Edit tour

Windows Analysis Report
Essity Invoice 10903258 .HTML

Overview

General Information

Sample Name:	Essity Invoice 10903258 .HTML
Analysis ID:	1274951
MD5:	d55e4a7969cddac3e5b5705174cd12b9
SHA1:	045f5bbc75954c6e13c04eea702fb46edd19f447
SHA256:	b06054cb1b14022072ea28bfba7b7730862cb15e9bf6b17539bf3614773276da
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish54

HTML IFrame injector detected

HTML document with suspicious name

Phishing site detected (based on image similarity)

Internet Provider seen in connection with other malware

HTML page contains hidden URLs or javascript code

HTML body contains low number of good links

HTML title does not match URL

IP address seen in connection with other malware

Connects to many different domains

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2220 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Essity Invoice 10903258 .HTML MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 4960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1796,i,1704398707666972118,4259187563649323686,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 7712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4064 --field-trial-handle=1796,i,1704398707666972118,4259187563649323686,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish54

Source: Yara match

File source: 1.2.pages.csv, type: HTML

HTML IFrame injector detected

Source: file:///C:/Users/user/Desktop/Essity%20Invoice%2010903258%20.HTML

HTTP Parser: New IFrame, src: https://os2d0we54yl.leviandsonsco.sbs?sign=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL29zMmQwd2U1NHlsLmxldmlhbmRzb25zY28uc2JzIiwiZG9tYWluIjoib3MyZDB3ZTU0eWwubGV2aWFuZHNvbnNjby5zYnMiLCJrZXkiOiJvNFRMUWJEZVhMZXQiLCJxcmMiOiJyb2JlcnQubWFndWlyZUBlc3NpdHkuY29tIiwiaWF0IjoxNjg5NjY4NTk0LCJleHAiOjE2ODk2Njg3MTR9.Uv2hFz-OrOVeuKzs3065eqOPfhCk1gIjQMs7NumHzxg

Phishing site detected (based on image similarity)

Source: file:///C:/Users/user/Desktop/Essity%20Invoice%2010903258%20.HTML

Matcher: Found strong image similarity, brand: MICROSOFT

Source: file:///C:/Users/user/Desktop/Essity%20Invoice%2010903258%20.HTML

HTTP Parser: Base64 decoded: {"url":"https://os2d0we54yl.leviandsonsco.sbs","domain":"os2d0we54yl.leviandsonsco.sbs","key":"o4TLQbDeXLet","qrc":"robert.maguire@essity.com","iat":1689668594,"exp":1689668714}

Source: https://corp.sts.essity.com/adfs/ls/?login_hint=robert.maguire%40essity.com&mkt=en-US&client-request-id=10909e94-ae82-4cdf-9730-24d1875b55d9&username=robert.maguire%40essity.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0GIbj5C5co0KPgqpWYrihA0LE8X_HJ1Wq4ziOE9vxJU4chyGKHSexz_bPFztx7BEGYDshBNINDB0PxMAEDAiJ7aZjpAt0ayudVDF1JNfOFcv3fp--Z3uf0h4FoxiMwshHBQxGDu8TNEUSBGmWccyiygRjIuUqblNldMrg2xdGU9Zkebu0__V3p_uf_vi39C1y_8_PP-n_dQ4dLOI4jA4rlSRJYDCbOZYNW8CveJNg6gTzNfYzBF1C0Ff5e0tg2ssY9ifzlbO0H9pR5MTpNXuW37WDcr93no8onGYwhkFwmqYIiqKqKGxgBmG4itvRxVjRu57sIMg2fUnnU0XgY0WQNzLWXSjuwpd9A1U0ETd8mexocty5Zra8obdcSZuTozobG76Ryu486egNV9b7m8f5Wx12FS-w6wGWTmb_m78xA0t_HIIoPit8kxfKA-_EitNhCxxNMmUaUaoe6LTQrI1bXVnhjhQxsnzFJ5i0mqQ1H3EAa6rNrMbjbqZKApceYxup3WFPzFacaJIm1fsnAdtqrBSy51TZhlsbttNptjCpDcGLDj5WENBImfVAaRo1V6-ldZWiYtInuxMEnfXEOcmNe44vnlQBGoRexrspYyzILGvJlNF1eLGKiW1KzYZpimNNdkxgoblB6utRQmJkM7RWg7nMogNdHTlcu-GleIsPZFVb0NJ0BgCVlIlN67i_OE6TkaeW9ZXnhx08XHYjWzDaNXEwCL1Wcl6...

HTTP Parser: Number of links: 0

HTTP Parser: Title: Sign In does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No <meta name="author".. found

Source: Essity Invoice 10903258 .HTML	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Essity%20Invoice%2010903258%20.HTML	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Essity%20Invoice%2010903258%20.HTML	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Essity%20Invoice%2010903258%20.HTML	HTTP Parser: No favicon
Source: https://os2d0we54yl.leviandsonsco.sbs/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&ste=tqdgtv.ociwktg%40guukva.eqo	HTTP Parser: No favicon
Source: https://corp.sts.essity.com/adfs/ls/?login_hint=robert.maguire%40essity.com&mkt=en-US&client-request-id=10909e94-ae82-4cdf-9730-24d1875b55d9&username=robert.maguire%40essity.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0GIbj5C5co0KPgqpWYrihA0LE8X_HJ1Wq4ziOE9vxJU4chyGKHSexz_bPFztx7BEGYDshBNINDB0PxMAEDAiJ7aZjpAt0ayudVDF1JNfOFcv3fp--Z3uf0h4FoxiMwshHBQxGDu8TNEUSBGmWccyiygRjIuUqblNldMrg2xdGU9Zkebu0__V3p_uf_vi39C1y_8_PP-n_dQ4dLOI4jA4rlSRJYDCbOZYNW8CveJNg6gTzNfYzBF1C0Ff5e0tg2ssY9ifzlbO0H9pR5MTpNXuW37WDcr93no8onGYwhkFwmqYIiqKqKGxgBmG4itvRxVjRu57sIMg2fUnnU0XgY0WQNzLWXSjuwpd9A1U0ETd8mexocty5Zra8obdcSZuTozobG76Ryu486egNV9b7m8f5Wx12FS-w6wGWTmb_m78xA0t_HIIoPit8kxfKA-_EitNhCxxNMmUaUaoe6LTQrI1bXVnhjhQxsnzFJ5i0mqQ1H3EAa6rNrMbjbqZKApceYxup3WFPzFacaJIm1fsnAdtqrBSy51TZhlsbttNptjCpDcGLDj5WENBImfVAaRo1V6-ldZWiYtInuxMEnfXEOcmNe44vnlQBGoRexrspYyzILGvJlNF1eLGKiW1KzYZpimNNdkxgoblB6utRQmJkM7RWg7nMogNdHTlcu-GleIsPZFVb0NJ0BgCVlIlN67i_OE6TkaeW9ZXnhx08XHYjWzDaNXEwCL1Wcl6...	HTTP Parser: No favicon

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: Joe Sandbox View

ASN Name: CMCSUS CMCSUS

Source: Joe Sandbox View

IP Address: 104.18.29.38 104.18.29.38

Source: unknown

Network traffic detected: DNS query count 35

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: chromecache_322.1.dr	String found in binary or memory: <a href="https://www.facebook.com/essity"><i class="i i-facebook" aria-hidden="true"></i></a> equals www.facebook.com (Facebook)
Source: chromecache_322.1.dr	String found in binary or memory: <a href="https://www.linkedin.com/company/16240930/"><i class="i i-linkedin" aria-hidden="true"></i></a> equals www.linkedin.com (Linkedin)
Source: chromecache_322.1.dr	String found in binary or memory: <a href="https://www.youtube.com/channel/UCv5LMehTcMvdcUUpEVNTVGA"><i class="i i-youtube" aria-hidden="true"></i></a> equals www.youtube.com (Youtube)
Source: chromecache_299.1.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=f.getFbeventsModules("signalsFBEventsGetTier");e.exports=function(b,c){c=a(c);c=c==null?"www.facebook.com":"www."+c+".facebook.com";return"https://"+c+"/signals/iwl.js?pixel_id="+b}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}};e.exports=new h(function(d,e){function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=function(){n.removeItem(m),a.close()};e.src=i(c,g.ENDPOINT);b.body&&b.body.appendChild(e)}var o=!1,p=function(a){return!!(e&&e.pixelsByID&&Object.prototype.hasOwnProperty.call(e.pixelsByID,a))};function q(){if(o)return;var b=n.getItem(m);if(!b)return;b=JSON.parse(b);var c=b.pixelID,d=b.graphToken,e=b.sessionStartTime;o=!0;h(c,function(){var b=p(c)?c:null;a.FacebookIWL.init(b,d,e)})}function r(b){if(o)return;h(b,func
Source: chromecache_293.1.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://masdpstatic.azureedge.net/essity/1.69.0-release.9/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtm.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.85.0-release.2/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://www.linkedin.com/px/li_sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googleoptimize.com/optimize.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.88.0-release.1/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.86.0-release.2/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/collect","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com/uwt.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/252916668616627","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/iframe_api","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/404682490064138","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://analytics.twitter.com/i/adsct","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/js/300/addthis_widget.js#pubid\x3dra-5c385ed8e96854b3","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.beta.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png","CategoryId":["C0003"],"Vendor":null},{"Tag":"https://t.co/i/adsct","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtag/js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.facebook.com/tr/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2017/annual-and-sustainability-report/layout/js/jquery.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/1221985607932630","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2018/annual-and-sustainability-report/layout/js/jquery.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://i.creativecommons.org/l/by-nc-nd/4.0/88x31.png","CategoryId
Source: chromecache_293.1.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://masdpstatic.azureedge.net/essity/1.69.0-release.9/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtm.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.85.0-release.2/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://www.linkedin.com/px/li_sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googleoptimize.com/optimize.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.88.0-release.1/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.86.0-release.2/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/collect","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com/uwt.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/252916668616627","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/iframe_api","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/404682490064138","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://analytics.twitter.com/i/adsct","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/js/300/addthis_widget.js#pubid\x3dra-5c385ed8e96854b3","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.beta.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png","CategoryId":["C0003"],"Vendor":null},{"Tag":"https://t.co/i/adsct","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtag/js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.facebook.com/tr/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2017/annual-and-sustainability-report/layout/js/jquery.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/1221985607932630","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2018/annual-and-sustainability-report/layout/js/jquery.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://i.creativecommons.org/l/by-nc-nd/4.0/88x31.png","CategoryId
Source: chromecache_293.1.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://masdpstatic.azureedge.net/essity/1.69.0-release.9/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtm.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.85.0-release.2/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://www.linkedin.com/px/li_sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googleoptimize.com/optimize.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.88.0-release.1/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.86.0-release.2/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/collect","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com/uwt.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/252916668616627","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/iframe_api","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/404682490064138","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://analytics.twitter.com/i/adsct","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/js/300/addthis_widget.js#pubid\x3dra-5c385ed8e96854b3","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.beta.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png","CategoryId":["C0003"],"Vendor":null},{"Tag":"https://t.co/i/adsct","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtag/js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.facebook.com/tr/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2017/annual-and-sustainability-report/layout/js/jquery.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/1221985607932630","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2018/annual-and-sustainability-report/layout/js/jquery.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://i.creativecommons.org/l/by-nc-nd/4.0/88x31.png","CategoryId
Source: chromecache_293.1.dr	String found in binary or memory: a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",b=q(c);(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.removeAttribute("src"),a.setAttribute("data-src",c)))}var u=JSON.parse('[{"Tag":"https://masdpstatic.azureedge.net/essity/1.69.0-release.9/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtm.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.google-analytics.com/analytics.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.85.0-release.2/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://www.linkedin.com/px/li_sync","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googleoptimize.com/optimize.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.88.0-release.1/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://masdpstatic.azureedge.net/essity/1.86.0-release.2/js/app.js","CategoryId":["C0003","C0004"],"Vendor":null},{"Tag":"https://px.ads.linkedin.com/collect","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com/uwt.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/252916668616627","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.youtube.com/iframe_api","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/404682490064138","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://analytics.twitter.com/i/adsct","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/js/300/addthis_widget.js#pubid\x3dra-5c385ed8e96854b3","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://snap.licdn.com/li.lms-analytics/insight.beta.min.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png","CategoryId":["C0003"],"Vendor":null},{"Tag":"https://t.co/i/adsct","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtag/js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://www.facebook.com/tr/","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2017/annual-and-sustainability-report/layout/js/jquery.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/1221985607932630","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2018/annual-and-sustainability-report/layout/js/jquery.js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://i.creativecommons.org/l/by-nc-nd/4.0/88x31.png","CategoryId
Source: chromecache_341.1.dr	String found in binary or memory: b,"vert.pix");break;case "PERCENT":HA(d.verticalThresholds,b,"vert.pct")}qx("sdl","init",!1)?qx("sdl","pending",!1)\|\|H(function(){return IA()}):(ox("sdl","init",!0),ox("sdl","pending",!0),H(function(){IA();if(JA()){var e=KA();tc(z,"scroll",e);tc(z,"resize",e)}else ox("sdl","init",!1)}));return b}OA.I="internal.enableAutoEventOnScroll";var dc=da(["data-gtm-yt-inspected-"]),PA=["www.youtube.com","www.youtube-nocookie.com"],QA,RA=!1; equals www.youtube.com (Youtube)
Source: chromecache_305.1.dr	String found in binary or memory: const YT_VIDEO_IFRAME_API = 'https://www.youtube.com/iframe_api'; equals www.youtube.com (Youtube)
Source: chromecache_241.1.dr	String found in binary or memory: function OA(a,b){var c=this;return b}OA.I="internal.enableAutoEventOnScroll";var dc=da(["data-gtm-yt-inspected-"]),PA=["www.youtube.com","www.youtube-nocookie.com"],QA,RA=!1; equals www.youtube.com (Youtube)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 96835288-6b9b-4b31-b3ac-e65712993c01x-ms-ests-server: 2.1.15771.4 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}Referrer-Policy: strict-origin-when-cross-originDate: Tue, 18 Jul 2023 08:23:20 GMTConnection: closeContent-Length: 0Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 705a83bc-afec-4710-af3a-258be42e7301x-ms-ests-server: 2.1.15771.4 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}Referrer-Policy: strict-origin-when-cross-originDate: Tue, 18 Jul 2023 08:23:19 GMTConnection: closeContent-Length: 0Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Source: chromecache_295.1.dr	String found in binary or memory: http://aka.ms/ssprsetup
Source: chromecache_340.1.dr	String found in binary or memory: http://api.jqueryui.com/category/theming/
Source: chromecache_340.1.dr	String found in binary or memory: http://api.jqueryui.com/datepicker/#theming
Source: chromecache_233.1.dr	String found in binary or memory: http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_276.1.dr	String found in binary or memory: http://blog.alexmaccaw.com/css-transitions
Source: chromecache_233.1.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12282#comment:15
Source: chromecache_233.1.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: chromecache_233.1.dr	String found in binary or memory: http://bugs.jquery.com/ticket/13378
Source: chromecache_324.1.dr	String found in binary or memory: http://commercialtype.com/licenseGraphik
Source: chromecache_325.1.dr	String found in binary or memory: http://commercialtype.com/licenseGraphikMedium
Source: chromecache_272.1.dr	String found in binary or memory: http://commercialtype.com/licenseGraphikSemibold
Source: chromecache_325.1.dr	String found in binary or memory: http://commercialtype.comhttp://christianschwartz.comCommercial
Source: chromecache_233.1.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_233.1.dr	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: chromecache_233.1.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_282.1.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_233.1.dr	String found in binary or memory: http://helpful.knobs-dials.com/index.php/Component_returned_failure_code:_0x80040111_(NS_ERROR_NOT_A
Source: chromecache_233.1.dr	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: chromecache_233.1.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_340.1.dr, chromecache_233.1.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_340.1.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_340.1.dr	String found in binary or memory: http://jqueryui.com/themeroller/
Source: chromecache_233.1.dr	String found in binary or memory: http://json.org/json2.js
Source: chromecache_233.1.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_279.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_254.1.dr	String found in binary or memory: http://modernjavascript.blogspot.de/2013/08/building-better-debounce.html
Source: chromecache_327.1.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_233.1.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#affix
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#alerts
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#buttons
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#carousel
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#collapse
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#dropdowns
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#modals
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#popovers
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#scrollspy
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#tabs
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#tooltip
Source: chromecache_276.1.dr	String found in binary or memory: http://twbs.github.com/bootstrap/javascript.html#transitions
Source: chromecache_233.1.dr	String found in binary or memory: http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context
Source: chromecache_276.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_349.1.dr, chromecache_363.1.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: chromecache_322.1.dr	String found in binary or memory: http://www.essity.com/
Source: chromecache_276.1.dr	String found in binary or memory: http://www.modernizr.com/)
Source: chromecache_327.1.dr	String found in binary or memory: http://www.modernizr.com/license/
Source: chromecache_279.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_322.1.dr	String found in binary or memory: http://www.torkglobal.com/
Source: chromecache_300.1.dr, chromecache_357.1.dr	String found in binary or memory: http://www.videolan.oG
Source: chromecache_295.1.dr	String found in binary or memory: https://account.activedirectory.windowsazure.com/ChangePassword.aspx?BrandContextID=O365&ruO365
Source: chromecache_295.1.dr	String found in binary or memory: https://aka.ms/mfasetup
Source: chromecache_295.1.dr	String found in binary or memory: https://aka.ms/sspr
Source: chromecache_271.1.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_293.1.dr	String found in binary or memory: https://analytics.twitter.com/i/adsct
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: chromecache_254.1.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=7731
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13393
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.jquery.com/ticket/4833
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_307.1.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: chromecache_233.1.dr, chromecache_307.1.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_233.1.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_233.1.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: chromecache_307.1.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_241.1.dr, chromecache_341.1.dr, chromecache_273.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_322.1.dr	String found in binary or memory: https://cdn-ukwest.onetrust.com/consent/243652f0-45aa-4193-a147-291d1592994a/OtAutoBlock.js
Source: chromecache_322.1.dr	String found in binary or memory: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js
Source: chromecache_264.1.dr, chromecache_312.1.dr	String found in binary or memory: https://cdn-ukwest.onetrust.com/vendorlist/googleData.json
Source: chromecache_264.1.dr, chromecache_312.1.dr	String found in binary or memory: https://cdn-ukwest.onetrust.com/vendorlist/iab2Data.json
Source: chromecache_264.1.dr, chromecache_312.1.dr	String found in binary or memory: https://cdn-ukwest.onetrust.com/vendorlist/iabData.json
Source: chromecache_322.1.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/select2
Source: chromecache_322.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Source: chromecache_293.1.dr	String found in binary or memory: https://connect.facebook.net/signals/config/252916668616627
Source: chromecache_293.1.dr	String found in binary or memory: https://connect.facebook.net/signals/config/404682490064138
Source: chromecache_264.1.dr, chromecache_312.1.dr	String found in binary or memory: https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck
Source: chromecache_330.1.dr	String found in binary or memory: https://developer.jwplayer.com/jw-player/docs/developer-guide/
Source: chromecache_233.1.dr, chromecache_307.1.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_233.1.dr	String found in binary or memory: https://developer.mozilla.org/en/Security/CSP)
Source: chromecache_330.1.dr	String found in binary or memory: https://developers.google.com/tag-manager/devguide
Source: chromecache_307.1.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: chromecache_307.1.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: chromecache_322.1.dr	String found in binary or memory: https://embed-cdn.flockler.com/embed-v2.js
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/169/201169/optimized-w1440_jpg/lotus-300x300.jpg?w=240&am
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/175/201175/optimized-w1440_jpg/nosotras-300x300.jpg?w=240
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/177/201177/optimized-w1440_jpg/libresse-300x300.jpg?w=240
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/179/201179/optimized-w1440_jpg/saba-300x300.jpg?w=240&amp
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/181/201181/optimized-w1440_jpg/tena-300x300.jpg?w=240&amp
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/186/201186/optimized-w1440_jpg/leukoplast-300x300.jpg?w=2
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/187/201187/optimized-w1440_jpg/jobst-300x300.jpg?w=240&am
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=10
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=11
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=12
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=13
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=16
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=24
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=35
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=40
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=48
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=62
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=64
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=69
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=72
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=83
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=96
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/267/201267/optimized-w1440_jpg/tork-300x300.jpg?w=240&amp
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/268/201268/optimized-w1440_jpg/libero-300x300.jpg?w=240&a
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/269/201269/optimized-w1440_jpg/vinda-300x300.jpg?w=240&am
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/270/201270/optimized-w1440_jpg/zewa-300x300.jpg?w=240&amp
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/328/435328/original/essity-omslag-1920x1080-en.jpg
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/361/443361/optimized-w1440_jpg/womenjogging11920x1080.jpg
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/449/368449/optimized-w1440_jpg/landscape-of-a-large-hay-f
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/55/208055/optimized-w1440_jpg/tempo.jpg?w=240&h=10000
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/552/445552/optimized-w1440_jpg/tork-easycube-cleaner-tabl
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/559/328559/optimized-w1440_jpg/2020-asr-homebanner-2880x1
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/811/375811/optimized-w1440_jpg/manandwomanlaughing-1920x1
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/881/165881/optimized-AzureJPG4K/2017-q-1-report-1440w.jpg
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/884/165884/optimized-AzureJPG4K/2017-q-4-report-1440w.jpg
Source: chromecache_322.1.dr	String found in binary or memory: https://essity-images.essity.com/images-c5/964/434964/optimized-w1440_jpg/asr2022-cover-tena-silloue
Source: chromecache_226.1.dr	String found in binary or memory: https://flockler.com
Source: chromecache_246.1.dr	String found in binary or memory: https://framework7.io/docs/dom7.html
Source: chromecache_264.1.dr, chromecache_312.1.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: chromecache_279.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_327.1.dr	String found in binary or memory: https://github.com/dperini/css-support/blob/master/LICENSE
Source: chromecache_282.1.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: chromecache_307.1.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_233.1.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_307.1.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_307.1.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_327.1.dr	String found in binary or memory: https://github.com/kriskowal/es5-shim/blob/master/es5-shim.js
Source: chromecache_327.1.dr	String found in binary or memory: https://github.com/kriskowal/es5-shim/blob/master/es5-shim.js;
Source: chromecache_241.1.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: chromecache_246.1.dr	String found in binary or memory: https://github.com/nolimits4web/ssr-window
Source: chromecache_315.1.dr	String found in binary or memory: https://github.com/select2/select2/blob/master/LICENSE.md
Source: chromecache_282.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_226.1.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_307.1.dr	String found in binary or memory: https://github.com/whatwg/html/issues/2369
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/#nonce-attributes
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#tag-name-state
Source: chromecache_307.1.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#tag-open-state
Source: chromecache_307.1.dr	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: chromecache_307.1.dr	String found in binary or memory: https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
Source: chromecache_307.1.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_307.1.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: chromecache_307.1.dr	String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_293.1.dr	String found in binary or memory: https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpanalytics.azureedge.net/main-datalayer.js
Source: chromecache_293.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.69.0-release.9/js/app.js
Source: chromecache_293.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.85.0-release.2/js/app.js
Source: chromecache_293.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.86.0-release.2/js/app.js
Source: chromecache_293.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.88.0-release.1/js/app.js
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/css/app.css
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/essity-logo-white.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/favicon.png
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/de.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/es.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/fr.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/it.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/mx.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/nl.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/se.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/us.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/icons/stock-arrow-down.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/img/logo-essity.svg
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/1.99.0-release.7/js/main.js
Source: chromecache_322.1.dr	String found in binary or memory: https://masdpstatic.azureedge.net/essity/Essity_Annual%20and%20Sustainability%20Report%202022_0302.p
Source: chromecache_322.1.dr	String found in binary or memory: https://mediaessityprod.streaming.mediaservices.windows.net/079e2d1d-74f9-45c9-a84f-f38591cb11ad/329
Source: chromecache_322.1.dr	String found in binary or memory: https://mediaessityprod.streaming.mediaservices.windows.net/6a3934a8-d24b-41be-b2eb-ade33fbd4eb8/329
Source: chromecache_303.1.dr	String found in binary or memory: https://os2d0we54yl.leviandsonsco.sbs?sign=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczov
Source: chromecache_322.1.dr	String found in binary or memory: https://oss.maxcdn.com/html5shiv/3.7.3/html5shiv.min.js
Source: chromecache_322.1.dr	String found in binary or memory: https://oss.maxcdn.com/respond/1.4.2/respond.min.js
Source: chromecache_241.1.dr, chromecache_341.1.dr, chromecache_273.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_226.1.dr	String found in binary or memory: https://plugins.flockler.com/embed/$
Source: chromecache_307.1.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: chromecache_307.1.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: chromecache_307.1.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: chromecache_307.1.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: chromecache_307.1.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: chromecache_307.1.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: chromecache_307.1.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: chromecache_293.1.dr	String found in binary or memory: https://px.ads.linkedin.com/collect
Source: chromecache_293.1.dr	String found in binary or memory: https://s7.addthis.com/js/300/addthis_widget.js#pubid
Source: chromecache_307.1.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_293.1.dr, chromecache_338.1.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Source: chromecache_293.1.dr, chromecache_241.1.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: chromecache_338.1.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Source: chromecache_330.1.dr	String found in binary or memory: https://ssl.p.jwpcdn.com/player/v/
Source: chromecache_330.1.dr, chromecache_343.1.dr, chromecache_277.1.dr	String found in binary or memory: https://ssl.p.jwpcdn.com/player/v/8.18.3/notice.txt
Source: chromecache_246.1.dr	String found in binary or memory: https://stackoverflow.com/questions/54520554/custom-element-getrootnode-closest-function-crossing-mu
Source: chromecache_293.1.dr	String found in binary or memory: https://static.ads-twitter.com
Source: chromecache_293.1.dr	String found in binary or memory: https://static.ads-twitter.com/uwt.js
Source: chromecache_341.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_341.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_271.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_246.1.dr	String found in binary or memory: https://swiperjs.com
Source: chromecache_293.1.dr	String found in binary or memory: https://t.co/i/adsct
Source: chromecache_271.1.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_241.1.dr, chromecache_341.1.dr, chromecache_273.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_322.1.dr	String found in binary or memory: https://twitter.com/essity
Source: chromecache_238.1.dr	String found in binary or memory: https://vanillajstoolkit.com/reference/selectors/element-matches/
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.com
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.com/innovation-at-essity/
Source: chromecache_356.1.dr, chromecache_257.1.dr	String found in binary or memory: https://www.essity.com/terms-and-conditions/terms-and-conditions/#UseOfCookies
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.de
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.es/
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.fr
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.it/
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.mx
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.nl
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essity.se
Source: chromecache_322.1.dr	String found in binary or memory: https://www.essityusa.com
Source: chromecache_293.1.dr, chromecache_241.1.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_271.1.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_271.1.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_273.1.dr	String found in binary or memory: https://www.google-analytics.com/gtm/optimize-dyn.js?id=OPT-PJMNWBW
Source: chromecache_241.1.dr	String found in binary or memory: https://www.google-analytics.com/gtm/optimize.js
Source: chromecache_271.1.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_271.1.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_307.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?hl=
Source: chromecache_293.1.dr, chromecache_241.1.dr	String found in binary or memory: https://www.googleoptimize.com/optimize.js
Source: chromecache_241.1.dr, chromecache_341.1.dr, chromecache_273.1.dr	String found in binary or memory: https://www.googletagmanager.com/a?id=
Source: chromecache_293.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js
Source: chromecache_271.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_293.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js
Source: chromecache_322.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_322.1.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-TH9F6KQ
Source: chromecache_322.1.dr	String found in binary or memory: https://www.instagram.com/Essitycareers/
Source: chromecache_330.1.dr, chromecache_343.1.dr, chromecache_277.1.dr	String found in binary or memory: https://www.jwplayer.com/tos/
Source: chromecache_322.1.dr	String found in binary or memory: https://www.linkedin.com/company/16240930/
Source: chromecache_293.1.dr	String found in binary or memory: https://www.linkedin.com/px/li_sync
Source: chromecache_341.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog/mc/collect
Source: chromecache_322.1.dr	String found in binary or memory: https://www.tena.com/
Source: chromecache_322.1.dr	String found in binary or memory: https://www.youtube.com/channel/UCv5LMehTcMvdcUUpEVNTVGA
Source: chromecache_293.1.dr, chromecache_305.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Essity Invoice 10903258 .HTML
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1796,i,1704398707666972118,4259187563649323686,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4064 --field-trial-handle=1796,i,1704398707666972118,4259187563649323686,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1796,i,1704398707666972118,4259187563649323686,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=audio --mojo-platform-channel-handle=4064 --field-trial-handle=1796,i,1704398707666972118,4259187563649323686,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Accept

