Windows Analysis Report
https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com

Overview

General Information

Sample URL:	https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com
Analysis ID:	1570345

Detection

HTMLPhisher, ReCaptcha Phish

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

Yara detected Recaptcha Phish

AI detected suspicious Javascript

Phishing site or detected (based on various text indicators)

Detected hidden input values containing email addresses (often used in phishing pages)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTML title does not match URL

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Signatures

Phishing

AI detected phishing page

Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'office.aeentrabar.com' does not match the legitimate domain 'microsoft.com'., The domain 'aeentrabar.com' is not associated with Microsoft and appears suspicious., The use of 'office' as a subdomain could be an attempt to mimic Microsoft's Office services., The domain name includes an unusual and unrelated string 'aeentrabar', which is a common tactic in phishing URLs. DOM: 1.3.pages.csv
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'office.aeentrabar.com' does not match the legitimate domain 'microsoft.com'., The domain 'aeentrabar.com' is not associated with Microsoft and appears to be unrelated., The use of 'office' as a subdomain could be an attempt to mimic Microsoft's Office services, which is suspicious., The presence of input fields for 'Email, phone, or Skype' aligns with common phishing tactics targeting Microsoft accounts. DOM: 3.10.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.16.id.script.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 0.27.i.script.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML
Source: Yara match	File source: 3.10.pages.csv, type: HTML

Yara detected Recaptcha Phish

Source: Yara match	File source: 0.7.id.script.csv, type: HTML
Source: Yara match	File source: 0.6.id.script.csv, type: HTML
Source: Yara match	File source: 0.12.i.script.csv, type: HTML
Source: Yara match	File source: 0.10.i.script.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.1.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://office.aeentrabar.com/kTNoOGHr#alissa.bess... High risk due to multiple red flags: 1) Obfuscated URL construction through string concatenation to hide the actual destination domain, 2) Suspicious redirect using window.location.assign, 3) Domain appears non-standard and potentially malicious (aeentrabar.com), 4) Function appears to execute after a verification callback, suggesting potential abuse of legitimate verification systems for malicious redirect

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.5	OCR Text: Microsoft Please stand by, while we are checking if the site cannectian is secure Verifying... CLOUDFLARE Ten-rs Microsoft needs to review the security of your connection before proceeding. Performance & security by Microsoft
Source: Chrome DOM: 1.4	OCR Text: Microsoft Please stand by, while we are checking if the site cannectian is secure Verifying... CLOUDFLARE Ten-rs Microsoft needs to review the security of your connection before proceeding. Performance & security by Microsoft

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30eOM5-8i-bqh4eFYuZ-5jhzu4d8v7_j8PmXH3ylSc-5n5t_3v52Wc5c7VcqvcB6kEx7Is3wg4hWnRHL2CmaDlWyT-EtluaXViTGQwj0h2Qde5RHHuXzV_kjvjmRWgo1QV_kka8PMr8e_S_RT966VyhEzsT19KlrBnf_I_v3tzO371y8-ubm6ePHzzo3dz6LaCa0aL4HuiylgEF7xpCDuILpfiPmH2ybkAFWxJlCAzqthz8WM38VM_8A0&cbcxt=&username=billg%40microsoft.com&mkt=en-US&lc=&pullStatus=0

HTTP Parser: billg@microsoft.com

HTML body contains low number of good links

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: Number of links: 0
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0

HTTP Parser: Base64 decoded: 89188cfb-dc58-48bb-aee8-e0eb9941eceab4eab1b8-2ad4-4ab3-bd76-1800d1305630

HTML page contains string obfuscation

Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com

HTTP Parser: Found new string: script ...var verifyCallback_CF = function (response) {. console.log("verified");. window.location.assign('ht' + 'tps' + '://' + 'o' + 'ffi' + 'ce.' + 'ae' + 'en' + 'tra' + 'ba' + 'r' + '.c' + 'om/' + 'kT' + 'N' + 'oOG' + 'Hr' + '?' + 'd=' + 'xt' + 'mt' + 'r' + 'JQ');. };.....

