset(),relative:this._getRelativeOffset()});this.helper.css("position","absolute");this.cssPosition=this.helper.css("position");this.originalPosition=this._generatePosition(a);this.originalPageX=a.pageX;
2022-04-01 15:32:04 UTC	402	IN	Data Raw: 69 73 2e 6f 70 74 69 6f 6e 73 3b 72 65 74 75 72 6e 20 61 2e 63 6f 6e 6e 65 63 74 57 69 74 68 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 74 72 69 6e 67 3f 5b 61 2e 63 6f 6e 6e 65 63 74 57 69 74 68 5d 3a 0a 61 2e 63 6f 6e 6e 65 63 74 57 69 74 68 7d 2c 5f 67 65 74 49 74 65 6d 73 41 73 6a 51 75 65 72 79 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 67 2e 70 75 73 68 28 74 68 69 73 29 7d 76 61 72 20 63 2c 66 2c 65 2c 67 3d 5b 5d 2c 68 3d 5b 5d 2c 6b 3d 74 68 69 73 2e 5f 63 6f 6e 6e 65 63 74 57 69 74 68 28 29 3b 69 66 28 6b 26 26 61 29 66 6f 72 28 61 3d 6b 2e 6c 65 6e 67 74 68 2d 31 3b 30 3c 3d 61 3b 61 2d 2d 29 66 6f 72 28 66 3d 64 28 6b 5b 61 5d 2c 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 29 2c 63 3d 66 2e 6c 65 6e Data Ascii: is.options;return a.connectWith.constructor===String?[a.connectWith]:a.connectWith},_getItemsAsjQuery:function(a){function b(){g.push(this)}var c,f,e,g=[],h=[],k=this._connectWith();if(k&&a)for(a=k.length-1;0<=a;a--)for(f=d(k[a],this.document[0]),c=f.len
2022-04-01 15:32:04 UTC	410	IN	Data Raw: 74 68 69 73 2e 68 65 6c 70 65 72 50 72 6f 70 6f 72 74 69 6f 6e 73 3d 7b 77 69 64 74 68 3a 74 68 69 73 2e 68 65 6c 70 65 72 2e 6f 75 74 65 72 57 69 64 74 68 28 29 2c 68 65 69 67 68 74 3a 74 68 69 73 2e 68 65 6c 70 65 72 2e 6f 75 74 65 72 48 65 69 67 68 74 28 29 7d 7d 2c 5f 73 65 74 43 6f 6e 74 61 69 6e 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 62 2c 63 3b 62 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 3b 22 70 61 72 65 6e 74 22 3d 3d 3d 62 2e 63 6f 6e 74 61 69 6e 6d 65 6e 74 26 26 28 62 2e 63 6f 6e 74 61 69 6e 6d 65 6e 74 3d 74 68 69 73 2e 68 65 6c 70 65 72 5b 30 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 29 3b 69 66 28 22 64 6f 63 75 6d 65 6e 74 22 3d 3d 3d 62 2e 63 6f 6e 74 61 69 6e 6d 65 6e 74 7c 7c 22 77 69 6e 64 6f 77 22 3d 3d 3d 62 2e 63 Data Ascii: this.helperProportions={width:this.helper.outerWidth(),height:this.helper.outerHeight()}},_setContainment:function(){var a,b,c;b=this.options;"parent"===b.containment&&(b.containment=this.helper[0].parentNode);if("document"===b.containment\|\|"window"===b.c
2022-04-01 15:32:04 UTC	417	IN	Data Raw: 65 64 6f 77 6e 20 2e 75 69 2d 73 70 69 6e 6e 65 72 2d 62 75 74 74 6f 6e 22 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 74 68 69 73 2e 65 6c 65 6d 65 6e 74 5b 30 5d 21 3d 3d 64 2e 75 69 2e 73 61 66 65 41 63 74 69 76 65 45 6c 65 6d 65 6e 74 28 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 29 26 26 28 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 74 72 69 67 67 65 72 28 22 66 6f 63 75 73 22 29 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 3d 63 2c 74 68 69 73 2e 5f 64 65 6c 61 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 70 72 65 76 69 6f 75 73 3d 63 7d 29 29 7d 76 61 72 20 63 3b 63 3d 74 68 69 73 2e 65 6c 65 6d 65 6e 74 5b 30 5d 3d 3d 3d 64 2e 75 69 2e 73 61 66 65 41 63 74 69 76 65 45 6c 65 6d 65 6e 74 28 74 68 69 73 2e 64 Data Ascii: edown .ui-spinner-button":function(a){function b(){this.element[0]!==d.ui.safeActiveElement(this.document[0])&&(this.element.trigger("focus"),this.previous=c,this._delay(function(){this.previous=c}))}var c;c=this.element[0]===d.ui.safeActiveElement(this.d