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label
https://swiperjs.com	0%	URL Reputation	safe
https://swiperjs.com	0%	URL Reputation	safe
https://ssl.p.jwpcdn.com/player/v/	0%	Avira URL Cloud	safe
https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png	0%	Avira URL Cloud	safe
https://www.essity.it/	0%	Avira URL Cloud	safe
https://bam.nr-data.net/jserrors/1/0daf5539a6?a=79783226&v=1.236.0&to=ZVJTZUJVWUoCBk1cWFwYfGdzG2dYBAB6WllGRV5dXFFFFjMEXlA%3D&rst=26739&ck=0&s=ccaa8a1404c3e91f&ref=https://www.essity.com/	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
https://www.tena.com/	0%	Avira URL Cloud	safe
http://www.torkglobal.com/	0%	Avira URL Cloud	safe
https://os2d0we54yl.leviandsonsco.sbs/adfs/portal/logo/logo.png?id=4763FF523B7C10B9E6B3A54908F0E3460038413A696D6B1BC6D1BAD1BED7DDC5	0%	Avira URL Cloud	safe
https://www.essity.se	0%	Avira URL Cloud	safe
https://os2d0we54yl.leviandsonsco.sbs/adfs/portal/css/style.css?id=0A13280A86E7DFA6949BD016EA848912FCAFC05E88CBEDF538AC325B27041205	0%	Avira URL Cloud	safe
https://bam.nr-data.net/events/1/0daf5539a6?a=79783226&v=1.236.0&to=ZVJTZUJVWUoCBk1cWFwYfGdzG2dYBAB6WllGRV5dXFFFFjMEXlA%3D&rst=26735&ck=0&s=ccaa8a1404c3e91f&ref=https://www.essity.com/	0%	Avira URL Cloud	safe
https://www.essity.de	0%	Avira URL Cloud	safe
https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-4Y7BKNV189&cid=144166781.1689668634&gtm=45je37c0&aip=1&z=2002977891	0%	Avira URL Cloud	safe
https://bam.nr-data.net/events/1/0daf5539a6?a=79783226&v=1.236.0&to=ZVJTZUJVWUoCBk1cWFwYfGdzG2dYBAB6WllGRV5dXFFFFjMEXlA%3D&rst=18512&ck=0&s=ccaa8a1404c3e91f&ref=https://www.essity.com/	0%	Avira URL Cloud	safe
https://bam.nr-data.net/1/0daf5539a6?a=79783226&v=1.236.0&to=ZVJTZUJVWUoCBk1cWFwYfGdzG2dYBAB6WllGRV5dXFFFFjMEXlA%3D&rst=7562&ck=0&s=ccaa8a1404c3e91f&ref=https://www.essity.com/&ap=314&be=1437&fe=2722&dc=1389&perf=%7B%22timing%22:%7B%22of%22:1689668626733,%22n%22:0,%22f%22:7,%22dn%22:299,%22dne%22:299,%22c%22:299,%22s%22:299,%22ce%22:1059,%22rq%22:1060,%22rp%22:1437,%22rpe%22:1558,%22di%22:2586,%22ds%22:2825,%22de%22:2826,%22dc%22:4022,%22l%22:4029,%22le%22:4159%7D,%22navigation%22:%7B%7D%7D&fp=1877&fcp=1877	0%	Avira URL Cloud	safe
http://modernjavascript.blogspot.de/2013/08/building-better-debounce.html	0%	Avira URL Cloud	safe
https://ssl.p.jwpcdn.com/player/v/8.18.3/provider.hlsjs.js	0%	Avira URL Cloud	safe
https://ssl.p.jwpcdn.com/player/v/8.18.3/jwplayer.core.controls.js	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
fastly-tls12-bam.nr-data.net	162.247.243.29	true	false	unknown
platform.twitter.map.fastly.net	151.101.8.157	true	false	unknown
stats.g.doubleclick.net	108.177.127.155	true	false	high
leviandsonsco.fun	2.59.255.149	true	false	unknown
scontent.xx.fbcdn.net	157.240.17.15	true	false	high
t.co	104.244.42.5	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
jwplayer-dualstack.map.fastly.net	151.101.2.114	true	false	unknown
www.google.com	172.217.168.68	true	false	high
star-mini.c10r.facebook.com	157.240.9.35	true	false	high
gbxvilyfawt.leviandsonsco.tattoo	2.59.255.149	true	false	unknown
accounts.google.com	172.217.168.77	true	false	high
cdn-ukwest.onetrust.com	104.18.29.38	true	false	high
s.twitter.com	104.244.42.67	true	false	high
dhp6c9ul58mzq.cloudfront.net	18.165.183.68	true	false	high
os2d0we54yl.leviandsonsco.sbs	2.59.255.149	true	true	unknown
region1.analytics.google.com	216.239.34.36	true	false	high
www.googleoptimize.com	172.217.168.78	true	false	unknown
corp.sts.essity.com	193.221.53.107	true	false	high
d1ni990a184w7d.cloudfront.net	18.165.183.25	true	false	high
www.google.co.uk	172.217.168.35	true	false	unknown
www.essity.com	52.142.123.60	true	false	high
clients.l.google.com	216.58.215.238	true	false	high
flockler.com	18.193.194.249	true	false	high
ohhr609lwgk.leviandsonsco.homes	2.59.255.149	true	false	unknown
geolocation.onetrust.com	104.18.28.38	true	false	high
static.ads-twitter.com	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
mediaessityprod.streaming.mediaservices.windows.net	unknown	unknown	false	high
cdn.linkedin.oribi.io	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
js-agent.newrelic.com	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
password.essity.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
bam.nr-data.net	unknown	unknown	false	unknown
ssl.p.jwpcdn.com	unknown	unknown	false	unknown
analytics.twitter.com	unknown	unknown	false	high
embed-cdn.flockler.com	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
fl-1.cdn.flockler.com	unknown	unknown	false	high
essity-images.essity.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-100789646-3&cid=144166781.1689668634&jid=1247599628&gjid=1706618695&_gid=1884863269.1689668634&_u=YADAAEABQAAAACgEKCC~&z=1718310546	false		high
https://t.co/i/adsct?bci=3&eci=2&event_id=e88bd6d6-77f9-4095-9f16-6e6149a9cffa&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=9103663f-cfeb-478c-92ce-6362b89307e1&tw_document_href=https%3A%2F%2Fwww.essity.com%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nuy8m&type=javascript&version=2.3.29	false		high
https://bam.nr-data.net/jserrors/1/0daf5539a6?a=79783226&v=1.236.0&to=ZVJTZUJVWUoCBk1cWFwYfGdzG2dYBAB6WllGRV5dXFFFFjMEXlA%3D&rst=26739&ck=0&s=ccaa8a1404c3e91f&ref=https://www.essity.com/	false	Avira URL Cloud: safe	unknown
https://www.essity.com/assets/js/lazysizes.js	false		high
https://embed-cdn.flockler.com/embed-v2.js	false		high
file:///C:/Users/user/Desktop/Essity%20Invoice%2010903258%20.HTML	true		low
https://os2d0we54yl.leviandsonsco.sbs/adfs/portal/logo/logo.png?id=4763FF523B7C10B9E6B3A54908F0E3460038413A696D6B1BC6D1BAD1BED7DDC5	false	Avira URL Cloud: safe	unknown
https://ssl.p.jwpcdn.com/player/v/8.18.3/jwplayer.core.controls.js	false	Avira URL Cloud: safe	unknown
https://os2d0we54yl.leviandsonsco.sbs/adfs/portal/css/style.css?id=0A13280A86E7DFA6949BD016EA848912FCAFC05E88CBEDF538AC325B27041205	false	Avira URL Cloud: safe	unknown
https://corp.sts.essity.com/adfs/portal/logo/logo.png?id=4763FF523B7C10B9E6B3A54908F0E3460038413A696D6B1BC6D1BAD1BED7DDC5	false		high
https://bam.nr-data.net/events/1/0daf5539a6?a=79783226&v=1.236.0&to=ZVJTZUJVWUoCBk1cWFwYfGdzG2dYBAB6WllGRV5dXFFFFjMEXlA%3D&rst=26735&ck=0&s=ccaa8a1404c3e91f&ref=https://www.essity.com/	false	Avira URL Cloud: safe	unknown
https://www.essity.com/assets/js/5327.js	false		high
https://www.facebook.com/tr/?id=1221985607932630&ev=PageView&dl=https%3A%2F%2Fwww.essity.com%2F&rl=&if=false&ts=1689668635065&sw=1280&sh=1024&v=2.9.111&r=stable&ec=0&o=30&fbp=fb.1.1689668635052.783405673&cs_est=true&it=1689668634378&coo=false&rqm=GET	false		high
https://www.essity.com/assets/css/2369.app.css	false		high
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-100789646-1&cid=144166781.1689668634&jid=217223183&gjid=479051737&_gid=1884863269.1689668634&_u=YADAAEAAQAAAACgEKC~&z=1074728352	false		high
https://cdn-ukwest.onetrust.com/logos/597906e5-2a6b-4651-8f18-c8c4df72850a/c38a2285-ffea-4c9c-8886-0736eb4f3cae/8df47db8-ddf8-4270-b38f-5fcf5b408002/Essity-logo-color.png	false		high
https://www.essity.com/assets/js/one-trust-cookies-youtube.js	false		high
https://cdn-ukwest.onetrust.com/consent/243652f0-45aa-4193-a147-291d1592994a/243652f0-45aa-4193-a147-291d1592994a.json	false		high
https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-4Y7BKNV189&cid=144166781.1689668634&gtm=45je37c0&aip=1&z=2002977891	false	Avira URL Cloud: safe	unknown
https://bam.nr-data.net/events/1/0daf5539a6?a=79783226&v=1.236.0&to=ZVJTZUJVWUoCBk1cWFwYfGdzG2dYBAB6WllGRV5dXFFFFjMEXlA%3D&rst=18512&ck=0&s=ccaa8a1404c3e91f&ref=https://www.essity.com/	false	Avira URL Cloud: safe	unknown
https://ssl.p.jwpcdn.com/player/v/8.18.3/provider.hlsjs.js	false	Avira URL Cloud: safe	unknown
https://www.essity.com/assets/js/carousel.js	false		high
https://www.facebook.com/tr/?id=1221985607932630&ev=ViewContent&dl=https%3A%2F%2Fwww.essity.com%2F&rl=&if=false&ts=1689668635062&sw=1280&sh=1024&v=2.9.111&r=stable&ec=1&o=30&fbp=fb.1.1689668635052.783405673&cs_est=true&est_source=1268864926872153&it=1689668634378&coo=false&es=automatic&tm=3&rqm=GET	false		high
https://cdn-ukwest.onetrust.com/scripttemplates/202304.1.0/assets/otFlat.json	false		high
https://cdn.linkedin.oribi.io/partner/1715802/domain/essity.com/token	false		high
https://www.essity.com/assets/js/navigation.js	false		high
https://cdn-ukwest.onetrust.com/consent/243652f0-45aa-4193-a147-291d1592994a/OtAutoBlock.js	false		high
https://bam.nr-data.net/1/0daf5539a6?a=79783226&v=1.236.0&to=ZVJTZUJVWUoCBk1cWFwYfGdzG2dYBAB6WllGRV5dXFFFFjMEXlA%3D&rst=7562&ck=0&s=ccaa8a1404c3e91f&ref=https://www.essity.com/&ap=314&be=1437&fe=2722&dc=1389&perf=%7B%22timing%22:%7B%22of%22:1689668626733,%22n%22:0,%22f%22:7,%22dn%22:299,%22dne%22:299,%22c%22:299,%22s%22:299,%22ce%22:1059,%22rq%22:1060,%22rp%22:1437,%22rpe%22:1558,%22di%22:2586,%22ds%22:2825,%22de%22:2826,%22dc%22:4022,%22l%22:4029,%22le%22:4159%7D,%22navigation%22:%7B%7D%7D&fp=1877&fcp=1877	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://essity-images.essity.com/images-c5/269/201269/optimized-w1440_jpg/vinda-300x300.jpg?w=240&am	chromecache_322.1.dr	false		high
https://essity-images.essity.com/images-c5/270/201270/optimized-w1440_jpg/zewa-300x300.jpg?w=240&amp	chromecache_322.1.dr	false		high
https://stats.g.doubleclick.net/g/collect	chromecache_341.1.dr	false		high
https://account.activedirectory.windowsazure.com/ChangePassword.aspx?BrandContextID=O365&ruO365	chromecache_295.1.dr	false		high
https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=69	chromecache_322.1.dr	false		high
https://www.essity.it/	chromecache_322.1.dr	false	Avira URL Cloud: safe	unknown
https://essity-images.essity.com/images-c5/811/375811/optimized-w1440_jpg/manandwomanlaughing-1920x1	chromecache_322.1.dr	false		high
https://stackoverflow.com/questions/54520554/custom-element-getrootnode-closest-function-crossing-mu	chromecache_246.1.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_271.1.dr	false		high
https://oss.maxcdn.com/respond/1.4.2/respond.min.js	chromecache_322.1.dr	false		high
https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=64	chromecache_322.1.dr	false		high
https://github.com/select2/select2/blob/master/LICENSE.md	chromecache_315.1.dr	false		high
https://ssl.p.jwpcdn.com/player/v/	chromecache_330.1.dr	false	Avira URL Cloud: safe	unknown
https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=62	chromecache_322.1.dr	false		high
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled	chromecache_307.1.dr	false		high
https://swiperjs.com	chromecache_246.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://essity-images.essity.com/images-c5/268/201268/optimized-w1440_jpg/libero-300x300.jpg?w=240&a	chromecache_322.1.dr	false		high
https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace	chromecache_307.1.dr	false		high
http://modernjavascript.blogspot.de/2013/08/building-better-debounce.html	chromecache_254.1.dr	false	Avira URL Cloud: safe	unknown
http://bugs.jquery.com/ticket/12282#comment:15	chromecache_233.1.dr	false		high
http://dev.w3.org/csswg/cssom/#resolved-values	chromecache_233.1.dr	false		high
http://www.essity.com/	chromecache_322.1.dr	false		high
https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png	chromecache_293.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	chromecache_307.1.dr	false		high
https://github.com/kriskowal/es5-shim/blob/master/es5-shim.js	chromecache_327.1.dr	false		high
http://getbootstrap.com)	chromecache_282.1.dr	false	Avira URL Cloud: safe	low
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	chromecache_307.1.dr	false		high
https://stats.g.doubleclick.net/j/collect	chromecache_271.1.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=470258	chromecache_307.1.dr	false		high
http://www.torkglobal.com/	chromecache_322.1.dr	false	Avira URL Cloud: safe	unknown
https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=72	chromecache_322.1.dr	false		high
http://twbs.github.com/bootstrap/javascript.html#transitions	chromecache_276.1.dr	false		high
https://cdn-ukwest.onetrust.com/vendorlist/iabData.json	chromecache_264.1.dr, chromecache_312.1.dr	false		high
https://essity-images.essity.com/images-c5/328/435328/original/essity-omslag-1920x1080-en.jpg	chromecache_322.1.dr	false		high
http://bugs.jquery.com/ticket/12359	chromecache_233.1.dr	false		high
https://mediaessityprod.streaming.mediaservices.windows.net/6a3934a8-d24b-41be-b2eb-ade33fbd4eb8/329	chromecache_322.1.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	chromecache_233.1.dr	false		high
http://www.modernizr.com/)	chromecache_276.1.dr	false		high
https://html.spec.whatwg.org/#nonce-attributes	chromecache_307.1.dr	false		high
https://www.tena.com/	chromecache_322.1.dr	false	Avira URL Cloud: safe	unknown
https://jsperf.com/getall-vs-sizzle/2	chromecache_307.1.dr	false		high
http://twbs.github.com/bootstrap/javascript.html#modals	chromecache_276.1.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_279.1.dr	false		high
https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=83	chromecache_322.1.dr	false		high
https://aka.ms/mfasetup	chromecache_295.1.dr	false		high
https://www.essity.se	chromecache_322.1.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_279.1.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_282.1.dr	false		high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_341.1.dr	false		high
http://twbs.github.com/bootstrap/javascript.html#carousel	chromecache_276.1.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	chromecache_233.1.dr	false		high
https://bugs.jquery.com/ticket/4833	chromecache_307.1.dr	false		high
https://sizzlejs.com/	chromecache_307.1.dr	false		high
https://essity-images.essity.com/images-c5/225/421225/optimized-w1440_jpg/ba-webcasts-cover.jpg?w=96	chromecache_322.1.dr	false		high
http://twbs.github.com/bootstrap/javascript.html#affix	chromecache_276.1.dr	false		high
https://bugs.jquery.com/ticket/12359	chromecache_307.1.dr	false		high
https://www.essity.com/terms-and-conditions/terms-and-conditions/#UseOfCookies	chromecache_356.1.dr, chromecache_257.1.dr	false		high
https://essity-images.essity.com/images-c5/186/201186/optimized-w1440_jpg/leukoplast-300x300.jpg?w=2	chromecache_322.1.dr	false		high
http://jsperf.com/getall-vs-sizzle/2	chromecache_233.1.dr	false		high
https://essity-images.essity.com/images-c5/881/165881/optimized-AzureJPG4K/2017-q-1-report-1440w.jpg	chromecache_322.1.dr	false		high
https://plugins.flockler.com/embed/$	chromecache_226.1.dr	false		high
https://github.com/jquery/jquery/pull/557)	chromecache_307.1.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=378607	chromecache_307.1.dr	false		high
https://cdn-ukwest.onetrust.com/vendorlist/iab2Data.json	chromecache_264.1.dr, chromecache_312.1.dr	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	chromecache_307.1.dr	false		high
https://www.jwplayer.com/tos/	chromecache_330.1.dr, chromecache_343.1.dr, chromecache_277.1.dr	false		high
https://essity-images.essity.com/images-c5/449/368449/optimized-w1440_jpg/landscape-of-a-large-hay-f	chromecache_322.1.dr	false		high
https://essity-images.essity.com/images-c5/559/328559/optimized-w1440_jpg/2020-asr-homebanner-2880x1	chromecache_322.1.dr	false		high
https://www.essity.de	chromecache_322.1.dr	false	Avira URL Cloud: safe	unknown
http://twbs.github.com/bootstrap/javascript.html#alerts	chromecache_276.1.dr	false		high
https://developers.google.com/tag-manager/devguide	chromecache_330.1.dr	false		high
https://drafts.csswg.org/cssom/#resolved-values	chromecache_307.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
157.240.9.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
216.239.34.36	region1.analytics.google.com	United States	15169	GOOGLEUS	false
172.217.168.68	www.google.com	United States	15169	GOOGLEUS	false
157.240.17.15	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
2.59.255.149	leviandsonsco.fun	Germany	33657	CMCSUS	true
193.221.53.107	corp.sts.essity.com	Sweden	25252	VOLVOITSE	false
104.18.29.38	cdn-ukwest.onetrust.com	United States	13335	CLOUDFLARENETUS	false
151.101.8.157	platform.twitter.map.fastly.net	United States	54113	FASTLYUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
18.193.194.249	flockler.com	United States	16509	AMAZON-02US	false
18.165.183.25	d1ni990a184w7d.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
108.177.127.155	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
18.165.183.68	dhp6c9ul58mzq.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.244.42.67	s.twitter.com	United States	13414	TWITTERUS	false
52.142.123.60	www.essity.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.244.42.5	t.co	United States	13414	TWITTERUS	false
172.217.168.35	www.google.co.uk	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.77	accounts.google.com	United States	15169	GOOGLEUS	false
104.18.28.38	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
151.101.2.114	jwplayer-dualstack.map.fastly.net	United States	54113	FASTLYUS	false
162.247.243.29	fastly-tls12-bam.nr-data.net	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1274951
Start date and time:	2023-07-18 10:21:47 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Essity Invoice 10903258 .HTML
Detection:	MAL
Classification:	mal60.phis.winHTML@40/144@40/26
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .HTML Browse: http://password.essity.com/ Browse: https://www.essity.com/ Browse: https://password.essity.com/Contact

