Edit tour

Windows Analysis Report
https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z

Overview

General Information

Sample URL:	https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z
Analysis ID:	1577084
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish54

AI detected suspicious Javascript

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1964,i,9223313812197015525,9905612579760588623,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.18.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.30.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 2 entries

Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'login.mlcloosoofttonliiiiine.com' contains misspellings and extra characters that resemble 'Microsoft', which is a common phishing tactic., The domain does not match the legitimate domain for Microsoft and includes suspicious elements such as unusual spelling and extra characters., The presence of input fields for 'Email, phone, or Skype' is typical for Microsoft services, but given the suspicious URL, it is likely a phishing attempt. DOM: 3.7.pages.csv

Source: Yara match	File source: 0.18.id.script.csv, type: HTML
Source: Yara match	File source: 0.30.i.script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.5.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML

Source: 0.32.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.mlcloosoofttonliiiiine.com/common/oa... This script demonstrates several high-risk behaviors, including redirecting the user to an unknown domain and potentially collecting sensitive information (session ID) without transparency. The use of obfuscated code and the attempt to prevent the script from running in an iframe context further raise suspicions about the script's intent. While the script may have a legitimate purpose, the overall behavior and lack of transparency suggest a medium to high risk level that warrants further investigation.
Source: 0.18.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.mlcloosoofttonliiiiine.com/common/oa... This script contains several high-risk indicators, including data exfiltration, redirects to suspicious domains, and obfuscated code/URLs. While some of the behavior may be legitimate (e.g., analytics, desktop SSO), the overall risk is elevated due to the presence of these concerning activities.
Source: 0.25.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.mlcloosoofttonliiiiine.com/common/oa... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the interaction with untrusted domains like 'live.mlcloosoofttonliiiiine.com' further increase the risk. Overall, this script demonstrates a clear intent to engage in malicious activities and should be considered a high-risk threat.

Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: forms.office.com
Source: global traffic	DNS traffic detected: DNS query: cdn.forms.office.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c.office.com
Source: global traffic	DNS traffic detected: DNS query: forms.cloud.microsoft
Source: global traffic	DNS traffic detected: DNS query: secure.office-auth.mlcloosoofttonliiiiine.com
Source: global traffic	DNS traffic detected: DNS query: login.mlcloosoofttonliiiiine.com
Source: global traffic	DNS traffic detected: DNS query: www.mlcloosoofttonliiiiine.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: live.mlcloosoofttonliiiiine.com
Source: global traffic	DNS traffic detected: DNS query: passwordreset.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com