HTML title does not match URL

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: Title: Sign In does not match URL
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: Title: Error does not match URL

URL contains potential PII (phishing indication)

Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com

HTTP Parser: Iframe src: https://ywnjb.aeentrabar.com/Me.htm?v=3

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: <input type="password" .../> found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: <input type="password" .../> found

Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	HTTP Parser: No favicon
Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	HTTP Parser: No favicon
Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	HTTP Parser: No favicon
Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	HTTP Parser: No favicon
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: No favicon
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: No favicon

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27	HTTP Parser: No <meta name="author".. found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27	HTTP Parser: No <meta name="author".. found

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: No <meta name="copyright".. found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49775 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	DNS traffic detected: DNS query: m0g9861wc1.execute-api.us-east-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: office.aeentrabar.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: js.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: findicons.com
Source: global traffic	DNS traffic detected: DNS query: images.freeimages.com
Source: global traffic	DNS traffic detected: DNS query: newassets.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: api2.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: react.aeentrabar.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: ywnjb.aeentrabar.com
Source: global traffic	DNS traffic detected: DNS query: dc.services.visualstudio.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49775 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@22/6@46/270

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,3941485955034497807,11036203168277288222,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,3941485955034497807,11036203168277288222,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.227	unknown	United States	15169	GOOGLEUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.19.161	unknown	United States	15133	EDGECASTUS	false
18.161.111.41	images.freeimages.com	United States	3	MIT-GATEWAYSUS	false
172.217.17.46	unknown	United States	15169	GOOGLEUS	false
20.50.88.242	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
20.189.173.3	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.86.84.193	react.aeentrabar.com	United States	9009	M247GB	true
104.19.230.21	js.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.42	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
157.58.197.16	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.217.17.35	unknown	United States	15169	GOOGLEUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
20.50.88.235	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.116.245.11	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
216.58.208.234	unknown	United States	15169	GOOGLEUS	false
167.220.71.70	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
104.19.229.21	api2.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
20.31.161.73	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
54.235.109.11	m0g9861wc1.execute-api.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
173.194.222.84	unknown	United States	15169	GOOGLEUS	false
52.84.45.64	findicons.com	United States	55960	BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN	false
142.250.181.74	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
m0g9861wc1.execute-api.us-east-1.amazonaws.com	54.235.109.11	true
react.aeentrabar.com	172.86.84.193	true
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true
images.freeimages.com	18.161.111.41	true
js.hcaptcha.com	104.19.230.21	true
findicons.com	52.84.45.64	true
challenges.cloudflare.com	104.18.95.41	true
sni1gl.wpc.omegacdn.net	152.199.21.175	true
www.google.com	142.250.181.100	true
api2.hcaptcha.com	104.19.229.21	true
newassets.hcaptcha.com	104.19.229.21	true
office.aeentrabar.com	172.86.84.193	true
ywnjb.aeentrabar.com	172.86.84.193	true
aadcdn.msftauth.net	unknown	unknown
identity.nel.measure.office.net	unknown	unknown
dc.services.visualstudio.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	true	unknown
https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	false	unknown
https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	true	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 6 18:44:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	89FD35FC9481AB974500151AAF1CA5B1	C9E1A33C80B78DA3E92A8DA0B8F9B3DFAA07C770	4AB8B4E52F725BCD8278844E214E07EA126B9617D928D395EF3B85ECFFB9364A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 6 18:44:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1D2EB981D73B44A178901B2245F6619B	EB12AF56C241A8631D722BEC33F99CDC7F7A74DF	1C08A79D145B5A5DF5C1715DE146171938D9193E408D7EC534D16C7773A564EC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	16E9DA01B6C5FF234B7D655C42845597	96F55B7BBF2F055E8FC60DFB4FD3B1C1CD4F5CAD	95D3A3B9E341C7A4B018934D2029AC4CFD188060736B1C3D1E3FF48221B0F448
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 6 18:44:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BCB6F76D61DAC97F45BA2648C2D83541	7283A59212491B34D7D168F4AAD2AB46EE627C33	C95927400C5C56C05C31279ED4A101F45309F966AD968EC176A58B18858B4DC8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 6 18:44:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	10654990DCD940736DA0CD5C42BE41C8	46C1228F886A7A1E761F8EEAE80D1BBF25C7D539	C35E03FCAD6A7F291B1B777D978477CC22EA442D583CD1B51FB164508D4F3416
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 6 18:44:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B9ED02EB1EA1BDDB993212E53EE37537	AAF1B17A8CE93A96ECFAA599FC2EFFC6FDBDD339	54AA21E75C284147925385D7641DBF8395760AA8B4EBBBF23DB2C258CFF9A9A8