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.18.29.38	https://mail.onelink.me/107872968?pid=nativeplacement&c=Global_Acquisition_YMktg_315_Internal_EmailSignature&af_sub1=Acquisition&af_sub2=Global_YMktg&af_sub3=&af_sub4=100000604&af_sub5=EmailSignature__Static_	Get hash	malicious	Unknown	Browse
	https://mydhl.express.dhl/fr/fr/home.html#/getQuoteTab	Get hash	malicious	HTMLPhisher	Browse
	http://pr-newsroom-wp.appspot.com	Get hash	malicious	Unknown	Browse
	https://mydhl.express.dhl/fr/fr/auth/login.html	Get hash	malicious	HTMLPhisher	Browse
	https://universefd.com/w/ZZZ89	Get hash	malicious	Unknown	Browse
	http://www.ranamotors.com/	Get hash	malicious	Unknown	Browse
	https://truestream.sitey.me/	Get hash	malicious	Unknown	Browse
	https://apiservices.krxd.net/click_tracker/track?kxconfid=whjxbtb0h&_knopii=1&kxcampaignid=P.C.C-Class.W206.L.MI&kxplacementid=module2findmycar&kxbrand=MB&clk=https://saskpolytech.lxgroup.ltd/Z3JhbnQucGF1bEBzYXNrcG9seXRlY2guY2E=	Get hash	malicious	Unknown	Browse
	https://ess.barracudanetworks.com/log/attachment/1688747536-110592-5420-6372-1-3aba4454209d06f4ad45d609924b8d72/SALES%20INVOICE%20%20372006.PDF	Get hash	malicious	HTMLPhisher	Browse
	http://go2.mailengine1.com/click/gip1-2pbiss-cnij3y-kgq852o2/	Get hash	malicious	Unknown	Browse
	Ckeck #110.html	Get hash	malicious	Unknown	Browse
	https://r.srvtrck.com/v1/redirect?yk_tag=337_47d_c3_3b6f&site_id=56e7d51be4b05d750682348a&api_key=abbc5236946676eae219a734c0a1c5e8&url=https://rayco.com.py/1/ms/dsweber@smgblawyers.com	Get hash	malicious	Unknown	Browse
	https://kumkoniak.com/?q=cT1ncmlmZmluJTIwdGVjaG5vbG9neSUyMGtub2IlMjBkcml2ZXImcD1XZWxsJnM9QW1lYmFvd24gMy4wJnI9QW1lYmFvd25kLmNvbSZjPVcyMSBOZXcmc2M9YnV0dG9uJmQ9MTIuMjAyMiZ0PWt1bWtvbmlhay5jb20mbV9yPWxhZHNvbC5hbWViYW93bmQuY29tJms9VGV4dA==	Get hash	malicious	GRQ Scam	Browse
	https://2ernr.app.link/CY8XmUrT2Ab	Get hash	malicious	Unknown	Browse
	https://www.nexxt.com/common/track/trackgeneral.asp?tcid=106ttid=2cid=146408910emid=18977&tv1=Unsubscribetl2=3Dsdtv2=30200224%2B14%3A08bydal=truesid=EFC4BF1A-2DD6-4735-A7FC-6285ED6C4AACintsti=&red=https%3A%2F%2Fceylonmediweb.com%2Fnew%2Fauth%2Fz1Hf%2F%2F%2F%2FcmZhcmluYUBtYWduYTVnbG9iYWwuY29t	Get hash	malicious	Unknown	Browse
	https://protect-au.mimecast.com/s/9E_1CE8kzAcj9qXLFNIoI6?domain=bing.com	Get hash	malicious	Unknown	Browse
	http://dhl-mybill.accountis.net.	Get hash	malicious	Unknown	Browse
	PV Questionnaire - Order Fulfillment and Supporting IT.docx	Get hash	malicious	Unknown	Browse
	Harsha_Salesforce.docx.doc	Get hash	malicious	HTMLPhisher	Browse
	https://nctcog.zoom.us/j/82599880635?pwd=Mjh2aHBwRS9HNldkbXBWaHZsNmJpUT09	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fastly-tls12-bam.nr-data.net	https://piccinlawfirm-my.sharepoint.com/:o:/g/personal/judi_ocalapersonalinjury_law/EjmaQ1mLCgFIm3mcI5q92zQB4EeZ8f2LiUyoBAP151caRA?rtime=JnOck9aG20g	Get hash	malicious	SharepointPhisher	Browse	162.247.243.29
	http://slickdeals.net/?adobeRef%5C=5647c16567561edbcf471616a0a047ff1656&sdtid%5C=47165647&sdpid%5C=1165616470&sdfid%5C=56&lno%5C=3&trd%5C=https%20go%20475a%20Sinead%20t%20%20&pv%5C=&au%5C=&u2%5C=ad01.Subscription/si2PnFe5addy9kFe5anFe5x0qFe5sbdy9i2PFe5	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://ess.barracudanetworks.com/log/attachment/1688747536-110592-5420-6372-1-3aba4454209d06f4ad45d609924b8d72/SALES%20INVOICE%20%20372006.PDF	Get hash	malicious	HTMLPhisher	Browse	162.247.243.29
	https://eosmsoffice-my.sharepoint.com/:o:/g/personal/mona_titancorpus_com/ElzUPFtItmlIhBdELMjbQOEBX_ftCNEbxjl1mSO4e42K0g?e=5%3aUOCQuY&at=9	Get hash	malicious	SharepointPhisher	Browse	162.247.243.29
	https://2ernr.app.link/CY8XmUrT2Ab	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://tripadvisor.no	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://in.xero.com/k34DX3F1IJWpPZQRL3xv5WDWc6huYHlgDDvVuMdH?utm_source=email	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://camcast.net	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://johnsonsupply-my.sharepoint.com/:w:/p/kschneider/EVwXsYM_zkRAs5fkn3OTP30B9y9KbuLvtrD0KpGJB_SJ-Q?e=4%3aITx17W&at=9	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://homemail021.systeme.io/onlidocfilesytrumngdssdsfgf	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://www.bsc-icc.com	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://in.xero.com/nZHFmpqNOlihygQczTQwi93w30JfVIpvjwIOobiD?utm_source=email	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://johnsonsupply-my.sharepoint.com:443/:w:/p/kschneider/EVwXsYM_zkRAs5fkn3OTP30B9y9KbuLvtrD0KpGJB_SJ-Q?e=4%3aITx17W&at=9	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://services.intralinks.com/AZ?w=14717155&br=1&p=3&urlId=1584287538	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://woodsatwindrose.net	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://jdem.cz/fg8555	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://in.xero.com/LqjTIywQ5iZm6XF3lYjJrfEdsCM6UD2R4LzuHdbg	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://uwm-encryptedclosingdocument.online/	Get hash	malicious	HTMLPhisher	Browse	162.247.243.29
	https://firebasestorage.googleapis.com/v0/b/kkduieiirmm.appspot.com/o/index.html?alt=media&token=f945bdca-22ad-4038-b354-16cb99cc4423	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://encryptedclosingdocument.store/	Get hash	malicious	HTMLPhisher	Browse	162.247.243.29

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CMCSUS	BUILD2LN463322.pdf.lnk	Get hash	malicious	Unknown	Browse	85.208.139.229
	File_patched.exe	Get hash	malicious	Amadey, Nymaim, RedLine, SmokeLoader, Tofsee	Browse	45.12.253.56
	https://www.bing.com/ck/a?!&&p=dfc1d9822742d286JmltdHM9MTY4OTEyMDAwMCZpZ3VpZD0yOGJjODMwNy1iMzRjLTY5OWMtMWI4NS05MWE2YjI1MTY4MmMmaW5zaWQ9NTQ3MQ&ptn=3&hsh=3&fclid=28bc8307-b34c-699c-1b85-91a6b251682c&psq=colourfundsinsure.com&u=a1aHR0cHM6Ly9jb2xvdXJmdW5kc2luc3VyZS5jb20vYWJvdXQuaHRtbA#=amFtZXNAdmlld3RyYWRlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	95.214.27.60
	5ri9A66afp.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.12.253.92
	http://vk.com/away.php?to=https://rracquaservice.com.br/re/9y7LhO/	Get hash	malicious	Unknown	Browse	2.59.255.178
	swift_remittance.exe	Get hash	malicious	Lokibot	Browse	171.22.30.164
	i35SwdcXgD.exe	Get hash	malicious	Lokibot	Browse	171.22.30.147
	MV_TRANS-ASIA_I.xls	Get hash	malicious	Lokibot	Browse	171.22.30.147
	esvkLlXsDw.exe	Get hash	malicious	DarkCloud	Browse	2.59.255.67
	QYwme2w6if.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RedLine, SmokeLoader	Browse	45.66.230.149
	https://www.bing.com/ck/a?!&&p=4967148b1fd73cf1JmltdHM9MTY4OTI5MjgwMCZpZ3VpZD0yNzA3N2YxNi1mYTcxLTY3ZDktM2NmMy02YzU4ZmI5MTY2MTkmaW5zaWQ9NTE3MQ&ptn=3&hsh=3&fclid=27077f16-fa71-67d9-3cf3-6c58fb916619&psq=alvaanderson.com&u=a1aHR0cHM6Ly9hbHZhYW5kZXJzb24uY29tL2Fib3V0LWFsdmEv#=cm9iLmJyb3duQHVzLmd0LmNvbQ==	Get hash	malicious	Unknown	Browse	2.59.255.148
	file.exe	Get hash	malicious	Amadey, RHADAMANTHYS, RedLine, SmokeLoader	Browse	45.12.253.92
	file.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	QsvFJjljYu.exe	Get hash	malicious	Nymaim	Browse	45.12.253.56
	U7tOTvnD70.exe	Get hash	malicious	Amadey, Fabookie, SmokeLoader	Browse	45.66.230.149
	QtFaiTyjW0.exe	Get hash	malicious	Unknown	Browse	171.22.30.13
	JwHxFczxRw.exe	Get hash	malicious	Amadey, RHADAMANTHYS, RedLine	Browse	45.12.253.92
	oieoHHGAtm.exe	Get hash	malicious	Amadey, Nymaim, SmokeLoader	Browse	45.12.253.56
	57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader	Browse	45.66.230.164
	dKVM0xvjEe.exe	Get hash	malicious	RHADAMANTHYS	Browse	45.12.253.92

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	M3U playlist, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1387
Entropy (8bit):	5.158184542310398
Encrypted:	false
SSDEEP:	24:9fFfkUYBXHrHcH+HntHAHOHdHD3p+6iPsZUWfF2LHnRHXxaf:9f17YB3ryUVGkFD5ZQsSWt2LnZhq
MD5:	C2F846316FB88372480611B1164ECACD
SHA1:	958756FC8DF6D21648A42C0C72219D0F8436DA49
SHA-256:	2D0E099D298574745FE2F6299B8D3CC51E0ADFCAEE8F629098451B6C9AD5E34D
SHA-512:	6DC9E5624F0D278F2EDF298CA3FC581FDBEB224842660F5F7169252744432156704DCBE4EC2BD40DB7790CE464A16CC633D0ADD4041BAFF86B8BAB3F0904B974
Malicious:	false
Reputation:	low
URL:	"https://mediaessityprod.streaming.mediaservices.windows.net/079e2d1d-74f9-45c9-a84f-f38591cb11ad/329108_ESSI_UUID.ism/QualityLevels(4260970)/Manifest(video,format=m3u8-aapl)"
Preview:	#EXTM3U..#EXT-X-VERSION:4..#EXT-X-PLAYLIST-TYPE:VOD..#EXT-X-ALLOW-CACHE:NO..#EXT-X-MEDIA-SEQUENCE:0..#EXT-X-TARGETDURATION:7..#EXT-X-PROGRAM-DATE-TIME:1970-01-01T00:00:00Z..#EXTINF:6.000000,no-desc..Fragments(video=0,format=m3u8-aapl)..#EXTINF:6.000000,no-desc..Fragments(video=60000000,format=m3u8-aapl)..#EXTINF:6.000000,no-desc..Fragments(video=120000000,format=m3u8-aapl)..#EXTINF:6.000000,no-desc..Fragments(video=180000000,format=m3u8-aapl)..#EXTINF:6.000000,no-desc..Fragments(video=240000000,format=m3u8-aapl)..#EXTINF:6.000000,no-desc..Fragments(video=300000000,format=m3u8-aapl)..#EXTINF:6.000000,no-desc..Fragments(video=360000000,format=m3u8-aapl)..#EXTINF:6.000000,no-desc..Fragments(video=420000000,format=m3u8-aapl)..#EXTINF:6.000000,no-desc..Fragments(video=480000000,format=m3u8-aapl)..#EXTINF:4.000000,no-desc..Fragments(video=540000000,format=m3u8-aapl)..#EXTINF:5.200000,no-desc..Fragments(video=580000000,format=m3u8-aapl)..#EXTINF:6.800000,no-desc..Fragments(video=632000000,for

File type:	HTML document, ASCII text, with very long lines (56727), with CRLF line terminators
Entropy (8bit):	4.708122603368527
TrID:
File name:	Essity Invoice 10903258 .HTML
File size:	207'170 bytes
MD5:	d55e4a7969cddac3e5b5705174cd12b9
SHA1:	045f5bbc75954c6e13c04eea702fb46edd19f447
SHA256:	b06054cb1b14022072ea28bfba7b7730862cb15e9bf6b17539bf3614773276da
SHA512:	19996cc6119e71b1f4e919f68102614f5fb6c1ae650e488a9e5c39514f06400daeec6a2f30882c2dfd3fbc7b70954cff0ff75dc35ee564addc70f593c39480ee
SSDEEP:	6144:QA2RHev8VUyTC4BnNn3nogKV+6Gh+ghIEIBE8VB0U3xBZYVL:QPR+v8GyTC4BnNn3nogKV+6M+ghIEIBK
TLSH:	6C1469D43291E00395CE1A53BF1A7EFDD03AA8B3A5C8B50796A8769C74BD14BC2B4DC4
File Content Preview:	<html class=no-touch dir=ltr lang=en translate=no xmlns=http://www.w3.org/1999/xhtml>.. <title>Outlook</title>.. <p id="uxo" style="display:none;">robert.maguire@essity.com</p>.. <body class="disableTextSelection ms-Fabric--isFocusHidden ms-font-s" sty