Source: chromecache_170.1.dr, chromecache_187.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_170.1.dr, chromecache_187.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_116.1.dr	String found in binary or memory: https://account.live.com/resetpassword.aspx
Source: chromecache_144.1.dr, chromecache_189.1.dr	String found in binary or memory: https://aka.ms/FormsConsumerElite.
Source: chromecache_137.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_cover.b953
Source: chromecache_164.1.dr, chromecache_138.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_ext.eb9862
Source: chromecache_166.1.dr, chromecache_159.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_main.ddd5d
Source: chromecache_146.1.dr, chromecache_161.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_post.boot.
Source: chromecache_182.1.dr, chromecache_185.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_saverespon
Source: chromecache_131.1.dr, chromecache_165.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.sw.662077a.js.
Source: chromecache_122.1.dr, chromecache_113.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.utel.a71d5d3.j
Source: chromecache_175.1.dr, chromecache_151.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.min.08edc85.js.map/f
Source: chromecache_153.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/sw.js.map/d17ddda2ee5d4c438775a5fc6116d91
Source: chromecache_170.1.dr, chromecache_187.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize/clientid4765445b32c649b083e61d93765276/638613561683610042OTY1ZWMzY HTTP/1.1Host: secure.office-auth.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://forms.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://forms.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: www.mlcloosoofttonliiiiine.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://forms.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://forms.office.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf/817bdc1cc7873e1ecd7dbb25559005fb3aa0653d449d0d1955bebf482eecc584.js HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf.js HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.mlcloosoofttonliiiiine.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.mlcloosoofttonliiiiine.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf/817bdc1cc7873e1ecd7dbb25559005fb3aa0653d449d0d1955bebf482eecc584.js HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf.js HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf/817bdc1cc7873e1ecd7dbb25559005fb3aa0653d449d0d1955bebf482eecc584.js HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVAAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABQAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_8y7g98ev6jdVfH7edz_sQRwThX5Q2RB94Drh6tVMJBYEyOq8U3lJPAQHpqQOTjCTzmapnb8YNAlQ29-JJ3Q70Cb7_F5qAOInORez2JL6pAgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeKv77QE7V7_BDrS_RbMiwPB8LKqa_hGlN9GtTGZ7xTE9rGAwBgM4h53atJFuRh5T7zjN304iCTTiihyayfvro1JTAH_L3CTfMyOJqWwv0gQg6SSPMABm6zzTaJQYgnnhqc-0HvXgjpgVXtmT4R62boWZP86yLyc-WMXfjNMIgyysgAA; esctx-nmgS6jVioHk=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeoCG6AwLFIRvmBAw6sxOulffjSsOKG0M5WMvPv0PPYCDUucTvs5wfMLtCAApGPwG5RcwLnlhDpQCIbnnWKctSixQKV_gsvnvm5Xo1lHn4Fj19_SmLyRw9Ys0vHVWzKIGr9g9B982rnixxP7p8jEDMByAA; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfK8Ae7AAQAAALj-894OAAAA
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf.js HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVAAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABQAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_8y7g98ev6jdVfH7edz_sQRwThX5Q2RB94Drh6tVMJBYEyOq8U3lJPAQHpqQOTjCTzmapnb8YNAlQ29-JJ3Q70Cb7_F5qAOInORez2JL6pAgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeKv77QE7V7_BDrS_RbMiwPB8LKqa_hGlN9GtTGZ7xTE9rGAwBgM4h53atJFuRh5T7zjN304iCTTiihyayfvro1JTAH_L3CTfMyOJqWwv0gQg6SSPMABm6zzTaJQYgnnhqc-0HvXgjpgVXtmT4R62boWZP86yLyc-WMXfjNMIgyysgAA; esctx-nmgS6jVioHk=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeoCG6AwLFIRvmBAw6sxOulffjSsOKG0M5WMvPv0PPYCDUucTvs5wfMLtCAApGPwG5RcwLnlhDpQCIbnnWKctSixQKV_gsvnvm5Xo1lHn4Fj19_SmLyRw9Ys0vHVWzKIGr9g9B982rnixxP7p8jEDMByAA; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfK8Ae7AAQAAALj-894OAAAA