2022-04-01 15:32:04 UTC	425	IN	Data Raw: 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 61 63 74 69 76 61 74 69 6e 67 29 3b 63 3d 74 68 69 73 2e 5f 66 6f 63 75 73 4e 65 78 74 54 61 62 28 63 2c 66 29 3b 61 2e 63 74 72 6c 4b 65 79 7c 7c 61 2e 6d 65 74 61 4b 65 79 7c 7c 28 62 2e 61 74 74 72 28 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 2c 22 66 61 6c 73 65 22 29 2c 74 68 69 73 2e 74 61 62 73 2e 65 71 28 63 29 2e 61 74 74 72 28 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 2c 22 74 72 75 65 22 29 2c 0a 74 68 69 73 2e 61 63 74 69 76 61 74 69 6e 67 3d 74 68 69 73 2e 5f 64 65 6c 61 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 28 22 61 63 74 69 76 65 22 2c 63 29 7d 2c 74 68 69 73 2e 64 65 6c 61 79 29 29 7d 7d 2c 5f 70 61 6e Data Ascii: eventDefault();clearTimeout(this.activating);c=this._focusNextTab(c,f);a.ctrlKey\|\|a.metaKey\|\|(b.attr("aria-selected","false"),this.tabs.eq(c).attr("aria-selected","true"),this.activating=this._delay(function(){this.option("active",c)},this.delay))}},_pan
2022-04-01 15:32:04 UTC	427	IN	Data Raw: 2e 61 63 74 69 76 65 3d 64 28 29 29 3b 74 68 69 73 2e 5f 72 65 66 72 65 73 68 28 29 7d 2c 5f 72 65 66 72 65 73 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 73 65 74 4f 70 74 69 6f 6e 44 69 73 61 62 6c 65 64 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 29 3b 74 68 69 73 2e 5f 73 65 74 75 70 45 76 65 6e 74 73 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 76 65 6e 74 29 3b 74 68 69 73 2e 5f 73 65 74 75 70 48 65 69 67 68 74 53 74 79 6c 65 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 68 65 69 67 68 74 53 74 79 6c 65 29 3b 74 68 69 73 2e 74 61 62 73 2e 6e 6f 74 28 74 68 69 73 2e 61 63 74 69 76 65 29 2e 61 74 74 72 28 7b 22 61 72 69 61 2d 73 65 6c 65 63 74 65 64 22 3a 22 66 61 6c 73 65 22 2c 22 61 72 69 61 2d 65 78 70 61 6e 64 65 64 Data Ascii: .active=d());this._refresh()},_refresh:function(){this._setOptionDisabled(this.options.disabled);this._setupEvents(this.options.event);this._setupHeightStyle(this.options.heightStyle);this.tabs.not(this.active).attr({"aria-selected":"false","aria-expanded
2022-04-01 15:32:04 UTC	434	IN	Data Raw: 6d 73 3a 22 5b 74 69 74 6c 65 5d 3a 6e 6f 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 22 2c 70 6f 73 69 74 69 6f 6e 3a 7b 6d 79 3a 22 6c 65 66 74 20 74 6f 70 2b 31 35 22 2c 61 74 3a 22 6c 65 66 74 20 62 6f 74 74 6f 6d 22 2c 63 6f 6c 6c 69 73 69 6f 6e 3a 22 66 6c 69 70 66 69 74 20 66 6c 69 70 22 7d 2c 73 68 6f 77 3a 21 30 2c 74 72 61 63 6b 3a 21 31 2c 63 6c 6f 73 65 3a 6e 75 6c 6c 2c 6f 70 65 6e 3a 6e 75 6c 6c 7d 2c 5f 61 64 64 44 65 73 63 72 69 62 65 64 42 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 28 61 2e 61 74 74 72 28 22 61 72 69 61 2d 64 65 73 63 72 69 62 65 64 62 79 22 29 7c 7c 22 22 29 2e 73 70 6c 69 74 28 2f 5c 73 2b 2f 29 3b 63 2e 70 75 73 68 28 62 29 3b 61 2e 64 61 74 61 28 22 75 69 2d 74 6f 6f 6c 74 69 70 2d 69 64 22 2c 62 29 Data Ascii: ms:"[title]:not([disabled])",position:{my:"left top+15",at:"left bottom",collision:"flipfit flip"},show:!0,track:!1,close:null,open:null},_addDescribedBy:function(a,b){var c=(a.attr("aria-describedby")\|\|"").split(/\s+/);c.push(b);a.data("ui-tooltip-id",b)