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2023 10:23:04.777447939 CEST	59683	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:04.786678076 CEST	64167	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:04.798300028 CEST	53	59683	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:04.832653999 CEST	53	64167	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:07.991904020 CEST	60686	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:08.021389961 CEST	53	60686	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:08.096369028 CEST	61124	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:08.116518021 CEST	53	61124	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:09.734883070 CEST	55570	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:09.944932938 CEST	53	55570	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:10.911804914 CEST	59446	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:11.240143061 CEST	53	59446	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:14.722836971 CEST	58729	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:14.867317915 CEST	53	58729	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:20.210558891 CEST	49750	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:20.459388018 CEST	60550	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:20.607758045 CEST	53	60550	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:20.613486052 CEST	54851	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:20.688586950 CEST	53	54851	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:43.638209105 CEST	61733	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:43.909279108 CEST	53370	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:47.706811905 CEST	59818	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:47.780227900 CEST	53	59818	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:48.970937014 CEST	63229	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:49.005902052 CEST	53	63229	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:49.289604902 CEST	52259	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:49.315643072 CEST	53887	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:49.319873095 CEST	53	52259	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:49.319892883 CEST	56218	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:49.724047899 CEST	50094	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:49.727603912 CEST	51766	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:49.750232935 CEST	53	50094	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:49.761605978 CEST	53	51766	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:50.337754011 CEST	57349	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:50.367620945 CEST	53	57349	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:51.615149021 CEST	53622	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:53.757463932 CEST	64159	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:53.761360884 CEST	59926	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:53.764678955 CEST	61709	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:53.772106886 CEST	53	64159	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:53.778640985 CEST	59182	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:53.781821012 CEST	61657	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:53.799402952 CEST	53	59182	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:53.801625967 CEST	53	59926	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:53.819787025 CEST	53	61657	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:54.704596996 CEST	51511	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:54.812767982 CEST	57889	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:54.814111948 CEST	58480	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:54.827544928 CEST	53	57889	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:54.844494104 CEST	53	58480	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:54.957293987 CEST	57682	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:54.958812952 CEST	54075	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:54.961627007 CEST	49746	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:54.987781048 CEST	53	54075	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:54.990139961 CEST	53	49746	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:54.998981953 CEST	53	57682	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:55.052352905 CEST	61940	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:55.067548037 CEST	53	61940	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:55.682579041 CEST	53573	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:55.735963106 CEST	60828	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:55.771151066 CEST	53	60828	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:55.829233885 CEST	59673	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:23:55.844237089 CEST	53	59673	8.8.8.8	192.168.2.4
Jul 18, 2023 10:23:56.532428026 CEST	61837	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:24:20.278687954 CEST	56804	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:25:08.119873047 CEST	64617	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:25:08.148644924 CEST	53	64617	8.8.8.8	192.168.2.4
Jul 18, 2023 10:25:08.183119059 CEST	50836	53	192.168.2.4	8.8.8.8
Jul 18, 2023 10:25:08.212132931 CEST	53	50836	8.8.8.8	192.168.2.4

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:05 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:05 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-07-18 08:23:05 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 18 Jul 2023 08:23:05 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-S3Vavlm4Z9KFppqsU0n1SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-07-18 08:23:05 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-07-18 08:23:05 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:05 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:05 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-kq9DCC_GAHunk5JaWFP7kw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 18 Jul 2023 08:23:05 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6042 X-Daystart: 4985 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-07-18 08:23:05 UTC	1	IN	Data Raw: 32 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 30 34 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 39 38 35 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 Data Ascii: 2c8<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6042" elapsed_seconds="4985"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-07-18 08:23:05 UTC	2	IN	Data Raw: 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 3f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-07-18 08:23:05 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:18 UTC	175	OUT	GET /__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&ste=tqdgtv.ociwktg%40guukva.eqo&sso_reload=true HTTP/1.1 Host: os2d0we54yl.leviandsonsco.sbs Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://os2d0we54yl.leviandsonsco.sbs/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&ste=tqdgtv.ociwktg%40guukva.eqo Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: qPdM=o4TLQbDeXLet; qPdM.sig=mA0V-r93uuyYn0uJI_z87xzzVQc; fpc=Aj69XZw8uwlLgstMd7ZN4ug; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2023-07-18 08:23:18 UTC	177	IN	HTTP/1.1 302 Found Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://os2d0we54yl.leviandsonsco.sbs/redirect.cgi?ref=aHR0cHM6Ly9jb3JwLnN0cy5lc3NpdHkuY29tL2FkZnMvbHMvP2xvZ2luX2hpbnQ9cm9iZXJ0Lm1hZ3VpcmUlNDBlc3NpdHkuY29tJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0xMDkwOWU5NC1hZTgyLTRjZGYtOTczMC0yNGQxODc1YjU1ZDkmdXNlcm5hbWU9cm9iZXJ0Lm1hZ3VpcmUlNDBlc3NpdHkuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFoWklfak50MEdJYmo1QzVjbzBLUGdxcFdZcmloQTBMRThYX0hKMVdxNHppT0U5dnhKVTRjaHlHS0hTZXh6X2JQRnp0eDdCRUdZRHNoQk5JTkRCMFB4TUFFREFpSjdhWmpwQXQwYXl1ZFZERjFKTmZPRmN2M2ZwLS1aM3VmMGg0Rm94aU13c2hIQlF4R0R1OFRORVVTQkdtV2NjeWl5Z1JqSXVVcWJsTmxkTXJnMnhkR1U5WmtlYnUwX19WM3BfdWZfdmkzOUMxeV84X1BQLW5fZFE0ZExPSTRqQTRybFNSSllEQ2JPWllOVzhDdmVKTmc2Z1R6TmZZekJGMUMwRmY1ZTB0ZzJzc1k5aWZ6bGJPMEg5cFI1TVRwTlh1VzM3V0Rjcjkzbm84b25HWXdoa0Z3bXFZSWlxS3FLR3hnQm1HNGl0dlJ4VmpSdTU3c0lNZzJmVW5uVTBYZ1kwV1FOekxXWFNqdXdwZDlBMVUwRVRkOG1leG9jdHk1WnJhOG9iZGNTWnVUb3pvYkc3NlJ5dTQ4NmVnTlY5YjdtOGY1V3gxMkZTLXc2d0dXVG1iX203OHhBMHRfSElJb1BpdDhreGZLQS1fRWl0TmhDeHhOTW1VYVVhb2U2TFRRckkxYlhWbmhqaFF4c256Rko1aTBtcVExSDNFQWE2ck5yTWJqYnFaS0FwY2VZeHVwM1dGUHpGYWNhSkltMWZzbkFkdHFyQlN5NTFUWmhsc2J0dE5wdGpDcERjR0xEajVXRU5CSW1mVkFhUm8xVjYtbGRaV2lZdEludXhNRW5mWEVPY21OZTQ0dm5sUUJHb1JleHJzcFl5eklMR3ZKbE5GMWVMR0tpVzFLellacGltTk5ka3hnb2JsQjZ1dFJRbUprTTdSV2c3bk1vZ05kSFRsY3UtR2xlSXNQWkZWYjBOSjBCZ0NWbElsTjY3aV9PRTZUa2FlVzlaWG5oeDA4WEhZald6RGFOWEV3Q0wxV2NsNjQ5NGJxMTloUGhlSjI4VUZ3VWFCQmFBZk85Q0JjZ3BuajJXX1NaWTFWT3EtdUp2QnRtUFc4eXgzby1jNmR2ZUwtemJ2UVFlN0Q5NUhDNGQ1ZWFUOTNOM2VRZTdrRFBkcmQydmpQTV9YN1AzNTRXdl9seThIWmI0OC15RjNzVmtSaHJtaTlrRnczdUNVSXB3SWc1MGNhWVk4NGRHVWVhUnhOY1l6WllIMXRhRmdQaUVQMHRBaWRGb3NYeFhmRi1samh0WjdHS25XMlc4Zkd5SXNpOU1WYnVWOXZfS19majItLVZ5cXRuTEVIcklsblI3ZGZ1X3o3MjdtWDcxeS1lSHIxMmRXVHEtYnpXeC1yNkR3YjRpU0lCUFI0bGpxZUpOak5NSmx5V1FBUWpwY21QY01UUWRmcnJUWHc0RDgxIw== Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: ab50e9e0-acc3-44e8-b989-569abea21c00 x-ms-ests-server: 2.1.15811.5 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} x-ms-clitelem: 1,0,0,, nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: buid=0.AQoAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrDN3pm17rsOj_Wfa8ShXnQ-m4hHK9psXc4wzSF_MbfM0ueczWoWwrGKCGCeRmKeYEQZYIKBMsGC-mskTYaFDHa9W6d4slt6X2b8PtRM0lWqogAA; expires=Thu, 17-Aug-2023 08:23:18 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: ESTSWCTXFLOWTOKEN=AQABAAEAAAD--DLA3VO7QrddgJg7WevrfLtLLFu2JHML42OPO7ux4GpYDosmZIrX3bto_HALnfr2ap5ECEs9vXzweNzHelNWyOAZCom5A_ewe8g25v2MxuSY6R8tOzVGHQJGwCKyjTiZ3ZVEgo7unQuEEt639hajkSuAIfTu4F70mdWqhQhgnsoz2VZH5n4lY6etP2jUTI1uHumOaebgbTCX5fqkHB6LKvJCFHi4goTPCthyA-LU2J5ybwqm-LSrFdTr-t_G4o7Iff98LgK0pmadFV_adLCFBFyUvV4UkV1D37n-kZ-lXA5REQmZxn_lFwVBd6NgaiAQk_y5Gp-UPZ7izmIGsXihdshXnirLigHJYxU-66ORysi9xsi-4qY4ra42KjnYwyoruxdeFLqQRaJYyexgYDsN8wXBS7RHAFwDlHp67P37rAu3bjPcnHXR2znyrljeg6Mu1l8fLrFixfy1mP_VDkAlpTl4RPzhnOTXaGTs-EprCL7E1YaClwKatlQvNLg_it4lb-0A8rYqLEiWLdMjQYGoUO7da-llLssjAyAfy4lMkZ1e0gaUXrDHIAdSOHc-Lk-FgKoysUWI_O35JflIZXiYIAA; domain=os2d0we54yl.leviandsonsco.sbs; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=Aj69XZw8uwlLgstMd7ZN4ui8Ae7AAQAAAPZCSNwOAAAA; expires=Thu, 17-Aug-2023 08:23:18 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABAAEAAAD--DLA3VO7QrddgJg7WevrigLsCd_rcdVtxJNlDm1hg6kRBDPhmC7POTm0mkGHCzrL2uGWcLZjiRQ4QYylHt7Zn-B-GlpXdu1XWW_yzeS7cdW-snz_q3NH1LNrHRXQ29-uSfQwvfeeRMg7FLtuUx4iZEvzxQOsufYm1Jt9vp0-181x1oXgaE2dZn57T5r2-R4gAA; domain=os2d0we54yl.leviandsonsco.sbs; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 18 Jul 2023 08:23:17 GMT Connection: close content-length: 1487 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-07-18 08:23:18 UTC	182	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 72 70 2e 73 74 73 2e 65 73 73 69 74 79 2e 63 6f 6d 3a 34 34 33 2f 61 64 66 73 2f 6c 73 2f 3f 6c 6f 67 69 6e 5f 68 69 6e 74 3d 72 6f 62 65 72 74 2e 6d 61 67 75 69 72 65 25 34 30 65 73 73 69 74 79 2e 63 6f 6d 26 61 6d 70 3b 6d 6b 74 3d 65 6e 2d 55 53 26 61 6d 70 3b 63 6c 69 65 6e 74 2d 72 65 71 75 65 73 74 2d 69 64 3d 31 30 39 30 39 65 39 34 2d 61 65 38 32 2d 34 63 64 66 2d 39 37 33 30 2d 32 34 64 31 38 37 35 62 35 35 64 39 26 61 6d 70 3b 75 73 65 72 6e 61 6d 65 3d 72 6f 62 65 72 74 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://corp.sts.essity.com:443/adfs/ls/?login_hint=robert.maguire%40essity.com&mkt=en-US&client-request-id=10909e94-ae82-4cdf-9730-24d1875b55d9&username=robert

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:19 UTC	183	OUT	GET /redirect.cgi?ref=aHR0cHM6Ly9jb3JwLnN0cy5lc3NpdHkuY29tL2FkZnMvbHMvP2xvZ2luX2hpbnQ9cm9iZXJ0Lm1hZ3VpcmUlNDBlc3NpdHkuY29tJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0xMDkwOWU5NC1hZTgyLTRjZGYtOTczMC0yNGQxODc1YjU1ZDkmdXNlcm5hbWU9cm9iZXJ0Lm1hZ3VpcmUlNDBlc3NpdHkuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFoWklfak50MEdJYmo1QzVjbzBLUGdxcFdZcmloQTBMRThYX0hKMVdxNHppT0U5dnhKVTRjaHlHS0hTZXh6X2JQRnp0eDdCRUdZRHNoQk5JTkRCMFB4TUFFREFpSjdhWmpwQXQwYXl1ZFZERjFKTmZPRmN2M2ZwLS1aM3VmMGg0Rm94aU13c2hIQlF4R0R1OFRORVVTQkdtV2NjeWl5Z1JqSXVVcWJsTmxkTXJnMnhkR1U5WmtlYnUwX19WM3BfdWZfdmkzOUMxeV84X1BQLW5fZFE0ZExPSTRqQTRybFNSSllEQ2JPWllOVzhDdmVKTmc2Z1R6TmZZekJGMUMwRmY1ZTB0ZzJzc1k5aWZ6bGJPMEg5cFI1TVRwTlh1VzM3V0Rjcjkzbm84b25HWXdoa0Z3bXFZSWlxS3FLR3hnQm1HNGl0dlJ4VmpSdTU3c0lNZzJmVW5uVTBYZ1kwV1FOekxXWFNqdXdwZDlBMVUwRVRkOG1leG9jdHk1WnJhOG9iZGNTWnVUb3pvYkc3NlJ5dTQ4NmVnTlY5YjdtOGY1V3gxMkZTLXc2d0dXVG1iX203OHhBMHRfSElJb1BpdDhreGZLQS1fRWl0TmhDeHhOTW1VYVVhb2U2TFRRckkxYlhWbmhqaFF4c256Rko1aTBtcVExSDNFQWE2ck5yTWJqYnFaS0FwY2VZeHVwM1dGUHpGYWNhSkltMWZzbkFkdHFyQlN5NTFUWmhsc2J0dE5wdGpDcERjR0xEajVXRU5CSW1mVkFhUm8xVjYtbGRaV2lZdEludXhNRW5mWEVPY21OZTQ0dm5sUUJHb1JleHJzcFl5eklMR3ZKbE5GMWVMR0tpVzFLellacGltTk5ka3hnb2JsQjZ1dFJRbUprTTdSV2c3bk1vZ05kSFRsY3UtR2xlSXNQWkZWYjBOSjBCZ0NWbElsTjY3aV9PRTZUa2FlVzlaWG5oeDA4WEhZald6RGFOWEV3Q0wxV2NsNjQ5NGJxMTloUGhlSjI4VUZ3VWFCQmFBZk85Q0JjZ3BuajJXX1NaWTFWT3EtdUp2QnRtUFc4eXgzby1jNmR2ZUwtemJ2UVFlN0Q5NUhDNGQ1ZWFUOTNOM2VRZTdrRFBkcmQydmpQTV9YN1AzNTRXdl9seThIWmI0OC15RjNzVmtSaHJtaTlrRnczdUNVSXB3SWc1MGNhWVk4NGRHVWVhUnhOY1l6WllIMXRhRmdQaUVQMHRBaWRGb3NYeFhmRi1samh0WjdHS25XMlc4Zkd5SXNpOU1WYnVWOXZfS19majItLVZ5cXRuTEVIcklsblI3ZGZ1X3o3MjdtWDcxeS1lSHIxMmRXVHEtYnpXeC1yNkR3YjRpU0lCUFI0bGpxZUpOak5NSmx5V1FBUWpwY21QY01UUWRmcnJUWHc0RDgxIw== HTTP/1.1 Host: os2d0we54yl.leviandsonsco.sbs Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://os2d0we54yl.leviandsonsco.sbs/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&ste=tqdgtv.ociwktg%40guukva.eqo Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: qPdM=o4TLQbDeXLet; qPdM.sig=mA0V-r93uuyYn0uJI_z87xzzVQc; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AQoAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrDN3pm17rsOj_Wfa8ShXnQ-m4hHK9psXc4wzSF_MbfM0ueczWoWwrGKCGCeRmKeYEQZYIKBMsGC-mskTYaFDHa9W6d4slt6X2b8PtRM0lWqogAA; ESTSWCTXFLOWTOKEN=AQABAAEAAAD--DLA3VO7QrddgJg7WevrfLtLLFu2JHML42OPO7ux4GpYDosmZIrX3bto_HALnfr2ap5ECEs9vXzweNzHelNWyOAZCom5A_ewe8g25v2MxuSY6R8tOzVGHQJGwCKyjTiZ3ZVEgo7unQuEEt639hajkSuAIfTu4F70mdWqhQhgnsoz2VZH5n4lY6etP2jUTI1uHumOaebgbTCX5fqkHB6LKvJCFHi4goTPCthyA-LU2J5ybwqm-LSrFdTr-t_G4o7Iff98LgK0pmadFV_adLCFBFyUvV4UkV1D37n-kZ-lXA5REQmZxn_lFwVBd6NgaiAQk_y5Gp-UPZ7izmIGsXihdshXnirLigHJYxU-66ORysi9xsi-4qY4ra42KjnYwyoruxdeFLqQRaJYyexgYDsN8wXBS7RHAFwDlHp67P37rAu3bjPcnHXR2znyrljeg6Mu1l8fLrFixfy1mP_VDkAlpTl4RPzhnOTXaGTs-EprCL7E1YaClwKatlQvNLg_it4lb-0A8rYqLEiWLdMjQYGoUO7da-llLssjAyAfy4lMkZ1e0gaUXrDHIAdSOHc-Lk-FgKoysUWI_O35JflIZXiYIAA; fpc=Aj69XZw8uwlLgstMd7ZN4ui8Ae7AAQAAAPZCSNwOAAAA; esctx=PAQABAAEAAAD--DLA3VO7QrddgJg7WevrigLsCd_rcdVtxJNlDm1hg6kRBDPhmC7POTm0mkGHCzrL2uGWcLZjiRQ4QYylHt7Zn-B-GlpXdu1XWW_yzeS7cdW-snz_q3NH1LNrHRXQ29-uSfQwvfeeRMg7FLtuUx4iZEvzxQOsufYm1Jt9vp0-181x1oXgaE2dZn57T5r2-R4gAA
2023-07-18 08:23:20 UTC	188	IN	HTTP/1.1 200 OK Referer: https://corp.sts.essity.com/adfs/ls/?login_hint=robert.maguire%40essity.com&mkt=en-US&client-request-id=10909e94-ae82-4cdf-9730-24d1875b55d9&username=robert.maguire%40essity.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0GIbj5C5co0KPgqpWYrihA0LE8X_HJ1Wq4ziOE9vxJU4chyGKHSexz_bPFztx7BEGYDshBNINDB0PxMAEDAiJ7aZjpAt0ayudVDF1JNfOFcv3fp--Z3uf0h4FoxiMwshHBQxGDu8TNEUSBGmWccyiygRjIuUqblNldMrg2xdGU9Zkebu0__V3p_uf_vi39C1y_8_PP-n_dQ4dLOI4jA4rlSRJYDCbOZYNW8CveJNg6gTzNfYzBF1C0Ff5e0tg2ssY9ifzlbO0H9pR5MTpNXuW37WDcr93no8onGYwhkFwmqYIiqKqKGxgBmG4itvRxVjRu57sIMg2fUnnU0XgY0WQNzLWXSjuwpd9A1U0ETd8mexocty5Zra8obdcSZuTozobG76Ryu486egNV9b7m8f5Wx12FS-w6wGWTmb_m78xA0t_HIIoPit8kxfKA-_EitNhCxxNMmUaUaoe6LTQrI1bXVnhjhQxsnzFJ5i0mqQ1H3EAa6rNrMbjbqZKApceYxup3WFPzFacaJIm1fsnAdtqrBSy51TZhlsbttNptjCpDcGLDj5WENBImfVAaRo1V6-ldZWiYtInuxMEnfXEOcmNe44vnlQBGoRexrspYyzILGvJlNF1eLGKiW1KzYZpimNNdkxgoblB6utRQmJkM7RWg7nMogNdHTlcu-GleIsPZFVb0NJ0BgCVlIlN67i_OE6TkaeW9ZXnhx08XHYjWzDaNXEwCL1Wcl6494bq19hPheJ28UFwUaBBaAfO9CBcgpnj2W_SZY1VOq-uJvBtmPW8yx3o-c6dveL-zbvQQe7D95HC4d5eaT93N3eQe7kDPdrd2vjPM_X7P354Wv_ly8HZb48-yF3sVkRhrmi9kFw3uCUIpwIg50caYY84dGUeaRxNcYzZYH1taFgPiEP0tAidFosXxXfF-ljhtZ7GKnW2W8fGyIsi9MVbuV9v_K_fj2--VyqtnLEHrIlnR7dfu_z727mX71y-eHr12dWTq-bzWx-r6Dwb4iSIBPR4ljqeJNjNMJlyWQAQjpcmPcMTQdfrrTXw4D81# Cache-Control: no-cache,no-store Pragma: no-cache content-length: 32874 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 Date: Tue, 18 Jul 2023 08:23:20 GMT Set-Cookie: NSC_MCWT_QSPE_BEGT-FYU_Xfc_443_TTM=ffffffff09e62aa445525d5f4f58455e445a4a42378b;expires=Tue, 18-Jul-2023 08:38:31 GMT;path=/;secure;httponly Strict-Transport-Security: max-age=157680000 connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-07-18 08:23:20 UTC	190	IN	Data Raw: 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 31 22 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f Data Ascii: <!DOCTYPE html><html lang="en-GB"> <head> <meta http-equiv="X-UA-Compatible" content="IE=edge"/> <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=1"/> <meta http-equiv="content-type" co
2023-07-18 08:23:20 UTC	204	IN	Data Raw: 20 20 20 20 20 3c 70 3e 54 6f 20 66 69 6e 64 20 6f 75 74 20 69 66 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 73 75 70 70 6f 72 74 73 20 4a 61 76 61 53 63 72 69 70 74 20 6f 72 20 74 6f 20 65 6e 61 62 6c 65 20 4a 61 76 61 53 63 72 69 70 74 2c 20 73 65 65 20 77 65 62 20 62 72 6f 77 73 65 72 20 68 65 6c 70 2e 3c 2f 70 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6e 6f 53 63 72 69 70 74 22 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 6e 6f 6e 65 22 3b 0d 0a 20 20 Data Ascii: <p>To find out if your web browser supports JavaScript or to enable JavaScript, see web browser help.</p> </div> <script type="text/javascript" language="JavaScript"> document.getElementById("noScript").style.display = "none";
2023-07-18 08:23:20 UTC	220	IN	Data Raw: 0d 0a 2f 2f 20 6f 6e 6c 79 20 77 68 65 6e 20 74 68 65 20 62 72 61 6e 64 69 6e 67 20 69 73 20 64 69 73 70 6c 61 79 69 6e 67 2e 20 54 68 69 73 20 73 63 72 69 70 74 20 77 6f 72 6b 20 74 6f 67 65 74 68 65 72 0d 0a 2f 2f 20 77 69 74 68 20 74 68 65 20 63 6f 64 65 20 69 6e 20 50 61 67 65 42 61 73 65 2e 63 73 20 74 68 61 74 20 73 65 74 73 20 74 68 65 20 68 74 6d 6c 20 69 6e 6c 69 6e 65 20 73 74 79 6c 65 0d 0a 2f 2f 20 63 6f 6e 74 61 69 6e 69 6e 67 20 74 68 65 20 63 6c 61 73 73 20 27 69 6c 6c 75 73 74 72 61 74 69 6f 6e 43 6c 61 73 73 27 20 77 69 74 68 20 74 68 65 20 62 61 63 6b 67 72 6f 75 6e 64 20 69 6d 61 67 65 2e 0d 0a 76 61 72 20 63 6f 6d 70 75 74 65 4c 6f 61 64 49 6c 6c 75 73 74 72 61 74 69 6f 6e 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 Data Ascii: // only when the branding is displaying. This script work together// with the code in PageBase.cs that sets the html inline style// containing the class 'illustrationClass' with the background image.var computeLoadIllustration = function () {