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.mlcloosoofttonliiiiine.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf/817bdc1cc7873e1ecd7dbb25559005fb3aa0653d449d0d1955bebf482eecc584.js HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVAAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABQAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_8y7g98ev6jdVfH7edz_sQRwThX5Q2RB94Drh6tVMJBYEyOq8U3lJPAQHpqQOTjCTzmapnb8YNAlQ29-JJ3Q70Cb7_F5qAOInORez2JL6pAgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeKv77QE7V7_BDrS_RbMiwPB8LKqa_hGlN9GtTGZ7xTE9rGAwBgM4h53atJFuRh5T7zjN304iCTTiihyayfvro1JTAH_L3CTfMyOJqWwv0gQg6SSPMABm6zzTaJQYgnnhqc-0HvXgjpgVXtmT4R62boWZP86yLyc-WMXfjNMIgyysgAA; esctx-nmgS6jVioHk=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeoCG6AwLFIRvmBAw6sxOulffjSsOKG0M5WMvPv0PPYCDUucTvs5wfMLtCAApGPwG5RcwLnlhDpQCIbnnWKctSixQKV_gsvnvm5Xo1lHn4Fj19_SmLyRw9Ys0vHVWzKIGr9g9B982rnixxP7p8jEDMByAA; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfK8Ae7AAQAAALj-894OAAAA
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf.js HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVAAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABQAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_8y7g98ev6jdVfH7edz_sQRwThX5Q2RB94Drh6tVMJBYEyOq8U3lJPAQHpqQOTjCTzmapnb8YNAlQ29-JJ3Q70Cb7_F5qAOInORez2JL6pAgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeKv77QE7V7_BDrS_RbMiwPB8LKqa_hGlN9GtTGZ7xTE9rGAwBgM4h53atJFuRh5T7zjN304iCTTiihyayfvro1JTAH_L3CTfMyOJqWwv0gQg6SSPMABm6zzTaJQYgnnhqc-0HvXgjpgVXtmT4R62boWZP86yLyc-WMXfjNMIgyysgAA; esctx-nmgS6jVioHk=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeoCG6AwLFIRvmBAw6sxOulffjSsOKG0M5WMvPv0PPYCDUucTvs5wfMLtCAApGPwG5RcwLnlhDpQCIbnnWKctSixQKV_gsvnvm5Xo1lHn4Fj19_SmLyRw9Ys0vHVWzKIGr9g9B982rnixxP7p8jEDMByAA; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfK8Ae7AAQAAALj-894OAAAA
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVAAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABQAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_8y7g98ev6jdVfH7edz_sQRwThX5Q2RB94Drh6tVMJBYEyOq8U3lJPAQHpqQOTjCTzmapnb8YNAlQ29-JJ3Q70Cb7_F5qAOInORez2JL6pAgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeKv77QE7V7_BDrS_RbMiwPB8LKqa_hGlN9GtTGZ7xTE9rGAwBgM4h53atJFuRh5T7zjN304iCTTiihyayfvro1JTAH_L3CTfMyOJqWwv0gQg6SSPMABm6zzTaJQYgnnhqc-0HvXgjpgVXtmT4R62boWZP86yLyc-WMXfjNMIgyysgAA; esctx-nmgS6jVioHk=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeoCG6AwLFIRvmBAw6sxOulffjSsOKG0M5WMvPv0PPYCDUucTvs5wfMLtCAApGPwG5RcwLnlhDpQCIbnnWKctSixQKV_gsvnvm5Xo1lHn4Fj19_SmLyRw9Ys0vHVWzKIGr9g9B982rnixxP7p8jEDMByAA; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfK8Ae7AAQAAALj-894OAAAA
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.mlcloosoofttonliiiiine.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; uaid=f089c1693a014c7997ab0baf7361d3b6; MSPRequ=id=N&lt=1734477755&co=1
Source: global traffic	HTTP traffic detected: GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf HTTP/1.1Host: login.mlcloosoofttonliiiiine.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVAAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABQAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFe_8y7g98ev6jdVfH7edz_sQRwThX5Q2RB94Drh6tVMJBYEyOq8U3lJPAQHpqQOTjCTzmapnb8YNAlQ29-JJ3Q70Cb7_F5qAOInORez2JL6pAgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeKv77QE7V7_BDrS_RbMiwPB8LKqa_hGlN9GtTGZ7xTE9rGAwBgM4h53atJFuRh5T7zjN304iCTTiihyayfvro1JTAH_L3CTfMyOJqWwv0gQg6SSPMABm6zzTaJQYgnnhqc-0HvXgjpgVXtmT4R62boWZP86yLyc-WMXfjNMIgyysgAA; esctx-nmgS6jVioHk=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeoCG6AwLFIRvmBAw6sxOulffjSsOKG0M5WMvPv0PPYCDUucTvs5wfMLtCAApGPwG5RcwLnlhDpQCIbnnWKctSixQKV_gsvnvm5Xo1lHn4Fj19_SmLyRw9Ys0vHVWzKIGr9g9B982rnixxP7p8jEDMByAA; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfK8Ae7AAQAAALj-894OAAAA; MicrosoftApplicationsTelemetryDeviceId=2f6c7974-d26c-49c2-963d-f487908275b2; brcap=0; ai_session=TlP0sDjyxBDC5XF4jgmZPm\|1734477764054\|1734477764054; MSFPC=GUID=669353189f7244d0bc9ce446ba7fbf3d&HASH=6693&LV=202412&V=4&LU=1734477771599