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49778	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:03 UTC	50	OUT	GET /logon/LogonPoint/receiver/js/external/jquery.ui.touch-punch.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:03 UTC	73	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:34:44 GMT ETag: "449-5c7402a3c9100" Accept-Ranges: bytes Content-Length: 1097 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:03 UTC	73	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 61 2c 63 29 7b 69 66 28 21 28 31 3c 61 2e 6f 72 69 67 69 6e 61 6c 45 76 65 6e 74 2e 74 6f 75 63 68 65 73 2e 6c 65 6e 67 74 68 29 29 7b 61 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 76 61 72 20 62 3d 61 2e 6f 72 69 67 69 6e 61 6c 45 76 65 6e 74 2e 63 68 61 6e 67 65 64 54 6f 75 63 68 65 73 5b 30 5d 2c 64 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 64 2e 69 6e 69 74 4d 6f 75 73 65 45 76 65 6e 74 28 63 2c 21 30 2c 21 30 2c 77 69 6e 64 6f 77 2c 31 2c 62 2e 73 63 72 65 65 6e 58 2c 62 2e 73 63 72 65 65 6e 59 2c 62 2e 63 6c 69 65 6e 74 58 2c 62 2e 63 6c 69 65 6e 74 59 2c 21 31 2c 21 31 2c 21 31 2c 21 31 2c 30 2c 6e Data Ascii: (function(c){function b(a,c){if(!(1<a.originalEvent.touches.length)){a.preventDefault();var b=a.originalEvent.changedTouches[0],d=document.createEvent("MouseEvents");d.initMouseEvent(c,!0,!0,window,1,b.screenX,b.screenY,b.clientX,b.clientY,!1,!1,!1,!1,0,n

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49780	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:03 UTC	50	OUT	GET /logon/LogonPoint/receiver/js/external/jquery-migrate.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:03 UTC	82	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:34:41 GMT ETag: "20d6-5c7402a0eca40" Accept-Ranges: bytes Content-Length: 8406 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:03 UTC	90	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 77 69 6e 64 6f 77 2c 61 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 28 72 65 71 75 69 72 65 28 22 6a 71 75 65 72 79 22 29 2c 77 69 6e 64 6f 77 29 3a 61 28 6a 51 75 65 72 79 2c 77 69 6e 64 6f 77 29 7d 29 28 66 75 6e 63 74 69 6f 6e 28 61 2c 67 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 63 29 7b 76 61 72 20 62 3d 67 2e 63 6f 6e 73 6f 6c 65 3b 71 5b 63 5d 7c 7c 28 71 5b 63 5d 3d 21 30 2c 61 2e 6d 69 67 72 61 74 65 57 61 72 6e Data Ascii: (function(a){"function"===typeof define&&define.amd?define(["jquery"],window,a):"object"===typeof module&&module.exports?module.exports=a(require("jquery"),window):a(jQuery,window)})(function(a,g){function e(c){var b=g.console;q[c]\|\|(q[c]=!0,a.migrateWarn
2022-04-01 15:32:03 UTC	98	IN	Data Raw: 6f 69 64 20 30 3d 3d 3d 62 26 26 64 26 26 28 65 28 22 6a 51 75 65 72 79 2e 70 61 72 61 6d 28 29 20 6e 6f 20 6c 6f 6e 67 65 72 20 75 73 65 73 20 6a 51 75 65 72 79 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 74 72 61 64 69 74 69 6f 6e 61 6c 22 29 2c 62 3d 64 29 3b 72 65 74 75 72 6e 20 4a 2e 63 61 6c 6c 28 74 68 69 73 2c 63 2c 62 29 7d 3b 76 61 72 20 4b 3d 61 2e 66 6e 2e 61 6e 64 53 65 6c 66 7c 7c 61 2e 66 6e 2e 61 64 64 42 61 63 6b 3b 61 2e 66 6e 2e 61 6e 64 53 65 6c 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 65 28 22 6a 51 75 65 72 79 2e 66 6e 2e 61 6e 64 53 65 6c 66 28 29 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 72 65 6d 6f 76 65 64 2c 20 75 73 65 20 6a 51 75 65 72 79 2e 66 6e 2e 61 64 64 42 61 63 6b 28 29 22 29 3b 72 65 74 75 72 6e 20 4b 2e 61 Data Ascii: oid 0===b&&d&&(e("jQuery.param() no longer uses jQuery.ajaxSettings.traditional"),b=d);return J.call(this,c,b)};var K=a.fn.andSelf\|\|a.fn.addBack;a.fn.andSelf=function(){e("jQuery.fn.andSelf() is deprecated and removed, use jQuery.fn.addBack()");return K.a