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:20 UTC	222	OUT	GET /adfs/portal/css/style.css?id=0A13280A86E7DFA6949BD016EA848912FCAFC05E88CBEDF538AC325B27041205 HTTP/1.1 Host: os2d0we54yl.leviandsonsco.sbs Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://os2d0we54yl.leviandsonsco.sbs/redirect.cgi?ref=aHR0cHM6Ly9jb3JwLnN0cy5lc3NpdHkuY29tL2FkZnMvbHMvP2xvZ2luX2hpbnQ9cm9iZXJ0Lm1hZ3VpcmUlNDBlc3NpdHkuY29tJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0xMDkwOWU5NC1hZTgyLTRjZGYtOTczMC0yNGQxODc1YjU1ZDkmdXNlcm5hbWU9cm9iZXJ0Lm1hZ3VpcmUlNDBlc3NpdHkuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFoWklfak50MEdJYmo1QzVjbzBLUGdxcFdZcmloQTBMRThYX0hKMVdxNHppT0U5dnhKVTRjaHlHS0hTZXh6X2JQRnp0eDdCRUdZRHNoQk5JTkRCMFB4TUFFREFpSjdhWmpwQXQwYXl1ZFZERjFKTmZPRmN2M2ZwLS1aM3VmMGg0Rm94aU13c2hIQlF4R0R1OFRORVVTQkdtV2NjeWl5Z1JqSXVVcWJsTmxkTXJnMnhkR1U5WmtlYnUwX19WM3BfdWZfdmkzOUMxeV84X1BQLW5fZFE0ZExPSTRqQTRybFNSSllEQ2JPWllOVzhDdmVKTmc2Z1R6TmZZekJGMUMwRmY1ZTB0ZzJzc1k5aWZ6bGJPMEg5cFI1TVRwTlh1VzM3V0Rjcjkzbm84b25HWXdoa0Z3bXFZSWlxS3FLR3hnQm1HNGl0dlJ4VmpSdTU3c0lNZzJmVW5uVTBYZ1kwV1FOekxXWFNqdXdwZDlBMVUwRVRkOG1leG9jdHk1WnJhOG9iZGNTWnVUb3pvYkc3NlJ5dTQ4NmVnTlY5YjdtOGY1V3gxMkZTLXc2d0dXVG1iX203OHhBMHRfSElJb1BpdDhreGZLQS1fRWl0TmhDeHhOTW1VYVVhb2U2TFRRckkxYlhWbmhqaFF4c256Rko1aTBtcVExSDNFQWE2ck5yTWJqYnFaS0FwY2VZeHVwM1dGUHpGYWNhSkltMWZzbkFkdHFyQlN5NTFUWmhsc2J0dE5wdGpDcERjR0xEajVXRU5CSW1mVkFhUm8xVjYtbGRaV2lZdEludXhNRW5mWEVPY21OZTQ0dm5sUUJHb1JleHJzcFl5eklMR3ZKbE5GMWVMR0tpVzFLellacGltTk5ka3hnb2JsQjZ1dFJRbUprTTdSV2c3bk1vZ05kSFRsY3UtR2xlSXNQWkZWYjBOSjBCZ0NWbElsTjY3aV9PRTZUa2FlVzlaWG5oeDA4WEhZald6RGFOWEV3Q0wxV2NsNjQ5NGJxMTloUGhlSjI4VUZ3VWFCQmFBZk85Q0JjZ3BuajJXX1NaWTFWT3EtdUp2QnRtUFc4eXgzby1jNmR2ZUwtemJ2UVFlN0Q5NUhDNGQ1ZWFUOTNOM2VRZTdrRFBkcmQydmpQTV9YN1AzNTRXdl9seThIWmI0OC15RjNzVmtSaHJtaTlrRnczdUNVSXB3SWc1MGNhWVk4NGRHVWVhUnhOY1l6WllIMXRhRmdQaUVQMHRBaWRGb3NYeFhmRi1samh0WjdHS25XMlc4Zkd5SXNpOU1WYnVWOXZfS19majItLVZ5cXRuTEVIcklsblI3ZGZ1X3o3MjdtWDcxeS1lSHIxMmRXVHEtYnpXeC1yNkR3YjRpU0lCUFI0bGpxZUpOak5NSmx5V1FBUWpwY21QY01UUWRmcnJUWHc0RDgxIw== Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: qPdM=o4TLQbDeXLet; qPdM.sig=mA0V-r93uuyYn0uJI_z87xzzVQc; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AQoAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrDN3pm17rsOj_Wfa8ShXnQ-m4hHK9psXc4wzSF_MbfM0ueczWoWwrGKCGCeRmKeYEQZYIKBMsGC-mskTYaFDHa9W6d4slt6X2b8PtRM0lWqogAA; ESTSWCTXFLOWTOKEN=AQABAAEAAAD--DLA3VO7QrddgJg7WevrfLtLLFu2JHML42OPO7ux4GpYDosmZIrX3bto_HALnfr2ap5ECEs9vXzweNzHelNWyOAZCom5A_ewe8g25v2MxuSY6R8tOzVGHQJGwCKyjTiZ3ZVEgo7unQuEEt639hajkSuAIfTu4F70mdWqhQhgnsoz2VZH5n4lY6etP2jUTI1uHumOaebgbTCX5fqkHB6LKvJCFHi4goTPCthyA-LU2J5ybwqm-LSrFdTr-t_G4o7Iff98LgK0pmadFV_adLCFBFyUvV4UkV1D37n-kZ-lXA5REQmZxn_lFwVBd6NgaiAQk_y5Gp-UPZ7izmIGsXihdshXnirLigHJYxU-66ORysi9xsi-4qY4ra42KjnYwyoruxdeFLqQRaJYyexgYDsN8wXBS7RHAFwDlHp67P37rAu3bjPcnHXR2znyrljeg6Mu1l8fLrFixfy1mP_VDkAlpTl4RPzhnOTXaGTs-EprCL7E1YaClwKatlQvNLg_it4lb-0A8rYqLEiWLdMjQYGoUO7da-llLssjAyAfy4lMkZ1e0gaUXrDHIAdSOHc-Lk-FgKoysUWI_O35JflIZXiYIAA; fpc=Aj69XZw8uwlLgstMd7ZN4ui8Ae7AAQAAAPZCSNwOAAAA; esctx=PAQABAAEAAAD--DLA3VO7QrddgJg7WevrigLsCd_rcdVtxJNlDm1hg6kRBDPhmC7POTm0mkGHCzrL2uGWcLZjiRQ4QYylHt7Zn-B-GlpXdu1XWW_yzeS7cdW-snz_q3NH1LNrHRXQ29-uSfQwvfeeRMg7FLtuUx4iZEvzxQOsufYm1Jt9vp0-181x1oXgaE2dZn57T5r2-R4gAA
2023-07-18 08:23:20 UTC	231	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 705a83bc-afec-4710-af3a-258be42e7301 x-ms-ests-server: 2.1.15771.4 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Date: Tue, 18 Jul 2023 08:23:19 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Essity Invoice 10903258 .HTML

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 222

Chrome Cache Entry: 223

Chrome Cache Entry: 224

Chrome Cache Entry: 225

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Windows Analysis Report
Essity Invoice 10903258 .HTML

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:20 UTC	226	OUT	GET /adfs/portal/logo/logo.png?id=4763FF523B7C10B9E6B3A54908F0E3460038413A696D6B1BC6D1BAD1BED7DDC5 HTTP/1.1 Host: os2d0we54yl.leviandsonsco.sbs Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://os2d0we54yl.leviandsonsco.sbs/redirect.cgi?ref=aHR0cHM6Ly9jb3JwLnN0cy5lc3NpdHkuY29tL2FkZnMvbHMvP2xvZ2luX2hpbnQ9cm9iZXJ0Lm1hZ3VpcmUlNDBlc3NpdHkuY29tJm1rdD1lbi1VUyZjbGllbnQtcmVxdWVzdC1pZD0xMDkwOWU5NC1hZTgyLTRjZGYtOTczMC0yNGQxODc1YjU1ZDkmdXNlcm5hbWU9cm9iZXJ0Lm1hZ3VpcmUlNDBlc3NpdHkuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFoWklfak50MEdJYmo1QzVjbzBLUGdxcFdZcmloQTBMRThYX0hKMVdxNHppT0U5dnhKVTRjaHlHS0hTZXh6X2JQRnp0eDdCRUdZRHNoQk5JTkRCMFB4TUFFREFpSjdhWmpwQXQwYXl1ZFZERjFKTmZPRmN2M2ZwLS1aM3VmMGg0Rm94aU13c2hIQlF4R0R1OFRORVVTQkdtV2NjeWl5Z1JqSXVVcWJsTmxkTXJnMnhkR1U5WmtlYnUwX19WM3BfdWZfdmkzOUMxeV84X1BQLW5fZFE0ZExPSTRqQTRybFNSSllEQ2JPWllOVzhDdmVKTmc2Z1R6TmZZekJGMUMwRmY1ZTB0ZzJzc1k5aWZ6bGJPMEg5cFI1TVRwTlh1VzM3V0Rjcjkzbm84b25HWXdoa0Z3bXFZSWlxS3FLR3hnQm1HNGl0dlJ4VmpSdTU3c0lNZzJmVW5uVTBYZ1kwV1FOekxXWFNqdXdwZDlBMVUwRVRkOG1leG9jdHk1WnJhOG9iZGNTWnVUb3pvYkc3NlJ5dTQ4NmVnTlY5YjdtOGY1V3gxMkZTLXc2d0dXVG1iX203OHhBMHRfSElJb1BpdDhreGZLQS1fRWl0TmhDeHhOTW1VYVVhb2U2TFRRckkxYlhWbmhqaFF4c256Rko1aTBtcVExSDNFQWE2ck5yTWJqYnFaS0FwY2VZeHVwM1dGUHpGYWNhSkltMWZzbkFkdHFyQlN5NTFUWmhsc2J0dE5wdGpDcERjR0xEajVXRU5CSW1mVkFhUm8xVjYtbGRaV2lZdEludXhNRW5mWEVPY21OZTQ0dm5sUUJHb1JleHJzcFl5eklMR3ZKbE5GMWVMR0tpVzFLellacGltTk5ka3hnb2JsQjZ1dFJRbUprTTdSV2c3bk1vZ05kSFRsY3UtR2xlSXNQWkZWYjBOSjBCZ0NWbElsTjY3aV9PRTZUa2FlVzlaWG5oeDA4WEhZald6RGFOWEV3Q0wxV2NsNjQ5NGJxMTloUGhlSjI4VUZ3VWFCQmFBZk85Q0JjZ3BuajJXX1NaWTFWT3EtdUp2QnRtUFc4eXgzby1jNmR2ZUwtemJ2UVFlN0Q5NUhDNGQ1ZWFUOTNOM2VRZTdrRFBkcmQydmpQTV9YN1AzNTRXdl9seThIWmI0OC15RjNzVmtSaHJtaTlrRnczdUNVSXB3SWc1MGNhWVk4NGRHVWVhUnhOY1l6WllIMXRhRmdQaUVQMHRBaWRGb3NYeFhmRi1samh0WjdHS25XMlc4Zkd5SXNpOU1WYnVWOXZfS19majItLVZ5cXRuTEVIcklsblI3ZGZ1X3o3MjdtWDcxeS1lSHIxMmRXVHEtYnpXeC1yNkR3YjRpU0lCUFI0bGpxZUpOak5NSmx5V1FBUWpwY21QY01UUWRmcnJUWHc0RDgxIw== Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: qPdM=o4TLQbDeXLet; qPdM.sig=mA0V-r93uuyYn0uJI_z87xzzVQc; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AQoAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrDN3pm17rsOj_Wfa8ShXnQ-m4hHK9psXc4wzSF_MbfM0ueczWoWwrGKCGCeRmKeYEQZYIKBMsGC-mskTYaFDHa9W6d4slt6X2b8PtRM0lWqogAA; ESTSWCTXFLOWTOKEN=AQABAAEAAAD--DLA3VO7QrddgJg7WevrfLtLLFu2JHML42OPO7ux4GpYDosmZIrX3bto_HALnfr2ap5ECEs9vXzweNzHelNWyOAZCom5A_ewe8g25v2MxuSY6R8tOzVGHQJGwCKyjTiZ3ZVEgo7unQuEEt639hajkSuAIfTu4F70mdWqhQhgnsoz2VZH5n4lY6etP2jUTI1uHumOaebgbTCX5fqkHB6LKvJCFHi4goTPCthyA-LU2J5ybwqm-LSrFdTr-t_G4o7Iff98LgK0pmadFV_adLCFBFyUvV4UkV1D37n-kZ-lXA5REQmZxn_lFwVBd6NgaiAQk_y5Gp-UPZ7izmIGsXihdshXnirLigHJYxU-66ORysi9xsi-4qY4ra42KjnYwyoruxdeFLqQRaJYyexgYDsN8wXBS7RHAFwDlHp67P37rAu3bjPcnHXR2znyrljeg6Mu1l8fLrFixfy1mP_VDkAlpTl4RPzhnOTXaGTs-EprCL7E1YaClwKatlQvNLg_it4lb-0A8rYqLEiWLdMjQYGoUO7da-llLssjAyAfy4lMkZ1e0gaUXrDHIAdSOHc-Lk-FgKoysUWI_O35JflIZXiYIAA; fpc=Aj69XZw8uwlLgstMd7ZN4ui8Ae7AAQAAAPZCSNwOAAAA; esctx=PAQABAAEAAAD--DLA3VO7QrddgJg7WevrigLsCd_rcdVtxJNlDm1hg6kRBDPhmC7POTm0mkGHCzrL2uGWcLZjiRQ4QYylHt7Zn-B-GlpXdu1XWW_yzeS7cdW-snz_q3NH1LNrHRXQ29-uSfQwvfeeRMg7FLtuUx4iZEvzxQOsufYm1Jt9vp0-181x1oXgaE2dZn57T5r2-R4gAA
2023-07-18 08:23:20 UTC	229	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 96835288-6b9b-4b31-b3ac-e65712993c01 x-ms-ests-server: 2.1.15771.4 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Date: Tue, 18 Jul 2023 08:23:20 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:21 UTC	232	OUT	GET /adfs/ls/?login_hint=robert.maguire%40essity.com&mkt=en-US&client-request-id=10909e94-ae82-4cdf-9730-24d1875b55d9&username=robert.maguire%40essity.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0GIbj5C5co0KPgqpWYrihA0LE8X_HJ1Wq4ziOE9vxJU4chyGKHSexz_bPFztx7BEGYDshBNINDB0PxMAEDAiJ7aZjpAt0ayudVDF1JNfOFcv3fp--Z3uf0h4FoxiMwshHBQxGDu8TNEUSBGmWccyiygRjIuUqblNldMrg2xdGU9Zkebu0__V3p_uf_vi39C1y_8_PP-n_dQ4dLOI4jA4rlSRJYDCbOZYNW8CveJNg6gTzNfYzBF1C0Ff5e0tg2ssY9ifzlbO0H9pR5MTpNXuW37WDcr93no8onGYwhkFwmqYIiqKqKGxgBmG4itvRxVjRu57sIMg2fUnnU0XgY0WQNzLWXSjuwpd9A1U0ETd8mexocty5Zra8obdcSZuTozobG76Ryu486egNV9b7m8f5Wx12FS-w6wGWTmb_m78xA0t_HIIoPit8kxfKA-_EitNhCxxNMmUaUaoe6LTQrI1bXVnhjhQxsnzFJ5i0mqQ1H3EAa6rNrMbjbqZKApceYxup3WFPzFacaJIm1fsnAdtqrBSy51TZhlsbttNptjCpDcGLDj5WENBImfVAaRo1V6-ldZWiYtInuxMEnfXEOcmNe44vnlQBGoRexrspYyzILGvJlNF1eLGKiW1KzYZpimNNdkxgoblB6utRQmJkM7RWg7nMogNdHTlcu-GleIsPZFVb0NJ0BgCVlIlN67i_OE6TkaeW9ZXnhx08XHYjWzDaNXEwCL1Wcl6494bq19hPheJ28UFwUaBBaAfO9CBcgpnj2W_SZY1VOq-uJvBtmPW8yx3o-c6dveL-zbvQQe7D95HC4d5eaT93N3eQe7kDPdrd2vjPM_X7P354Wv_ly8HZb48-yF3sVkRhrmi9kFw3uCUIpwIg50caYY84dGUeaRxNcYzZYH1taFgPiEP0tAidFosXxXfF-ljhtZ7GKnW2W8fGyIsi9MVbuV9v_K_fj2--VyqtnLEHrIlnR7dfu_z727mX71y-eHr12dWTq-bzWx-r6Dwb4iSIBPR4ljqeJNjNMJlyWQAQjpcmPcMTQdfrrTXw4D81&pullStatus=0 HTTP/1.1 Host: corp.sts.essity.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://os2d0we54yl.leviandsonsco.sbs/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:21 UTC	236	IN	HTTP/1.1 200 OK Cache-Control: no-cache,no-store Pragma: no-cache Content-Length: 19514 Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 X-Frame-Options: allow-from https://*.essity.com Date: Tue, 18 Jul 2023 08:23:21 GMT Set-Cookie: NSC_MCWT_QSPE_BEGT-FYU_Xfc_443_TTM=ffffffff09e62aa445525d5f4f58455e445a4a42378b;expires=Tue, 18-Jul-2023 08:38:32 GMT;path=/;secure;httponly Strict-Transport-Security: max-age=157680000
2023-07-18 08:23:21 UTC	236	IN	Data Raw: 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 31 22 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f Data Ascii: <!DOCTYPE html><html lang="en-GB"> <head> <meta http-equiv="X-UA-Compatible" content="IE=edge"/> <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=1"/> <meta http-equiv="content-type" co
2023-07-18 08:23:21 UTC	243	IN	Data Raw: 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 73 3d 27 6c 6f 67 6f 49 6d 61 67 65 27 20 69 64 3d 27 63 6f 6d 70 61 6e 79 4c 6f 67 6f 27 20 73 72 63 3d 27 2f 61 64 66 73 2f 70 6f 72 74 61 6c 2f 6c 6f 67 6f 2f 6c 6f 67 6f 2e 70 6e 67 3f 69 64 3d 34 37 36 33 46 46 35 32 33 42 37 43 31 30 42 39 45 36 42 33 41 35 34 39 30 38 46 30 45 33 34 36 30 30 33 38 34 31 33 41 36 39 36 44 36 42 31 42 43 36 44 31 42 41 44 31 42 45 44 37 44 44 43 35 27 20 61 6c 74 3d 27 45 73 73 69 74 79 27 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f Data Ascii: <div id="content"> <div id="header"> <img class='logoImage' id='companyLogo' src='/adfs/portal/logo/logo.png?id=4763FF523B7C10B9E6B3A54908F0E3460038413A696D6B1BC6D1BAD1BED7DDC5' alt='Essity'/> </
2023-07-18 08:23:21 UTC	250	IN	Data Raw: 6f 72 6d 73 5b 27 6c 6f 67 69 6e 46 6f 72 6d 27 5d 2e 73 75 62 6d 69 74 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 49 6e 70 75 74 55 74 69 6c 2e 6d 61 6b 65 50 6c 61 63 65 68 6f 6c 64 65 72 28 4c 6f 67 69 6e 2e 75 73 65 72 4e 61 6d 65 49 6e 70 75 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 49 6e 70 75 74 55 74 69 6c 2e 6d 61 6b 65 50 6c 61 63 65 68 6f 6c 64 65 72 28 4c 6f 67 69 6e 2e 70 61 73 73 77 6f 72 64 49 6e 70 75 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 2f 2f 5d 5d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 0d 0a 20 20 20 20 3c 2f 64 Data Ascii: orms['loginForm'].submit(); return false; }; InputUtil.makePlaceholder(Login.userNameInput); InputUtil.makePlaceholder(Login.passwordInput); //... </script> </div> </d