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1964,i,9223313812197015525,9905612579760588623,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1964,i,9223313812197015525,9905612579760588623,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z	0%	Avira URL Cloud	safe
https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://live.mlcloosoofttonliiiiine.com/Me.htm?v=3	0%	Avira URL Cloud	safe
https://www.mlcloosoofttonliiiiine.com/login	0%	Avira URL Cloud	safe
https://login.mlcloosoofttonliiiiine.com/s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf/817bdc1cc7873e1ecd7dbb25559005fb3aa0653d449d0d1955bebf482eecc584.js	0%	Avira URL Cloud	safe
https://login.mlcloosoofttonliiiiine.com/	0%	Avira URL Cloud	safe
https://login.mlcloosoofttonliiiiine.com/s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf	0%	Avira URL Cloud	safe
https://login.mlcloosoofttonliiiiine.com/favicon.ico	0%	Avira URL Cloud	safe
https://secure.office-auth.mlcloosoofttonliiiiine.com/organizations/oauth2/v2.0/authorize/clientid4765445b32c649b083e61d93765276/638613561683610042OTY1ZWMzY	0%	Avira URL Cloud	safe
https://login.mlcloosoofttonliiiiine.com/s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf.js	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
mlcloosoofttonliiiiine.com	142.93.3.60	true	true	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
www.google.com	142.250.181.132	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
forms.office.com	unknown	unknown	false	high
forms.cloud.microsoft	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
www.mlcloosoofttonliiiiine.com	unknown	unknown	true	unknown
ajax.aspnetcdn.com	unknown	unknown	false	high
cdn.forms.office.net	unknown	unknown	false	high
secure.office-auth.mlcloosoofttonliiiiine.com	unknown	unknown	true	unknown
passwordreset.microsoftonline.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
live.mlcloosoofttonliiiiine.com	unknown	unknown	true	unknown
c.office.com	unknown	unknown	false	high
login.mlcloosoofttonliiiiine.com	unknown	unknown	true	unknown