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49781	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:03 UTC	51	OUT	GET /logon/LogonPoint/init.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:03 UTC	67	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 15:49:01 GMT ETag: "1612-5c73f86bdb540" Accept-Ranges: bytes Content-Length: 5650 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:03 UTC	67	IN	Data Raw: 2f 2f 20 43 61 6c 63 75 6c 61 74 65 73 20 74 68 65 20 6d 69 6e 69 6d 75 6d 20 77 69 64 74 68 20 74 68 61 74 20 77 6f 75 6c 64 20 62 65 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 74 68 65 20 77 65 62 20 55 49 20 6f 6e 20 74 68 69 73 20 64 65 76 69 63 65 0a 66 75 6e 63 74 69 6f 6e 20 63 61 6c 63 75 6c 61 74 65 4d 69 6e 69 6d 75 6d 41 76 61 69 6c 61 62 6c 65 57 69 64 74 68 28 75 72 6c 50 61 72 61 6d 73 29 20 7b 0a 20 20 20 20 76 61 72 20 61 76 61 69 6c 61 62 6c 65 57 69 64 74 68 2c 20 61 76 61 69 6c 61 62 6c 65 48 65 69 67 68 74 2c 0a 20 20 20 20 20 20 20 20 64 65 76 69 63 65 53 75 70 70 6f 72 74 73 52 6f 74 61 74 69 6f 6e 20 3d 20 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 73 63 72 65 65 6e 57 69 64 74 68 49 6e 55 72 6c 20 3d 20 75 72 6c 50 61 72 61 6d 73 2e Data Ascii: // Calculates the minimum width that would be available to the web UI on this devicefunction calculateMinimumAvailableWidth(urlParams) { var availableWidth, availableHeight, deviceSupportsRotation = true, screenWidthInUrl = urlParams.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49782	15.205.24.192	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-04-01 15:32:03 UTC	51	OUT	GET /logon/LogonPoint/receiver/js/external/hammer.min.js HTTP/1.1 Host: emsonline.tritech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-04-01 15:32:03 UTC	99	IN	HTTP/1.1 200 OK Date: Fri, 01 Apr 2022 15:30:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Last-Modified: Fri, 16 Jul 2021 16:34:48 GMT ETag: "4d8d-5c7402a799a00" Accept-Ranges: bytes Content-Length: 19853 Feature-Policy: camera 'none'; microphone 'none'; geolocation 'none' Referrer-Policy: no-referrer X-XSS-Protection: 1 X-Content-Type-Options: nosniff Cache-Control: max-age=0 must-revalidate X-Citrix-Application: Receiver for Web Content-Type: application/javascript; charset=utf-8 Connection: close
2022-04-01 15:32:03 UTC	99	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 68 2c 5a 2c 75 61 2c 6b 29 7b 66 75 6e 63 74 69 6f 6e 20 4d 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 73 65 74 54 69 6d 65 6f 75 74 28 4e 28 61 2c 63 29 2c 62 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 3f 28 71 28 61 2c 63 5b 62 5d 2c 63 29 2c 21 30 29 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 71 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3b 69 66 28 61 29 69 66 28 61 2e 66 6f 72 45 61 63 68 29 61 2e 66 6f 72 45 61 63 68 28 62 2c 63 29 3b 65 6c 73 65 20 69 66 28 61 2e 6c 65 6e 67 74 68 21 3d 3d 6b 29 66 6f 72 28 64 3d 30 3b 64 3c 61 2e 6c 65 6e 67 74 68 3b 29 62 2e 63 61 6c 6c 28 63 2c 61 5b 64 5d 2c 64 2c 61 29 2c 64 2b 2b 3b 65 6c 73 65 20 66 Data Ascii: (function(h,Z,ua,k){function M(a,b,c){return setTimeout(N(a,c),b)}function w(a,b,c){return Array.isArray(a)?(q(a,c[b],c),!0):!1}function q(a,b,c){var d;if(a)if(a.forEach)a.forEach(b,c);else if(a.length!==k)for(d=0;d<a.length;)b.call(c,a[d],d,a),d++;else f