Phishing

AI detected phishing page

Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'office.aeentrabar.com' does not match the legitimate domain 'microsoft.com'., The domain 'aeentrabar.com' is not associated with Microsoft and appears suspicious., The use of 'office' as a subdomain could be an attempt to mimic Microsoft's Office services., The domain name includes an unusual and unrelated string 'aeentrabar', which is a common tactic in phishing URLs. DOM: 1.3.pages.csv
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'office.aeentrabar.com' does not match the legitimate domain 'microsoft.com'., The domain 'aeentrabar.com' is not associated with Microsoft and appears to be unrelated., The use of 'office' as a subdomain could be an attempt to mimic Microsoft's Office services, which is suspicious., The presence of input fields for 'Email, phone, or Skype' aligns with common phishing tactics targeting Microsoft accounts. DOM: 3.10.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.16.id.script.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 0.27.i.script.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML
Source: Yara match	File source: 3.10.pages.csv, type: HTML

Yara detected Recaptcha Phish

Source: Yara match	File source: 0.7.id.script.csv, type: HTML
Source: Yara match	File source: 0.6.id.script.csv, type: HTML
Source: Yara match	File source: 0.12.i.script.csv, type: HTML
Source: Yara match	File source: 0.10.i.script.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.1.id.script.csv

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.5	OCR Text: Microsoft Please stand by, while we are checking if the site cannectian is secure Verifying... CLOUDFLARE Ten-rs Microsoft needs to review the security of your connection before proceeding. Performance & security by Microsoft
Source: Chrome DOM: 1.4	OCR Text: Microsoft Please stand by, while we are checking if the site cannectian is secure Verifying... CLOUDFLARE Ten-rs Microsoft needs to review the security of your connection before proceeding. Performance & security by Microsoft

Detected hidden input values containing email addresses (often used in phishing pages)

HTTP Parser: billg@microsoft.com

HTML body contains low number of good links

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: Number of links: 0
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

HTTP Parser: Base64 decoded: 89188cfb-dc58-48bb-aee8-e0eb9941eceab4eab1b8-2ad4-4ab3-bd76-1800d1305630

HTML page contains string obfuscation

Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com

HTML title does not match URL

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: Title: Sign In does not match URL
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: Title: Error does not match URL

URL contains potential PII (phishing indication)

Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com
Source: https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Sample URL: PII: alissa.bessette@eastwesttea.com

HTTP Parser: Iframe src: https://ywnjb.aeentrabar.com/Me.htm?v=3

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: <input type="password" .../> found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: <input type="password" .../> found

Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	HTTP Parser: No favicon
Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	HTTP Parser: No favicon
Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	HTTP Parser: No favicon
Source: https://office.aeentrabar.com/kTNoOGHr#alissa.bessette@eastwesttea.com	HTTP Parser: No favicon
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No favicon
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: No favicon
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: No favicon

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e	HTTP Parser: No <meta name="author".. found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27	HTTP Parser: No <meta name="author".. found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27	HTTP Parser: No <meta name="author".. found

Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://office.aeentrabar.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638691111273749007.ODkxODhjZmItZGM1OC00OGJiLWFlZTgtZTBlYjk5NDFlY2VhYjRlYWIxYjgtMmFkNC00YWIzLWJkNzYtMTgwMGQxMzA1NjMw&ui_locales=en-US&mkt=en-US&client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&state=azBYH97iH30gmyKPiJlO60LAmzXt82DNZoC8hSNBC7pBcJLrJX5sBDvbQCELL6JtGZiFFNuQ93mA37yudp9g-1XhGrwqkWnfRVuh1jByyZ7ppiRn1zLPUPs2KwQeOzTEGdY2KjcPqdO4UgtCIZ7acdZIwxy-KUzw7mH_nymXxNDh53ahvvm4Mre5q7mbtwVmFzy_129IppJZbZs6v2Fj5ltLcFdV8d70uSUtP3mHOylAeWvzAnTr1l8VZuTtMqSpP-Asyx9tBTfzT9Y6pOxLhg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://msft.sts.microsoft.com/adfs/ls/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN273kNu9t47PCju30e...	HTTP Parser: No <meta name="copyright".. found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: No <meta name="copyright".. found
Source: https://certauth.msft.sts.microsoft.com/adfs/certauth/?client-request-id=a54e7827-d073-4835-9256-2d3a375bc921&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAAhZI_jNt0HMXj5C53FwGNWoQK0yEhgShJ_Cfxz45UCTuJE-f8J7k4ydkMUWI7thP_Yl9sx7FHWJhQxcBwIxLLTQgxIMTA0oGbbq4YEFN1Q1t1uqEDKcwV3-Hp-_Te9j6FA1CulbEy-mkOL6P1j6qArFWrtVmJwHWyVKVnaIkiTLKEGTSxi3BA6tP13ULx4630Q3Bd63w7KtXBF398eIkc22HoB_VKJY7jsjefO7pZ1j1Ycacrw1lZG_wXBLlGkIvsvrkqDQeX2YAkKJLGdocDAlRpFAVlubncyk17oUE-1NoiJjdQVG53HWHMuZpihZrCuupiWZOanKviI1tdnLrqmN-qCysUIbeUdv2dT4VxdymlaigqViy2-1sxZTBpIcZPsndkJgpt_LV4ayc1X2aP5t4aTnwvCC9y32WnKat2aOB0CNSCyUnP6boyiQoMTM9CCm9Kmteg7IHENoDP6l1h3T2rBWxzM-s3WoJAdsO25nCcFPVpAjIESCLDp60Sdma31_H5cryan44iG1uwSaIB33dOV1gq9Ia9AD-J-6acKq22oeInC713bsjVoRU2eA1MdUPj421SOhmmMYCdySqBZ1upadeIqb3ZwKq4NmvnAM7CeAS5NJlgOM37flebaQG5wblFzQ0FnTNGlAHQaDAMewTsyInLmONNyqyUNeZSIy1SQvF84PdKTJBs6ZBV5qlCq6QvbwXbusy9_4Z5N_hPufzugd7qKgc831w5xrG_9uaOa74JiQ1ekf91HQ-aZcZ1_87dmzmua30OHX3tBd48fN27...	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49775 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	DNS traffic detected: DNS query: m0g9861wc1.execute-api.us-east-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: office.aeentrabar.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: js.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: findicons.com
Source: global traffic	DNS traffic detected: DNS query: images.freeimages.com
Source: global traffic	DNS traffic detected: DNS query: newassets.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: api2.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: react.aeentrabar.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: ywnjb.aeentrabar.com
Source: global traffic	DNS traffic detected: DNS query: dc.services.visualstudio.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49775 version: TLS 1.2

Source: classification engine

Classification label: mal72.phis.win@22/6@46/270

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,3941485955034497807,11036203168277288222,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1972,i,3941485955034497807,11036203168277288222,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1570345
Product:	CloudBasic
Start time:	20:44:28
Start date:	06.12.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com