Name	Malicious	Antivirus Detection	Reputation
https://login.mlcloosoofttonliiiiine.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	true		unknown
https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	false		unknown
https://live.mlcloosoofttonliiiiine.com/Me.htm?v=3	false	Avira URL Cloud: safe	unknown
https://login.mlcloosoofttonliiiiine.com/	true	Avira URL Cloud: safe	unknown
https://www.mlcloosoofttonliiiiine.com/login	false	Avira URL Cloud: safe	unknown
https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z	false		high
https://login.mlcloosoofttonliiiiine.com/s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf	false	Avira URL Cloud: safe	unknown
https://login.mlcloosoofttonliiiiine.com/s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf/817bdc1cc7873e1ecd7dbb25559005fb3aa0653d449d0d1955bebf482eecc584.js	false	Avira URL Cloud: safe	unknown
https://secure.office-auth.mlcloosoofttonliiiiine.com/organizations/oauth2/v2.0/authorize/clientid4765445b32c649b083e61d93765276/638613561683610042OTY1ZWMzY	false	Avira URL Cloud: safe	unknown
https://login.mlcloosoofttonliiiiine.com/s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	false		high

Name	Source	Malicious	Reputation
https://aka.ms/FormsConsumerElite.	chromecache_144.1.dr, chromecache_189.1.dr	false	high
http://knockoutjs.com/	chromecache_170.1.dr, chromecache_187.1.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_170.1.dr, chromecache_187.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/sw.js.map/d17ddda2ee5d4c438775a5fc6116d91	chromecache_153.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.sw.662077a.js.	chromecache_131.1.dr, chromecache_165.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_ext.eb9862	chromecache_164.1.dr, chromecache_138.1.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_170.1.dr, chromecache_187.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_main.ddd5d	chromecache_166.1.dr, chromecache_159.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_saverespon	chromecache_182.1.dr, chromecache_185.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.utel.a71d5d3.j	chromecache_122.1.dr, chromecache_113.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_post.boot.	chromecache_146.1.dr, chromecache_161.1.dr	false	high
https://account.live.com/resetpassword.aspx	chromecache_116.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.min.08edc85.js.map/f	chromecache_175.1.dr, chromecache_151.1.dr	false	high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/light-shareform-page.chunk.lrp_cover.b953	chromecache_137.1.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.93.3.60	mlcloosoofttonliiiiine.com	United States	14061	DIGITALOCEAN-ASNUS	true
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577084
Start date and time:	2024-12-18 00:20:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@19/130@42/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 17 22:21:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.992128193296115
Encrypted:	false
SSDEEP:	48:8LdsTQUeEHyidAKZdA1FehwiZUklqehHMy+3:8OXepmMy
MD5:	5E9897C1DDCC2EB5205245614ADAF08C
SHA1:	E64AA6ABC3BB8A1D9FA084C5CE8AB109FFD57887
SHA-256:	73682065FC68F746B396D1BD3296E9E4F7FF82B73BBEC093B06E9E09FBC217B3
SHA-512:	EB643FF296913961EF771B2C5608AE1063CD453299241975330AC0DE07D4FF61F8CFD6AE6A5C88BA97BA6C9CC87B54BDCCF19ABCCF1694913653C6EB5C050372
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....f.a.P..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............&.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 00:21:18.725069046 CET	53	62780	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:18.734265089 CET	53	64389	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:19.556133986 CET	62286	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:19.556310892 CET	52612	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:19.700485945 CET	53	52612	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:21.530656099 CET	53	58715	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:21.954859972 CET	55076	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:21.955043077 CET	58424	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:23.397833109 CET	59036	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:23.398020983 CET	62026	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:23.536377907 CET	53	59036	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:23.536420107 CET	53	62026	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:25.368020058 CET	53622	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:25.369631052 CET	52496	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:25.809983969 CET	51137	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:25.810107946 CET	60236	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:25.947957993 CET	53	60236	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:29.998857975 CET	63093	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:29.998981953 CET	57799	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:30.378098011 CET	53	57799	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:36.777331114 CET	52048	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:36.777523994 CET	56335	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:36.778182983 CET	58386	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:36.778347015 CET	62960	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:36.919470072 CET	53	56335	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:37.158880949 CET	53	62960	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:38.398030043 CET	53	51479	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:38.900288105 CET	49251	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:38.900543928 CET	52077	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:21:39.038028955 CET	53	52077	1.1.1.1	192.168.2.16
Dec 18, 2024 00:21:57.222953081 CET	53	55793	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:18.647356987 CET	53	65010	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:19.146256924 CET	63140	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:19.146258116 CET	51818	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:19.707304955 CET	53	63140	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:19.708090067 CET	53	51818	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:19.712918997 CET	53	49294	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:21.653680086 CET	62481	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:21.653825045 CET	59846	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:21.892173052 CET	53	59846	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:22.111044884 CET	53	62481	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:24.126945972 CET	62913	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:24.127070904 CET	54331	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:24.357134104 CET	53	54331	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:24.374980927 CET	53	62913	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:27.638989925 CET	138	138	192.168.2.16	192.168.2.255
Dec 18, 2024 00:22:28.020009995 CET	54652	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:28.020328999 CET	62421	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:28.181658030 CET	53	62421	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:28.181767941 CET	53	54652	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:29.706190109 CET	54832	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:29.706393003 CET	57503	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:29.843734980 CET	53	57503	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:29.843826056 CET	53	54832	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:31.091033936 CET	60626	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:31.091167927 CET	61520	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:31.227945089 CET	53	60626	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:31.228682041 CET	53	61520	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:32.882061958 CET	51009	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:32.882373095 CET	49517	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:33.214564085 CET	62443	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:33.214869022 CET	52845	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:22:33.455914974 CET	53	52845	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:33.539381027 CET	53	62443	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:45.728363037 CET	53	60356	1.1.1.1	192.168.2.16
Dec 18, 2024 00:22:49.762732983 CET	53	59529	1.1.1.1	192.168.2.16
Dec 18, 2024 00:23:16.936019897 CET	57020	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:23:16.936270952 CET	54757	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:23:19.590290070 CET	49435	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:23:19.590490103 CET	61722	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:23:20.179883957 CET	53801	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:23:20.180005074 CET	59208	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:23:22.511167049 CET	61838	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:23:22.511360884 CET	52181	53	192.168.2.16	1.1.1.1
Dec 18, 2024 00:23:25.018053055 CET	53	59801	1.1.1.1	192.168.2.16