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:21 UTC	234	OUT	GET /?sign=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL29oaHI2MDlsd2drLmxldmlhbmRzb25zY28uaG9tZXMiLCJkb21haW4iOiJvaGhyNjA5bHdnay5sZXZpYW5kc29uc2NvLmhvbWVzIiwia2V5IjoiTTcwdTVjazR2b1MwIiwicXJjIjoicm9iZXJ0Lm1hZ3VpcmVAZXNzaXR5LmNvbSIsImlhdCI6MTY4OTY2ODU5NiwiZXhwIjoxNjg5NjY4NzE2fQ.2z2y0KeKAyqBwk6KKz-yFQJVkUnkbdGKNnHXzUF82lY HTTP/1.1 Host: ohhr609lwgk.leviandsonsco.homes Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:21 UTC	235	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=M70u5ck4voS0; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=T8PCWKLnN1AuvDCB-eCtbRdC92U; path=/; samesite=none; secure; httponly location: /__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&ste=tqdgtv.ociwktg%40guukva.eqo Date: Tue, 18 Jul 2023 08:23:21 GMT Connection: close Transfer-Encoding: chunked
2023-07-18 08:23:21 UTC	236	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:22 UTC	301	OUT	GET /adfs/portal/illustration/illustration.png?id=9009666739F3CCB6C310E624F42FE5EC5D009BAD82E9E02FB9C9389C28D23119 HTTP/1.1 Host: corp.sts.essity.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://corp.sts.essity.com/adfs/ls/?login_hint=robert.maguire%40essity.com&mkt=en-US&client-request-id=10909e94-ae82-4cdf-9730-24d1875b55d9&username=robert.maguire%40essity.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0GIbj5C5co0KPgqpWYrihA0LE8X_HJ1Wq4ziOE9vxJU4chyGKHSexz_bPFztx7BEGYDshBNINDB0PxMAEDAiJ7aZjpAt0ayudVDF1JNfOFcv3fp--Z3uf0h4FoxiMwshHBQxGDu8TNEUSBGmWccyiygRjIuUqblNldMrg2xdGU9Zkebu0__V3p_uf_vi39C1y_8_PP-n_dQ4dLOI4jA4rlSRJYDCbOZYNW8CveJNg6gTzNfYzBF1C0Ff5e0tg2ssY9ifzlbO0H9pR5MTpNXuW37WDcr93no8onGYwhkFwmqYIiqKqKGxgBmG4itvRxVjRu57sIMg2fUnnU0XgY0WQNzLWXSjuwpd9A1U0ETd8mexocty5Zra8obdcSZuTozobG76Ryu486egNV9b7m8f5Wx12FS-w6wGWTmb_m78xA0t_HIIoPit8kxfKA-_EitNhCxxNMmUaUaoe6LTQrI1bXVnhjhQxsnzFJ5i0mqQ1H3EAa6rNrMbjbqZKApceYxup3WFPzFacaJIm1fsnAdtqrBSy51TZhlsbttNptjCpDcGLDj5WENBImfVAaRo1V6-ldZWiYtInuxMEnfXEOcmNe44vnlQBGoRexrspYyzILGvJlNF1eLGKiW1KzYZpimNNdkxgoblB6utRQmJkM7RWg7nMogNdHTlcu-GleIsPZFVb0NJ0BgCVlIlN67i_OE6TkaeW9ZXnhx08XHYjWzDaNXEwCL1Wcl6494bq19hPheJ28UFwUaBBaAfO9CBcgpnj2W_SZY1VOq-uJvBtmPW8yx3o-c6dveL-zbvQQe7D95HC4d5eaT93N3eQe7kDPdrd2vjPM_X7P354Wv_ly8HZb48-yF3sVkRhrmi9kFw3uCUIpwIg50caYY84dGUeaRxNcYzZYH1taFgPiEP0tAidFosXxXfF-ljhtZ7GKnW2W8fGyIsi9MVbuV9v_K_fj2--VyqtnLEHrIlnR7dfu_z727mX71y-eHr12dWTq-bzWx-r6Dwb4iSIBPR4ljqeJNjNMJlyWQAQjpcmPcMTQdfrrTXw4D81&pullStatus=0 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:22 UTC	303	IN	HTTP/1.1 200 OK Content-Length: 2514 Content-Type: image/png Expires: Thu, 17 Aug 2023 08:23:22 GMT ETag: 9009666739F3CCB6C310E624F42FE5EC5D009BAD82E9E02FB9C9389C28D23119 Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 Date: Tue, 18 Jul 2023 08:23:22 GMT Set-Cookie: NSC_MCWT_QSPE_BEGT-FYU_Xfc_443_TTM=ffffffff09e62aa445525d5f4f58455e445a4a42378b;expires=Tue, 18-Jul-2023 08:38:33 GMT;path=/;secure;httponly Strict-Transport-Security: max-age=157680000
2023-07-18 08:23:22 UTC	304	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 22 00 00 01 c1 08 06 00 00 00 95 02 0f 5b 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c2 00 00 0e c2 01 15 28 4a 80 00 00 09 67 49 44 41 54 78 5e ed d7 b1 0d 83 50 10 05 c1 c3 29 5d d3 8b 7b 72 23 c4 1f 09 51 00 72 b0 d1 4c 70 f7 5a d8 ed 9c 63 0d f0 97 7d 7e cf 02 00 e0 8d b5 be f7 ff dc 17 00 00 20 24 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 Data Ascii: PNGIHDR"[sRGBgAMAapHYs(JgIDATx^P)]{r#QrLpZc}~ $DrB 'DrB 'DrB 'DrB 'DrB 'D

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:10 UTC	4	OUT	GET /?vkxgkcdb&qrc=robert.maguire@essity.com HTTP/1.1 Host: leviandsonsco.fun Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:10 UTC	4	IN	HTTP/1.1 200 OK Set-Cookie: qPdM=XfXnciNRZYEP; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=nUg0db9y3Am21RJs461NZw1cIFU; path=/; samesite=none; secure; httponly content-type: application/json Access-Control-Allow-Origin: * Date: Tue, 18 Jul 2023 08:23:10 GMT Connection: close Transfer-Encoding: chunked
2023-07-18 08:23:10 UTC	5	IN	Data Raw: 31 37 64 0d 0a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 62 78 76 69 6c 79 66 61 77 74 2e 6c 65 76 69 61 6e 64 73 6f 6e 73 63 6f 2e 74 61 74 74 6f 6f 3f 73 69 67 6e 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 31 63 6d 77 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 69 65 48 5a 70 62 48 6c 6d 59 58 64 30 4c 6d 78 6c 64 6d 6c 68 62 6d 52 7a 62 32 35 7a 59 32 38 75 64 47 46 30 64 47 39 76 49 69 77 69 5a 47 39 74 59 57 6c 75 49 6a 6f 69 5a 32 4a 34 64 6d 6c 73 65 57 5a 68 64 33 51 75 62 47 56 32 61 57 46 75 5a 48 4e 76 62 6e 4e 6a 62 79 35 30 59 58 52 30 62 32 38 69 4c 43 4a 72 5a 58 6b 69 4f 69 4a 59 5a 6c 68 75 59 32 6c 4f 55 6c 70 5a 52 56 41 69 4c 43 4a 78 63 6d 4d Data Ascii: 17d{"url":"https://gbxvilyfawt.leviandsonsco.tattoo?sign=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2dieHZpbHlmYXd0LmxldmlhbmRzb25zY28udGF0dG9vIiwiZG9tYWluIjoiZ2J4dmlseWZhd3QubGV2aWFuZHNvbnNjby50YXR0b28iLCJrZXkiOiJYZlhuY2lOUlpZRVAiLCJxcmM

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:23 UTC	329	OUT	GET /adfs/portal/logo/logo.png?id=4763FF523B7C10B9E6B3A54908F0E3460038413A696D6B1BC6D1BAD1BED7DDC5 HTTP/1.1 Host: corp.sts.essity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:23 UTC	330	IN	HTTP/1.1 200 OK Content-Length: 34194 Content-Type: image/png Expires: Thu, 17 Aug 2023 08:23:23 GMT ETag: 4763FF523B7C10B9E6B3A54908F0E3460038413A696D6B1BC6D1BAD1BED7DDC5 Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 Date: Tue, 18 Jul 2023 08:23:23 GMT Set-Cookie: NSC_MCWT_QSPE_BEGT-FYU_Xfc_443_TTM=ffffffff09e62aa445525d5f4f58455e445a4a42378b;expires=Tue, 18-Jul-2023 08:38:34 GMT;path=/;secure;httponly Strict-Transport-Security: max-age=157680000
2023-07-18 08:23:23 UTC	330	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 7a 00 00 00 20 08 06 00 00 00 dd 4c 6c 75 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1 11 45 45 04 1b c8 a0 88 03 8e 8e 80 8c 15 51 2c 0c 8a 0a d8 07 e4 21 a2 8e 83 a3 88 8a ca fb e1 7b a3 6b d6 bc f7 e6 cd fe b5 d7 3e e7 ac f3 9d b3 cf 07 c0 08 0c 96 48 33 51 35 80 0c a9 42 1e 11 e0 83 c7 c4 c6 e1 e4 2e 40 81 0a 24 70 00 10 08 b3 64 21 73 fd 23 01 00 f8 7e 3c 3c 2b 22 c0 07 be 00 01 78 d3 0b 08 00 c0 4d 9b c0 30 1c 87 ff 0f ea 42 99 5c 01 80 84 01 c0 74 91 38 4b Data Ascii: PNGIHDRz LlupHYsOiCCPPhotoshop ICC profilexSgTS=BKKoR RB&*!J!QEEQ,!{k>H3Q5B.@$pd!s#~<<+"xM0B\t8K
2023-07-18 08:23:23 UTC	337	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2023-07-18 08:23:23 UTC	344	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2023-07-18 08:23:23 UTC	351	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 f6 00 00 00 43 00 00 00 d9 00 00 00 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 Data Ascii: C
2023-07-18 08:23:23 UTC	358	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 39 00 00 5a 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8a 00 00 00 cf 00 00 00 cf 00 00 00 cf 00 00 00 65 00 00 00 00 00 00 00 a5 00 00 00 bf 00 00 00 bf 00 00 00 bf 00 00 5a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 5e 00 00 00 bf 00 00 00 bf 00 00 00 bf 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 e7 00 00 00 c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 9Z=eZ$^j

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:24 UTC	364	OUT	GET /adfs/portal/illustration/illustration.png?id=9009666739F3CCB6C310E624F42FE5EC5D009BAD82E9E02FB9C9389C28D23119 HTTP/1.1 Host: corp.sts.essity.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: NSC_MCWT_QSPE_BEGT-FYU_Xfc_443_TTM=ffffffff09e62aa445525d5f4f58455e445a4a42378b
2023-07-18 08:23:24 UTC	364	IN	HTTP/1.1 200 OK Content-Length: 2514 Content-Type: image/png Expires: Thu, 17 Aug 2023 08:23:24 GMT ETag: 9009666739F3CCB6C310E624F42FE5EC5D009BAD82E9E02FB9C9389C28D23119 Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 Date: Tue, 18 Jul 2023 08:23:23 GMT Set-Cookie: NSC_MCWT_QSPE_BEGT-FYU_Xfc_443_TTM=ffffffff09e62aa445525d5f4f58455e445a4a42378b;expires=Tue, 18-Jul-2023 08:38:35 GMT;path=/;secure;httponly Strict-Transport-Security: max-age=157680000
2023-07-18 08:23:24 UTC	365	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 22 00 00 01 c1 08 06 00 00 00 95 02 0f 5b 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c2 00 00 0e c2 01 15 28 4a 80 00 00 09 67 49 44 41 54 78 5e ed d7 b1 0d 83 50 10 05 c1 c3 29 5d d3 8b 7b 72 23 c4 1f 09 51 00 72 b0 d1 4c 70 f7 5a d8 ed 9c 63 0d f0 97 7d 7e cf 02 00 e0 8d b5 be f7 ff dc 17 00 00 20 24 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 9c 10 01 00 00 72 42 04 00 00 c8 09 11 00 00 20 27 44 00 00 80 Data Ascii: PNGIHDR"[sRGBgAMAapHYs(JgIDATx^P)]{r#QrLpZc}~ $DrB 'DrB 'DrB 'DrB 'DrB 'D