2022-04-01 15:32:03 UTC	106	IN	Data Raw: 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 3d 3d 3d 6b 7c 7c 6e 75 6c 6c 3d 3d 3d 61 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 6f 6e 76 65 72 74 20 75 6e 64 65 66 69 6e 65 64 20 6f 72 20 6e 75 6c 6c 20 74 6f 20 6f 62 6a 65 63 74 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 4f 62 6a 65 63 74 28 61 29 2c 63 3d 31 3b 63 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 61 72 67 75 6d 65 6e 74 73 5b 63 5d 3b 69 66 28 64 21 3d 3d 6b 26 26 6e 75 6c 6c 21 3d 3d 64 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 64 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 26 26 28 62 5b 65 5d 3d 64 5b 65 5d 29 7d 72 65 74 75 72 6e 20 62 7d 3a 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3b 76 61 72 Data Ascii: ction(a){if(a===k\|\|null===a)throw new TypeError("Cannot convert undefined or null to object");for(var b=Object(a),c=1;c<arguments.length;c++){var d=arguments[c];if(d!==k&&null!==d)for(var e in d)d.hasOwnProperty(e)&&(b[e]=d[e])}return b}:Object.assign;var
2022-04-01 15:32:03 UTC	168	IN	Data Raw: 67 65 74 54 6f 75 63 68 41 63 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 5b 22 6e 6f 6e 65 22 5d 7d 2c 61 74 74 72 54 65 73 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 73 75 70 65 72 2e 61 74 74 72 54 65 73 74 2e 63 61 6c 6c 28 74 68 69 73 2c 61 29 26 26 28 4d 61 74 68 2e 61 62 73 28 61 2e 72 6f 74 61 74 69 6f 6e 29 3e 0a 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 74 68 72 65 73 68 6f 6c 64 7c 7c 74 68 69 73 2e 73 74 61 74 65 26 32 29 7d 7d 29 3b 6c 28 58 2c 70 2c 7b 64 65 66 61 75 6c 74 73 3a 7b 65 76 65 6e 74 3a 22 73 77 69 70 65 22 2c 74 68 72 65 73 68 6f 6c 64 3a 31 30 2c 76 65 6c 6f 63 69 74 79 3a 2e 33 2c 64 69 72 65 63 74 69 6f 6e 3a 33 30 2c 70 6f 69 6e 74 65 72 73 3a 31 7d 2c 67 65 74 54 6f Data Ascii: getTouchAction:function(){return["none"]},attrTest:function(a){return this._super.attrTest.call(this,a)&&(Math.abs(a.rotation)>this.options.threshold\|\|this.state&2)}});l(X,p,{defaults:{event:"swipe",threshold:10,velocity:.3,direction:30,pointers:1},getTo

Target ID:	1
Start time:	17:31:56
Start date:	01/04/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://emsonline.tritech.com
Imagebase:	0x7ff6220c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	17:31:58
Start date:	01/04/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,7003227980610139258,3128681342980020932,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1940 /prefetch:8
Imagebase:	0x7ff6220c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://emsonline.tritech.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\0eb8ed4a-e948-4c16-9f7b-87f779fe4cc4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\8ed1a3df-9034-42e8-838d-a5191f116c81.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1413345e-0320-4ce6-a393-051837b79367.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\15723bcd-379a-49d1-9f50-e62a0420ff9f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\20e0cc6d-d6f3-48ce-bb51-3ed9eb966ae0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5b80cdf9-e0de-4a5b-ba02-1d96632a90b2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\75611d83-2b1f-4c03-bc9c-3def6b0ba12b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7868da7d-9a77-4fdd-8358-344e1b840f80.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\5bda346b-693a-415b-82f8-d0aa0a9fcbac.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\bb283942-986b-4ef9-83fa-8cef9521bfdf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\d6ba839b-a3b4-406e-a40f-d4b430a247b5.tmp

C:\Users\user\AppData\Local\Temp\007305f8-30c8-4fab-9a77-a9bc68b6ca1a.tmp

C:\Users\user\AppData\Local\Temp\b0d81eef-34e6-41e6-80c7-6ea91f55978c.tmp

C:\Users\user\AppData\Local\Temp\scoped_dir6200_2088638494\CRX_INSTALL\_locales\bg\messages.json

Windows Analysis Report
https://emsonline.tritech.com