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:48 UTC	367	OUT	GET / HTTP/1.1 Host: www.essity.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:48 UTC	368	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Last-Modified: Tue, 18 Jul 2023 08:23:48 GMT Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Xss-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Date: Tue, 18 Jul 2023 08:23:48 GMT Set-Cookie: NSC_MCWT_MW_fttjuz_dpn_80_IUUQ=5ccba3d877455a6c41ae9e20a98c437bd6bdbcb8431fa2335a10947106ab0b17baee16f3;Version=1;Max-Age=1800;path=/;secure;httponly;SameSite=None; Secure Strict-Transport-Security: max-age=31536000 Transfer-Encoding: chunked
2023-07-18 08:23:48 UTC	368	IN	Data Raw: 34 62 66 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 74 6f 75 63 68 65 76 65 6e 74 73 20 66 6c 65 78 62 6f 78 20 6e 6f 2d 66 6c 65 78 62 6f 78 74 77 65 65 6e 65 72 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 21 2d 2d 20 4f 6e 65 54 72 75 73 74 20 43 6f 6f 6b 69 65 73 20 43 6f 6e 73 65 6e 74 20 4e 6f 74 69 63 65 20 73 74 61 72 74 20 66 6f 72 20 77 77 77 2e 65 73 73 69 74 79 2e 63 6f 6d 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 75 6b 77 65 73 74 2e 6f 6e 65 74 72 75 73 74 2e 63 6f 6d 2f 63 6f 6e 73 65 6e 74 Data Ascii: 4bf<!DOCTYPE html><html lang="en" class="no-touchevents flexbox no-flexboxtweener">...<![endif]--><head>... OneTrust Cookies Consent Notice start for www.essity.com --><script type="text/javascript" src="https://cdn-ukwest.onetrust.com/consent
2023-07-18 08:23:48 UTC	375	IN	Data Raw: 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 21 21 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2c 69 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 26 26 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 20 69 6e 73 74 61 6e 63 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 26 26 73 65 6c 66 2e 6e 61 76 69 67 61 74 6f 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 57 6f 72 6b 65 72 4e 61 76 69 67 61 74 6f 72 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 26 26 67 Data Ascii: !=typeof window&&!!window.document,i="undefined"!=typeof WorkerGlobalScope&&("undefined"!=typeof self&&self instanceof WorkerGlobalScope&&self.navigator instanceof WorkerNavigator\|\|"undefined"!=typeof globalThis&&globalThis instanceof WorkerGlobalScope&&g
2023-07-18 08:23:48 UTC	382	IN	Data Raw: 4c 48 74 74 70 52 65 71 75 65 73 74 2c 52 45 51 3a 69 2e 5f 41 2e 52 65 71 75 65 73 74 2c 45 56 3a 69 2e 5f 41 2e 45 76 65 6e 74 2c 50 52 3a 69 2e 5f 41 2e 50 72 6f 6d 69 73 65 2c 4d 4f 3a 69 2e 5f 41 2e 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 2c 46 45 54 43 48 3a 69 2e 5f 41 2e 66 65 74 63 68 7d 29 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 63 28 65 2c 74 2c 6e 29 7b 6c 65 74 20 69 3d 61 28 29 3b 63 6f 6e 73 74 20 6f 3d 69 2e 69 6e 69 74 69 61 6c 69 7a 65 64 41 67 65 6e 74 73 7c 7c 7b 7d 2c 73 3d 6f 5b 65 5d 7c 7c 7b 7d 3b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6c 65 6e 67 74 68 7c 7c 28 73 2e 69 6e 69 74 69 61 6c 69 7a 65 64 41 74 3d 7b 6d 73 3a 28 30 2c 72 2e 7a 29 28 29 2c 64 61 74 65 3a 6e 65 77 20 44 61 74 65 7d 29 2c 69 Data Ascii: LHttpRequest,REQ:i._A.Request,EV:i._A.Event,PR:i._A.Promise,MO:i._A.MutationObserver,FETCH:i._A.fetch}),e}function c(e,t,n){let i=a();const o=i.initializedAgents\|\|{},s=o[e]\|\|{};return Object.keys(s).length\|\|(s.initializedAt={ms:(0,r.z)(),date:new Date}),i
2023-07-18 08:23:48 UTC	389	IN	Data Raw: 6f 76 65 43 68 69 6c 64 28 73 29 2c 69 26 26 69 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 65 28 72 29 29 29 2c 74 29 72 65 74 75 72 6e 20 74 28 72 29 7d 2c 67 3d 73 65 74 54 69 6d 65 6f 75 74 28 66 2e 62 69 6e 64 28 6e 75 6c 6c 2c 76 6f 69 64 20 30 2c 7b 74 79 70 65 3a 22 74 69 6d 65 6f 75 74 22 2c 74 61 72 67 65 74 3a 73 7d 29 2c 31 32 65 34 29 3b 73 2e 6f 6e 65 72 72 6f 72 3d 66 2e 62 69 6e 64 28 6e 75 6c 6c 2c 73 2e 6f 6e 65 72 72 6f 72 29 2c 73 2e 6f 6e 6c 6f 61 64 3d 66 2e 62 69 6e 64 28 6e 75 6c 6c 2c 73 2e 6f 6e 6c 6f 61 64 29 2c 63 26 26 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 29 7d 7d 2c 69 2e 72 3d 65 3d 3e 7b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f Data Ascii: oveChild(s),i&&i.forEach((e=>e(r))),t)return t(r)},g=setTimeout(f.bind(null,void 0,{type:"timeout",target:s}),12e4);s.onerror=f.bind(null,s.onerror),s.onload=f.bind(null,s.onload),c&&document.head.appendChild(s)}},i.r=e=>{"undefined"!=typeof Symbol&&Symbo
2023-07-18 08:23:48 UTC	396	IN	Data Raw: 70 65 3a 22 6c 69 74 65 22 7d 29 7d 29 28 29 2c 77 69 6e 64 6f 77 2e 4e 52 42 41 3d 6f 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 45 73 73 69 74 79 20 2d 20 41 20 4c 65 61 64 69 6e 67 20 48 79 67 69 65 6e 65 20 61 6e 64 20 48 65 61 6c 74 68 20 43 6f 6d 70 61 6e 79 20 7c 20 47 6c 6f 62 61 6c 20 43 6f 72 70 6f 72 61 74 65 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 64 65 76 65 6c 6f 70 2c Data Ascii: pe:"lite"})})(),window.NRBA=o})();</script> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Essity - A Leading Hygiene and Health Company \| Global Corporate</title> <meta name="description" content="We develop,
2023-07-18 08:23:48 UTC	403	IN	Data Raw: 2f 6d 61 73 64 70 73 74 61 74 69 63 2e 61 7a 75 72 65 65 64 67 65 2e 6e 65 74 2f 65 73 73 69 74 79 2f 31 2e 39 39 2e 30 2d 72 65 6c 65 61 73 65 2e 37 2f 69 6d 67 2f 66 6c 61 67 73 2f 65 73 2e 73 76 67 22 20 61 6c 74 3d 22 53 70 61 69 6e 22 20 63 6c 61 73 73 3d 22 6c 61 7a 79 6c 6f 61 64 22 3e 0a 53 70 61 69 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 0a 0a 3c 21 2d 2d 20 53 65 61 72 63 68 62 61 72 20 73 74 61 72 74 2d 2d 3e 0a 0a 0a 3c 21 2d 2d 20 54 6f 70 20 53 65 61 72 63 68 20 53 54 41 52 54 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d Data Ascii: /masdpstatic.azureedge.net/essity/1.99.0-release.7/img/flags/es.svg" alt="Spain" class="lazyload">Spain </a> </div> </div> </div></div>... Searchbar start-->... Top Search START --><div class=
2023-07-18 08:23:48 UTC	410	IN	Data Raw: 6c 74 73 3a 20 70 61 67 69 6e 61 74 69 6f 6e 4e 6f 52 65 73 75 6c 74 0a 20 20 20 20 7d 3b 0a 0a 20 20 20 20 65 73 73 69 74 79 2e 66 69 6c 74 65 72 73 20 3d 20 66 69 6c 74 65 72 73 3b 0a 20 20 20 20 65 73 73 69 74 79 2e 73 65 61 72 63 68 20 3d 20 73 65 61 72 63 68 3b 0a 20 20 20 20 65 73 73 69 74 79 2e 74 72 61 6e 73 6c 61 74 69 6f 6e 73 20 3d 20 74 72 61 6e 73 6c 61 74 69 6f 6e 73 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 0a 20 20 20 20 0a 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6a 73 2d 66 69 78 65 64 20 6e 61 76 62 61 72 20 62 67 2d 6e 65 75 74 72 61 6c 2d 6c 69 67 68 74 65 73 74 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 Data Ascii: lts: paginationNoResult }; essity.filters = filters; essity.search = search; essity.translations = translations;</script> <div class="js-fixed navbar bg-neutral-lightest"> <div class="container"> <div class="navbar
2023-07-18 08:23:48 UTC	417	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0d 0a 34 62 64 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 72 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 67 61 2d 6d 65 6e 75 2d 69 74 65 6d 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 0a 20 20 20 20 3c 68 36 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d Data Ascii: </div> </div>4bd </div> <hr /> </div> <div class="mega-menu-items"> <h6> <a href=
2023-07-18 08:23:48 UTC	424	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 64 61 74 61 2d 63 6c 6f 73 65 3d 22 61 6c 6c 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 2d 69 63 6f 6e 20 6a 73 2d 74 6f 67 67 6c 65 20 74 78 74 2d 73 65 63 6f 6e 64 61 72 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 69 20 69 2d 63 61 72 65 74 2d 72 69 67 68 74 22 3e 3c 2f 69 3e 0a 20 20 20 20 20 20 20 20 20 20 0d 0a 34 62 64 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6a 73 2d 74 6f 67 67 6c 65 2d 77 72 61 70 20 Data Ascii: <button data-close="all" class="btn btn--icon js-toggle txt-secondary"> <i class="i i-caret-right"></i> 4bd </button> </div> <div class="js-toggle-wrap
2023-07-18 08:23:48 UTC	431	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 68 72 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 67 61 2d 6d 65 6e 75 2d 69 74 65 6d 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 0a 20 20 20 20 3c 68 36 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 69 6e 6e 6f 76 61 74 69 6f 6e 2d 61 74 2d 65 73 73 69 74 79 2f 70 72 6f 64 75 63 74 73 2d 61 6e 64 2d 73 6f 6c 75 74 69 6f 6e 73 2f 22 3e 50 72 6f 64 75 63 74 73 20 61 6e 64 20 53 6f 6c 75 74 69 6f 6e 73 3c 2f 61 3e 0a 20 20 20 20 3c 2f 68 36 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 0d 0a 34 62 64 0d 0a 20 20 Data Ascii: <hr /> </div> <div class="mega-menu-items"> <h6> <a href="/innovation-at-essity/products-and-solutions/">Products and Solutions</a> </h6> 4bd
2023-07-18 08:23:48 UTC	438	IN	Data Raw: 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 72 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 67 61 2d 6d 65 6e 75 2d 69 74 65 6d 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 0a 20 20 20 20 3c 68 36 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 69 6e 76 65 73 74 6f 72 73 2f 65 Data Ascii: </div> </div> </div> <hr /> </div> <div class="mega-menu-items"> <h6> <a href="/investors/e
2023-07-18 08:23:48 UTC	445	IN	Data Raw: 6f 6e 22 2c 0d 0a 20 20 61 6c 6c 6f 77 65 64 43 6f 6d 70 6f 6e 65 6e 74 54 79 70 65 73 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 73 63 68 65 6d 61 3a 20 22 74 63 6d 3a 33 33 39 2d 33 37 30 36 31 2d 38 22 2c 0d 0a 20 20 20 20 20 20 74 65 6d 70 6c 61 74 65 3a 20 22 74 63 6d 3a 33 33 39 2d 34 30 34 36 32 2d 33 32 22 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 73 63 68 65 6d 61 3a 20 22 74 63 6d 3a 33 33 39 2d 33 37 30 36 31 2d 38 22 2c 0d 0a 20 20 20 20 20 20 74 65 6d 70 6c 61 74 65 3a 20 22 74 63 6d 3a 33 33 39 2d 34 35 36 34 37 2d 33 32 22 0d 0a 20 20 20 20 7d 0d 0a 20 20 5d 2c 0d 0a 20 20 6d 69 6e 4f 63 63 75 72 73 3a 20 30 0d 0a 7d 20 2d 2d 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: on", allowedComponentTypes: [ { schema: "tcm:339-37061-8", template: "tcm:339-40462-32" }, { schema: "tcm:339-37061-8", template: "tcm:339-45647-32" } ], minOccurs: 0} -->
2023-07-18 08:23:48 UTC	453	IN	Data Raw: 64 79 6e 61 6d 69 63 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 77 69 70 65 72 2d 73 6c 69 64 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 65 73 73 69 74 79 2d 69 6d 61 67 65 73 2e 65 73 73 69 74 79 2e 63 6f 6d 2f 69 6d 61 67 65 73 2d 63 35 2f 31 37 39 2f 32 Data Ascii: dynamic" /> </span> </div> <div class="swiper-slide"> <span> <img src="https://essity-images.essity.com/images-c5/179/2
2023-07-18 08:23:48 UTC	460	IN	Data Raw: 20 20 20 20 20 20 20 4a 61 6e 75 61 72 79 20 32 36 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 70 72 65 73 73 2d 72 65 6c 65 61 73 65 2f 79 65 61 72 2d 65 6e 64 2d 72 65 70 6f 72 74 2d 32 30 32 32 2f 39 45 46 45 35 43 30 31 34 42 44 46 46 38 45 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 59 65 61 72 2d 65 6e 64 20 52 65 70 6f 72 74 20 32 30 32 32 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: January 26 </span> <a class="content-link" href="/media/press-release/year-end-report-2022/9EFE5C014BDFF8E3"> Year-end Report 2022 <
2023-07-18 08:23:48 UTC	467	IN	Data Raw: 61 67 65 73 2d 63 35 2f 39 36 34 2f 34 33 34 39 36 34 2f 6f 70 74 69 6d 69 7a 65 64 2d 77 31 34 34 30 5f 6a 70 67 2f 61 73 72 32 30 32 32 2d 63 6f 76 65 72 2d 74 65 6e 61 2d 73 69 6c 6c 6f 75 65 74 74 65 2d 31 39 32 30 78 31 30 38 30 2e 6a 70 67 3f 77 3d 38 33 35 26 68 3d 31 30 30 30 30 30 26 69 6d 50 6f 6c 69 63 79 3d 64 79 6e 61 6d 69 63 20 38 33 35 77 2c 0d 0a 68 74 74 70 73 3a 2f 2f 65 73 73 69 74 79 2d 69 6d 61 67 65 73 2e 65 73 73 69 74 79 2e 63 6f 6d 2f 69 6d 61 67 65 73 2d 63 35 2f 39 36 34 2f 34 33 34 39 36 34 2f 6f 70 74 69 6d 69 7a 65 64 2d 77 31 34 34 30 5f 6a 70 67 2f 61 73 72 32 30 32 32 2d 63 6f 76 65 72 2d 74 65 6e 61 2d 73 69 6c 6c 6f 75 65 74 74 65 2d 31 39 32 30 78 31 30 38 30 2e 6a 70 67 3f 77 3d 39 36 35 26 68 3d 31 30 30 30 30 30 26 Data Ascii: ages-c5/964/434964/optimized-w1440_jpg/asr2022-cover-tena-sillouette-1920x1080.jpg?w=835&h=100000&imPolicy=dynamic 835w,https://essity-images.essity.com/images-c5/964/434964/optimized-w1440_jpg/asr2022-cover-tena-sillouette-1920x1080.jpg?w=965&h=100000&
2023-07-18 08:23:49 UTC	474	IN	Data Raw: 67 3f 77 3d 32 34 30 26 68 3d 31 30 30 30 30 30 26 69 6d 50 6f 6c 69 63 79 3d 64 79 6e 61 6d 69 63 20 32 34 30 77 2c 0d 0a 68 74 74 70 73 3a 2f 2f 65 73 73 69 74 79 2d 69 6d 61 67 65 73 2e 65 73 73 69 74 79 2e 63 6f 6d 2f 69 6d 61 67 65 73 2d 63 35 2f 34 34 39 2f 33 36 38 34 34 39 2f 6f 70 74 69 6d 69 7a 65 64 2d 77 31 34 34 30 5f 6a 70 67 2f 6c 61 6e 64 73 63 61 70 65 2d 6f 66 2d 61 2d 6c 61 72 67 65 2d 68 61 79 2d 66 69 65 6c 64 2d 77 69 74 68 2d 6e 75 6d 65 72 6f 75 73 2d 73 74 72 61 77 2d 62 61 6c 65 73 2d 31 39 32 30 78 31 30 38 30 2e 6a 70 67 3f 77 3d 34 38 30 26 68 3d 31 30 30 30 30 30 26 69 6d 50 6f 6c 69 63 79 3d 64 79 6e 61 6d 69 63 20 34 38 30 77 2c 0d 0a 68 74 74 70 73 3a 2f 2f 65 73 73 69 74 79 2d 69 6d 61 67 65 73 2e 65 73 73 69 74 79 2e 63 Data Ascii: g?w=240&h=100000&imPolicy=dynamic 240w,https://essity-images.essity.com/images-c5/449/368449/optimized-w1440_jpg/landscape-of-a-large-hay-field-with-numerous-straw-bales-1920x1080.jpg?w=480&h=100000&imPolicy=dynamic 480w,https://essity-images.essity.c
2023-07-18 08:23:49 UTC	481	IN	Data Raw: 72 2d 74 61 62 6c 65 74 2d 38 30 30 78 35 30 30 2e 6a 70 67 3f 77 3d 31 33 35 31 26 68 3d 31 30 30 30 30 30 26 69 6d 50 6f 6c 69 63 79 3d 64 79 6e 61 6d 69 63 20 31 33 35 31 77 2c 0d 0a 68 74 74 70 73 3a 2f 2f 65 73 73 69 74 79 2d 69 6d 61 67 65 73 2e 65 73 73 69 74 79 2e 63 6f 6d 2f 69 6d 61 67 65 73 2d 63 35 2f 35 35 32 2f 34 34 35 35 35 32 2f 6f 70 74 69 6d 69 7a 65 64 2d 77 31 34 34 30 5f 6a 70 67 2f 74 6f 72 6b 2d 65 61 73 79 63 75 62 65 2d 63 6c 65 61 6e 65 72 2d 74 61 62 6c 65 74 2d 38 30 30 78 35 30 30 2e 6a 70 67 3f 77 3d 31 36 38 30 26 68 3d 31 30 30 30 30 30 26 69 6d 50 6f 6c 69 63 79 3d 64 79 6e 61 6d 69 63 20 31 36 38 30 77 0d 0a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 73 69 7a 65 73 3d 22 61 75 74 6f 22 3e 0a 0d 0a 20 20 20 Data Ascii: r-tablet-800x500.jpg?w=1351&h=100000&imPolicy=dynamic 1351w,https://essity-images.essity.com/images-c5/552/445552/optimized-w1440_jpg/tork-easycube-cleaner-tablet-800x500.jpg?w=1680&h=100000&imPolicy=dynamic 1680w" data-sizes="auto">
2023-07-18 08:23:49 UTC	488	IN	Data Raw: 61 3e 0a 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 6e 6b 65 64 69 6e 2e 63 6f 6d 2f 63 6f 6d 70 61 6e 79 2f 31 36 32 34 30 39 33 30 2f 22 3e 3c 69 20 63 6c 61 73 73 3d 22 69 20 69 2d 6c 69 6e 6b 65 64 69 6e 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 69 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 2d 69 6e 66 6f 2d 63 6f 6d 70 61 6e 79 20 6f 70 61 63 69 74 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 3c 70 3e 54 65 6c 20 2b 34 36 20 38 2d 37 38 38 20 35 31 20 30 30 3c 2f 70 3e 3c 70 3e c2 a9 20 45 73 73 69 74 79 20 41 6b 74 69 65 62 6f 6c 61 67 20 28 70 75 62 6c 29 2e 20 42 6f 78 20 32 30 30 2c 20 53 45 2d Data Ascii: a> <a href="https://www.linkedin.com/company/16240930/"><i class="i i-linkedin" aria-hidden="true"></i></a></div> <div class="footer-info-company opacity"> <p><p>Tel +46 8-788 51 00</p><p> Essity Aktiebolag (publ). Box 200, SE-

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:49 UTC	488	OUT	GET /consent/243652f0-45aa-4193-a147-291d1592994a/OtAutoBlock.js HTTP/1.1 Host: cdn-ukwest.onetrust.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.essity.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:49 UTC	511	IN	HTTP/1.1 200 OK Date: Tue, 18 Jul 2023 08:23:49 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 7e8953247b7f2bbe-FRA CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 71827 Cache-Control: public, max-age=86400 Last-Modified: Mon, 15 May 2023 06:22:05 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: K+6VR69Ck23u6MCEFuca+g== x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 09acaba1-701e-0066-4aa7-b896c1000000 x-ms-version: 2009-09-19 Server: cloudflare
2023-07-18 08:23:49 UTC	512	IN	Data Raw: 31 62 65 37 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 76 61 72 20 63 3d 5b 5d 2c 62 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 6f 72 28 76 61 72 20 67 3d 7b 7d 2c 68 3d 30 3b 68 3c 75 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 64 3d 75 5b 68 5d 3b 69 66 28 64 2e 54 61 67 3d 3d 3d 66 29 7b 67 3d 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 76 6f 69 64 20 30 2c 6b 3d 64 2e 54 61 67 3b 76 61 72 20 43 3d 28 6b 3d 2d 31 21 3d 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 6c 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 6b 2e 72 65 Data Ascii: 1be7!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.re
2023-07-18 08:23:49 UTC	513	IN	Data Raw: 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 69 6e 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 64 2e 6c 65 6e 67 74 68 3f 64 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6c 2e 68 6f 73 74 6e 61 6d 65 7d 28 66 29 3b 76 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 3d 3d 3d 68 7d 29 26 26 28 67 3d 5b 22 43 30 30 30 34 22 5d 29 3b 72 65 74 75 72 6e 20 67 7d 28 61 29 29 2c 7b 63 61 74 65 67 6f 72 79 49 64 73 3a 63 2c 76 73 43 61 74 49 64 73 3a 62 7d 7d 66 75 6e 63 74 69 6f 6e 20 77 28 61 29 7b 72 65 74 75 72 6e 21 61 7c 7c 21 61 2e 6c 65 6e 67 74 68 7c 7c 28 61 26 26 77 69 6e 64 6f 77 2e 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 3f 61 2e 65 76 65 72 79 28 66 75 6e 63 74 69 Data Ascii: .hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}function w(a){return!a\|\|!a.length\|\|(a&&window.OptanonActiveGroups?a.every(functi
2023-07-18 08:23:49 UTC	514	IN	Data Raw: 76 73 43 61 74 49 64 73 29 2c 6d 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 62 2e 76 73 43 61 74 49 64 73 29 7c 7c 28 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 73 63 72 69 70 74 65 78 65 63 75 74 65 22 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 74 65 78 74 2f 70 6c 61 69 6e 22 3d 3d 3d 0a 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 26 26 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 61 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 73 63 72 69 70 74 65 78 65 63 75 74 65 22 2c 63 29 7d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 41 28 61 29 7b 76 61 72 20 63 3d 61 2e 73 72 63 7c 7c 22 22 2c Data Ascii: vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.type="text/plain"),a.addEventListener("beforescriptexecute",c=function(e){"text/plain"===a.getAttribute("type")&&e.preventDefault();a.removeEventListener("beforescriptexecute",c)}))}function A(a){var c=a.src\|\|"",
2023-07-18 08:23:49 UTC	515	IN	Data Raw: 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 61 64 73 2d 74 77 69 74 74 65 72 2e 63 6f 6d 2f 75 77 74 2e 6a 73 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 61 64 73 2d 74 77 69 74 74 65 72 2e 63 6f 6d 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 2f 73 69 67 6e 61 6c 73 2f 63 6f 6e 66 69 67 2f 32 35 32 39 31 36 36 36 38 36 31 36 36 32 37 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c Data Ascii: {"Tag":"https://static.ads-twitter.com/uwt.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://static.ads-twitter.com","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://connect.facebook.net/signals/config/252916668616627","CategoryId":["C0004"],
2023-07-18 08:23:49 UTC	517	IN	Data Raw: 6f 6f 6b 2e 6e 65 74 2f 73 69 67 6e 61 6c 73 2f 63 6f 6e 66 69 67 2f 31 32 32 31 39 38 35 36 30 37 39 33 32 36 33 30 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 73 37 2e 61 64 64 74 68 69 73 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 6c 61 79 65 72 73 2e 66 61 36 63 64 31 39 34 37 63 65 32 36 65 38 39 30 64 33 64 2e 6a 73 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 70 6f 72 74 73 2e 65 73 73 69 74 79 2e 63 6f 6d 2f 32 30 31 38 2f 61 6e 6e 75 61 6c 2d 61 6e 64 2d 73 75 73 74 61 69 6e 61 62 69 6c 69 74 79 2d 72 65 Data Ascii: ook.net/signals/config/1221985607932630","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://reports.essity.com/2018/annual-and-sustainability-re
2023-07-18 08:23:49 UTC	518	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 61 2e 63 6c 6f 6e 65 4e 6f 64 65 28 29 2e 73 72 63 7d 63 61 74 63 68 28 66 29 7b 72 65 74 75 72 6e 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 29 7c 7c 22 22 7d 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 66 29 7b 76 61 72 20 67 3d 0a 62 5b 30 5d 2c 68 2c 64 2c 6c 2c 6b 3d 22 22 3b 6b 3d 71 28 6b 3d 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 66 7c 7c 66 20 69 6e 73 74 61 6e 63 65 6f 66 20 4f 62 6a 65 63 74 3f 66 2e 74 6f 53 74 72 69 6e 67 28 29 3a 6b 29 3b 72 65 74 75 72 6e 20 64 3d 67 2c 6c 3d 61 2c 21 28 68 3d 6b 29 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 26 26 21 68 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 22 73 63 72 69 70 74 22 21 Data Ascii: unction(){try{return a.cloneNode().src}catch(f){return a.getAttribute("src")\|\|""}},set:function(f){var g=b[0],h,d,l,k="";k=q(k="string"==typeof f\|\|f instanceof Object?f.toString():k);return d=g,l=a,!(h=k).categoryIds.length&&!h.vsCatIds.length\|\|"script"!
2023-07-18 08:23:49 UTC	519	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-07-18 08:23:49 UTC	489	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Host: cdn-ukwest.onetrust.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.essity.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2023-07-18 08:23:49 UTC	489	IN	HTTP/1.1 200 OK Date: Tue, 18 Jul 2023 08:23:49 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: Ss3gfiwT9vXTSvNlfc+4JQ== Last-Modified: Mon, 10 Jul 2023 20:07:10 GMT x-ms-request-id: fedf0f5c-601e-0014-4509-b4e7ff000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * CF-Cache-Status: HIT Age: 72756 Expires: Wed, 19 Jul 2023 08:23:49 GMT Cache-Control: public, max-age=86400 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 7e8953247c344d8f-FRA
2023-07-18 08:23:49 UTC	490	IN	Data Raw: 35 34 33 64 0d 0a 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6c 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b Data Ascii: 543dvar OneTrustStub=function(e){"use strict";var l=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCook
2023-07-18 08:23:49 UTC	491	IN	Data Raw: 22 53 45 22 2c 22 47 42 22 2c 22 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 42 61 6e 6e 65 72 53 64 6b 2e 6a 73 22 2c 74 68 69 73 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 3d 5b 5d 2c 74 68 69 73 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3d 21 31 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 43 43 54 49 44 3d 22 5b 5b 4f 6c 64 43 43 54 49 44 5d 5d 22 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 44 6f 6d 61 69 6e 49 64 3d 22 5b 5b 4e 65 77 44 6f 6d Data Ascii: "SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDom
2023-07-18 08:23:49 UTC	492	IN	Data Raw: 73 74 79 6c 65 22 21 3d 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 5b 65 2c 74 5d 29 2c 22 73 74 79 6c 65 22 21 3d 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 74 7c 7c 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 73 74 79 6c 65 22 29 2c 22 73 74 79 6c 65 22 3d 3d 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 74 29 7b 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 73 74 79 6c 65 22 29 3b 76 61 72 20 69 2c 6e 3d 61 2e 73 74 72 54 6f 4f 62 6a 28 74 29 3b 66 6f 72 28 69 20 69 6e 20 6e 29 74 68 69 73 2e 73 74 79 6c 65 5b 69 5d 3d 6e 5b 69 5d 7d 7d 2c 21 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 69 29 7b 76 6f 69 64 20 30 3d 3d 3d 69 26 26 28 Data Ascii: style"!==e.toLowerCase()&&o.apply(this,[e,t]),"style"!==e.toLowerCase()\|\|t\|\|this.removeAttribute("style"),"style"===e.toLowerCase()&&t){this.removeAttribute("style");var i,n=a.strToObj(t);for(i in n)this.style[i]=n[i]}},!0}}function p(e,t,i){void 0===i&&(
2023-07-18 08:23:49 UTC	493	IN	Data Raw: 74 2b 2b 29 65 5b 74 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 76 61 72 20 69 3d 6e 75 6c 6c 3d 3d 28 69 3d 73 2e 77 69 6e 29 3f 76 6f 69 64 20 30 3a 69 2e 5f 5f 67 70 70 3b 69 66 28 69 2e 71 75 65 75 65 3d 69 2e 71 75 65 75 65 7c 7c 5b 5d 2c 69 2e 65 76 65 6e 74 73 3d 69 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 21 65 2e 6c 65 6e 67 74 68 7c 7c 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 22 71 75 65 75 65 22 3d 3d 3d 65 5b 30 5d 29 72 65 74 75 72 6e 20 69 2e 71 75 65 75 65 3b 69 66 28 31 3d 3d 3d 65 2e 6c 65 6e 67 74 68 26 26 22 65 76 65 6e 74 73 22 3d 3d 3d 65 5b 30 5d 29 72 65 74 75 72 6e 20 69 2e 65 76 65 6e 74 73 3b 76 61 72 20 6e 3d 65 5b 30 5d 2c 61 3d 31 3c 65 2e 6c 65 6e 67 74 68 3f 65 5b 31 5d 3a 6e 75 6c 6c 2c 6f 3d 32 3c 65 2e 6c 65 6e 67 74 68 3f Data Ascii: t++)e[t]=arguments[t];var i=null==(i=s.win)?void 0:i.__gpp;if(i.queue=i.queue\|\|[],i.events=i.events\|\|[],!e.length\|\|1===e.length&&"queue"===e[0])return i.queue;if(1===e.length&&"events"===e[0])return i.events;var n=e[0],a=1<e.length?e[1]:null,o=2<e.length?
2023-07-18 08:23:49 UTC	495	IN	Data Raw: 7c 21 28 69 3d 21 30 29 7d 29 2c 7b 65 76 65 6e 74 4e 61 6d 65 3a 22 6c 69 73 74 65 6e 65 72 52 65 6d 6f 76 65 64 22 2c 6c 69 73 74 65 6e 65 72 49 64 3a 74 2c 64 61 74 61 3a 69 2c 70 69 6e 67 44 61 74 61 3a 73 2e 67 65 74 50 69 6e 67 52 65 71 75 65 73 74 28 29 7d 7d 2c 74 68 69 73 2e 61 64 64 54 6f 51 75 65 75 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 76 61 72 20 6e 3d 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 6e 2e 71 75 65 75 65 3d 6e 2e 71 75 65 75 65 7c 7c 5b 5d 2c 6e 2e 71 75 65 75 65 2e 70 75 73 68 28 5b 65 2c 74 2c 69 5d 29 7d 2c 74 68 69 73 2e 6d 65 73 73 61 67 65 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 74 2c 6e 2c 61 3d 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 69 2e 64 61 74 61 3b 74 72 79 7b 74 3d Data Ascii: \|!(i=!0)}),{eventName:"listenerRemoved",listenerId:t,data:i,pingData:s.getPingRequest()}},this.addToQueue=function(e,t,i){var n=s.win.__gpp;n.queue=n.queue\|\|[],n.queue.push([e,t,i])},this.messageHandler=function(i){var t,n,a="string"==typeof i.data;try{t=
2023-07-18 08:23:49 UTC	496	IN	Data Raw: 6f 6d 61 69 6e 4d 61 6e 61 67 65 6d 65 6e 74 26 26 69 21 3d 3d 6e 26 26 65 2e 53 63 72 69 70 74 54 79 70 65 3d 3d 3d 73 26 26 28 28 74 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 29 26 26 74 2e 67 65 74 49 74 65 6d 28 22 62 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 45 6e 61 62 6c 65 64 22 29 3f 74 68 69 73 2e 68 61 6e 64 6c 65 42 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 28 7b 69 73 56 61 6c 69 64 3a 22 74 72 75 65 22 3d 3d 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 62 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 45 6e 61 62 6c 65 64 22 29 7d 2c 65 29 3a 28 6e 3d 7b 6c 6f 63 61 74 69 6f 6e 3a 6c 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2e 72 65 70 6c 61 63 65 28 2f 5e 68 74 74 70 73 3f 3a Data Ascii: omainManagement&&i!==n&&e.ScriptType===s&&((t=window.sessionStorage)&&t.getItem("bulkDomainMgmtEnabled")?this.handleBulkDomainMgmt({isValid:"true"===window.sessionStorage.getItem("bulkDomainMgmtEnabled")},e):(n={location:l.storageBaseURL.replace(/^https?:
2023-07-18 08:23:49 UTC	498	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 65 2e 54 65 6e 61 6e 74 46 65 61 74 75 72 65 73 3b 76 61 72 20 74 3d 22 22 2b 6c 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 29 2e 73 70 6c 69 74 28 6c 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 29 5b 30 5d 2b 65 2e 56 65 72 73 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 65 77 20 52 65 67 45 78 70 28 22 5e 66 69 6c 65 3a 2f 2f 22 2c 22 69 22 29 2e 74 65 73 74 28 74 29 26 26 65 2e 4d 6f 62 69 6c 65 53 44 4b 3f 28 74 3d 22 2f 22 2b 65 2e 47 65 6f 6c 6f 63 61 74 69 6f 6e 55 72 6c 2e 72 65 70 6c 61 63 65 28 2f 5e 28 68 74 74 70 7c 68 74 74 70 73 29 3a 5c 2f 5c 2f 2f 2c 22 22 29 2e 73 70 6c 69 74 28 22 2f 22 29 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2f 22 29 2b 22 2e 6a 73 Data Ascii: tion(e){e.TenantFeatures;var t=""+l.stubScriptElement.getAttribute("src").split(l.stubFileName)[0]+e.Version;return new RegExp("^file://","i").test(t)&&e.MobileSDK?(t="/"+e.GeolocationUrl.replace(/^(http\|https):\/\//,"").split("/").slice(1).join("/")+".js
2023-07-18 08:23:49 UTC	499	IN	Data Raw: 74 2e 72 65 73 70 6f 6e 73 65 54 65 78 74 29 2c 61 3f 69 28 4a 53 4f 4e 2e 70 61 72 73 65 28 74 29 2c 61 29 3a 69 28 4a 53 4f 4e 2e 70 61 72 73 65 28 74 29 29 7d 2c 73 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 28 29 7d 2c 73 2e 6f 70 65 6e 28 22 47 45 54 22 2c 65 29 2c 73 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 31 2c 74 26 26 73 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 61 63 63 65 70 74 22 2c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 29 2c 6e 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 6e 29 73 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 72 2c 6e 5b 72 5d 29 3b 73 2e 73 65 6e 64 28 29 7d 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 74 46 65 74 63 68 4f 66 66 6c 69 6e 65 46 69 6c 65 3d Data Ascii: t.responseText),a?i(JSON.parse(t),a):i(JSON.parse(t))},s.onerror=function(){i()},s.open("GET",e),s.withCredentials=!1,t&&s.setRequestHeader("accept","application/json"),n)for(var r in n)s.setRequestHeader(r,n[r]);s.send()}},d.prototype.otFetchOfflineFile=
2023-07-18 08:23:49 UTC	500	IN	Data Raw: 74 61 28 29 2c 74 68 69 73 2e 69 6e 69 74 69 61 6c 69 7a 65 47 65 6e 56 65 6e 44 61 74 61 28 29 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 69 61 6c 69 7a 65 47 72 6f 75 70 44 61 74 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 6c 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 22 67 72 6f 75 70 73 22 29 3b 65 26 26 28 6c 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 74 68 69 73 2e 64 65 73 65 72 69 61 6c 69 73 65 53 74 72 69 6e 67 54 6f 41 72 72 61 79 28 65 29 29 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 69 61 6c 69 7a 65 48 6f 73 74 44 61 74 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 2e 72 65 61 64 43 6f Data Ascii: ta(),this.initializeGenVenData()},d.prototype.initializeGroupData=function(){var e=this.readCookieParam(l.optanonCookieName,"groups");e&&(l.optanonHtmlGroupData=this.deserialiseStringToArray(e))},d.prototype.initializeHostData=function(){var e=this.readCo
2023-07-18 08:23:49 UTC	502	IN	Data Raw: 3d 61 5b 69 5d 2e 73 70 6c 69 74 28 22 3d 22 29 2c 6e 5b 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 5b 30 5d 29 5d 3d 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 5b 31 5d 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 22 20 22 29 3b 72 65 74 75 72 6e 20 74 26 26 6e 5b 74 5d 3f 6e 5b 74 5d 3a 74 26 26 21 6e 5b 74 5d 3f 22 22 3a 6e 7d 72 65 74 75 72 6e 22 22 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 43 6f 6f 6b 69 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 74 68 69 73 2e 69 73 41 6d 70 29 7b 76 61 72 20 74 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 74 68 69 73 2e 64 6f 6d 61 69 6e 49 64 29 29 7c 7c 7b 7d 3b 69 66 28 74 29 72 65 74 Data Ascii: =a[i].split("="),n[decodeURIComponent(o[0])]=decodeURIComponent(o[1]).replace(/\+/g," ");return t&&n[t]?n[t]:t&&!n[t]?"":n}return""},d.prototype.getCookie=function(e){if(this.isAmp){var t=JSON.parse(window.localStorage.getItem(this.domainId))\|\|{};if(t)ret
2023-07-18 08:23:49 UTC	503	IN	Data Raw: 76 65 47 72 6f 75 70 73 3a 61 7d 5d 29 3a 6f 5b 74 68 69 73 2e 6f 74 44 61 74 61 4c 61 79 65 72 2e 6e 61 6d 65 5d 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 41 72 72 61 79 26 26 28 6f 5b 74 68 69 73 2e 6f 74 44 61 74 61 4c 61 79 65 72 2e 6e 61 6d 65 5d 2e 70 75 73 68 28 7b 4f 6e 65 74 72 75 73 74 41 63 74 69 76 65 47 72 6f 75 70 73 3a 61 7d 29 2c 6f 5b 74 68 69 73 2e 6f 74 44 61 74 61 4c 61 79 65 72 2e 6e 61 6d 65 5d 2e 70 75 73 68 28 7b 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 3a 61 7d 29 29 2c 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 63 6f 6e 73 65 6e 74 2e 6f 6e 65 74 72 75 73 74 22 2c 7b 64 65 74 61 69 6c 3a 65 7d 29 29 3b 21 74 68 69 73 2e 6f 74 44 61 74 61 4c 61 79 65 72 2e 69 67 6e 6f 72 65 26 26 65 2e 6c 65 6e 67 74 68 Data Ascii: veGroups:a}]):o[this.otDataLayer.name].constructor===Array&&(o[this.otDataLayer.name].push({OnetrustActiveGroups:a}),o[this.otDataLayer.name].push({OptanonActiveGroups:a})),new CustomEvent("consent.onetrust",{detail:e}));!this.otDataLayer.ignore&&e.length
2023-07-18 08:23:49 UTC	504	IN	Data Raw: 29 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 44 6f 6d 61 69 6e 44 61 74 61 46 69 6c 65 55 52 4c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 6c 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 29 2c 74 3d 2d 31 3c 65 2e 69 6e 64 65 78 4f 66 28 22 2f 63 6f 6e 73 65 6e 74 22 29 3b 65 26 26 28 6c 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3f 6c 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 3d 65 2e 73 70 6c 69 74 28 22 2f 63 6f 6e 73 65 6e 74 2f 22 2b 6c 2e 6d 69 67 72 61 74 65 64 43 43 54 49 44 29 5b 30 5d 3a 6c 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 3d 28 74 3f 65 2e 73 70 6c 69 74 28 22 2f 63 6f 6e 73 65 6e 74 22 29 3a 65 2e 73 70 6c 69 74 28 22 2f 73 63 72 69 70 74 74 65 Data Ascii: )},d.prototype.setDomainDataFileURL=function(){var e=l.stubScriptElement.getAttribute("src"),t=-1<e.indexOf("/consent");e&&(l.isMigratedURL?l.storageBaseURL=e.split("/consent/"+l.migratedCCTID)[0]:l.storageBaseURL=(t?e.split("/consent"):e.split("/scriptte
2023-07-18 08:23:49 UTC	506	IN	Data Raw: 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 76 61 72 20 65 3d 22 74 72 75 65 22 3d 3d 3d 74 68 69 73 2e 75 72 6c 50 61 72 61 6d 73 2e 67 65 74 28 22 6f 74 72 65 73 65 74 22 29 2c 74 3d 22 74 72 75 65 22 3d 3d 3d 74 68 69 73 2e 75 72 6c 50 61 72 61 6d 73 2e 67 65 74 28 22 6f 74 70 72 65 76 69 65 77 22 29 2c 69 3d 28 74 68 69 73 2e 67 65 6f 46 72 6f 6d 55 72 6c 3d 28 74 68 69 73 2e 75 72 6c 50 61 72 61 6d 73 2e 67 65 74 28 22 6f 74 67 65 6f 22 29 7c 7c 22 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 6f 2c 22 65 78 70 69 72 79 22 29 29 2c 6e 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 6f 2c 61 29 3b Data Ascii: LSearchParams(window.location.search);var e="true"===this.urlParams.get("otreset"),t="true"===this.urlParams.get("otpreview"),i=(this.geoFromUrl=(this.urlParams.get("otgeo")\|\|"").toLowerCase(),this.readCookieParam(o,"expiry")),n=this.readCookieParam(o,a);
2023-07-18 08:23:49 UTC	507	IN	Data Raw: 70 74 74 65 6d 70 6c 61 74 65 73 2f 22 2b 6c 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 2b 22 2e 6a 73 22 29 2c 6c 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2b 22 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 6e 65 77 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 22 2b 65 2e 56 65 72 73 69 6f 6e 2b 22 2f 22 2b 6c 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 29 3a 22 35 2e 31 31 2e 30 22 3d 3d 3d 65 2e 56 65 72 73 69 6f 6e 3f 28 6c 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 26 26 28 69 2e 73 72 63 3d 6c 2e 73 74 6f 72 61 67 65 42 61 73 65 55 52 4c 2b 22 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 6f 6c 64 2f 73 63 72 69 70 74 74 65 6d 70 6c 61 74 65 73 2f 22 2b 6c 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 2b 22 2e 6a 73 22 29 2c 6c 2e 73 Data Ascii: pttemplates/"+l.stubFileName+".js"),l.storageBaseURL+"/scripttemplates/new/scripttemplates/"+e.Version+"/"+l.bannerScriptName):"5.11.0"===e.Version?(l.isMigratedURL&&(i.src=l.storageBaseURL+"/scripttemplates/old/scripttemplates/"+l.stubFileName+".js"),l.s
2023-07-18 08:23:49 UTC	508	IN	Data Raw: 76 61 72 20 65 3d 77 69 6e 64 6f 77 3b 75 2e 69 61 62 54 79 70 65 41 64 64 65 64 3f 28 22 49 41 42 22 3d 3d 3d 75 2e 69 61 62 54 79 70 65 3f 76 6f 69 64 20 30 3d 3d 3d 65 2e 5f 5f 63 6d 70 26 26 28 77 69 6e 64 6f 77 2e 5f 5f 63 6d 70 3d 75 2e 65 78 65 63 75 74 65 43 6d 70 41 70 69 29 3a 76 6f 69 64 20 30 3d 3d 3d 65 2e 5f 5f 74 63 66 61 70 69 26 26 28 77 69 6e 64 6f 77 2e 5f 5f 74 63 66 61 70 69 3d 75 2e 65 78 65 63 75 74 65 54 63 66 41 70 69 29 2c 75 2e 61 64 64 49 61 62 46 72 61 6d 65 28 29 29 3a 75 2e 61 64 64 42 61 63 6b 77 61 72 64 49 61 62 46 72 61 6d 65 28 29 2c 65 2e 72 65 63 65 69 76 65 4f 54 4d 65 73 73 61 67 65 3d 75 2e 72 65 63 65 69 76 65 49 61 62 4d 65 73 73 61 67 65 2c 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 7c 7c 77 69 6e 64 6f 77 2e 61 Data Ascii: var e=window;u.iabTypeAdded?("IAB"===u.iabType?void 0===e.__cmp&&(window.__cmp=u.executeCmpApi):void 0===e.__tcfapi&&(window.__tcfapi=u.executeTcfApi),u.addIabFrame()):u.addBackwardIabFrame(),e.receiveOTMessage=u.receiveIabMessage,(e.attachEvent\|\|window.a
2023-07-18 08:23:49 UTC	510	IN	Data Raw: 6f 72 20 69 46 72 61 6d 65 20 63 61 6c 6c 3b 20 52 65 63 65 69 76 65 64 20 49 41 42 20 54 43 46 20 76 31 2e 31 22 29 2c 70 2e 5f 5f 74 63 66 61 70 69 43 61 6c 6c 26 26 22 49 41 42 32 22 3d 3d 3d 75 2e 69 61 62 54 79 70 65 3f 28 6f 3d 70 2e 5f 5f 74 63 66 61 70 69 43 61 6c 6c 2e 63 61 6c 6c 49 64 2c 73 3d 70 2e 5f 5f 74 63 66 61 70 69 43 61 6c 6c 2e 63 6f 6d 6d 61 6e 64 2c 65 3d 70 2e 5f 5f 74 63 66 61 70 69 43 61 6c 6c 2e 70 61 72 61 6d 65 74 65 72 2c 74 3d 70 2e 5f 5f 74 63 66 61 70 69 43 61 6c 6c 2e 76 65 72 73 69 6f 6e 2c 75 2e 65 78 65 63 75 74 65 54 63 66 41 70 69 28 73 2c 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 3d 7b 5f 5f 74 63 66 61 70 69 52 65 74 75 72 6e 3a 7b 72 65 74 75 72 6e 56 61 6c 75 65 3a 65 2c 73 75 63 63 65 73 73 3a 74 2c 63 Data Ascii: or iFrame call; Received IAB TCF v1.1"),p.__tcfapiCall&&"IAB2"===u.iabType?(o=p.__tcfapiCall.callId,s=p.__tcfapiCall.command,e=p.__tcfapiCall.parameter,t=p.__tcfapiCall.version,u.executeTcfApi(s,e,function(e,t){e={__tcfapiReturn:{returnValue:e,success:t,c
2023-07-18 08:23:49 UTC	511	IN	Data Raw: 4c 6f 61 64 65 64 3a 74 7d 2c 6e 3d 21 30 29 3a 22 49 41 42 32 22 3d 3d 3d 75 2e 69 61 62 54 79 70 65 26 26 28 69 3d 7b 67 64 70 72 41 70 70 6c 69 65 73 3a 6c 2e 6f 6e 65 54 72 75 73 74 49 41 42 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 2c 63 6d 70 4c 6f 61 64 65 64 3a 21 31 2c 63 6d 70 53 74 61 74 75 73 3a 22 73 74 75 62 22 2c 64 69 73 70 6c 61 79 53 74 61 74 75 73 3a 22 73 74 75 62 22 2c 61 70 69 56 65 72 73 69 6f 6e 3a 22 32 2e 30 22 2c 63 6d 70 56 65 72 73 69 6f 6e 3a 76 6f 69 64 20 30 2c 63 6d 70 49 64 3a 76 6f 69 64 20 30 2c 67 76 6c 56 65 72 73 69 6f 6e 3a 76 6f 69 64 20 30 2c 74 63 66 50 6f 6c 69 63 79 56 65 72 73 69 6f 6e 3a 76 6f 69 64 20 30 7d 2c 6e 3d 21 30 29 2c 65 28 69 2c 6e 29 29 7d 2c 74 68 69 73 2e 67 65 74 43 6f 6e 73 65 Data Ascii: Loaded:t},n=!0):"IAB2"===u.iabType&&(i={gdprApplies:l.oneTrustIABgdprAppliesGlobally,cmpLoaded:!1,cmpStatus:"stub",displayStatus:"stub",apiVersion:"2.0",cmpVersion:void 0,cmpId:void 0,gvlVersion:void 0,tcfPolicyVersion:void 0},n=!0),e(i,n))},this.getConse
2023-07-18 08:23:49 UTC	511	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0