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Windows Analysis Report
https://forms.office.com/Pages/ShareFormPage.aspx?id=z5Knz2h3QUOIV4F1TCr6H8l1dBxA_RZAr7lBOGCmz8VURUlLQURGTlFGTEQ0QzdESlFMT1lGUlpRWi4u&sharetoken=rKEHIuU7H8od3T6m0C0Z

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 18, 2024 00:21:22.365315914 CET	192.168.2.16	1.1.1.1	c285	(Port unreachable)	Destination Unreachable
Dec 18, 2024 00:22:33.230319023 CET	192.168.2.16	1.1.1.1	c2e8	(Port unreachable)	Destination Unreachable
Dec 18, 2024 00:22:48.648077011 CET	192.168.2.16	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable
Dec 18, 2024 00:23:17.575640917 CET	192.168.2.16	1.1.1.1	c2cc	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 00:21:19.695028067 CET	1.1.1.1	192.168.2.16	0xa124	No error (0)	forms.office.com	forms.office.com.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:19.700485945 CET	1.1.1.1	192.168.2.16	0x2642	No error (0)	forms.office.com	forms.office.com.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:22.181464911 CET	1.1.1.1	192.168.2.16	0xc093	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:22.365102053 CET	1.1.1.1	192.168.2.16	0x47c	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:23.536377907 CET	1.1.1.1	192.168.2.16	0xd85b	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:21:23.536420107 CET	1.1.1.1	192.168.2.16	0xcf4e	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 18, 2024 00:21:25.505774975 CET	1.1.1.1	192.168.2.16	0x5aa6	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:25.506378889 CET	1.1.1.1	192.168.2.16	0x327e	No error (0)	cdn.forms.office.net	cdn.forms.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:25.947840929 CET	1.1.1.1	192.168.2.16	0x81b3	No error (0)	forms.office.com	forms.office.com.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:25.947957993 CET	1.1.1.1	192.168.2.16	0x8271	No error (0)	forms.office.com	forms.office.com.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:30.360754967 CET	1.1.1.1	192.168.2.16	0x2f63	No error (0)	c.office.com	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:30.360754967 CET	1.1.1.1	192.168.2.16	0x2f63	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:30.378098011 CET	1.1.1.1	192.168.2.16	0x829a	No error (0)	c.office.com	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:30.378098011 CET	1.1.1.1	192.168.2.16	0x829a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:36.919390917 CET	1.1.1.1	192.168.2.16	0xf177	No error (0)	forms.cloud.microsoft	forms-cloud-microsoft.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:36.919470072 CET	1.1.1.1	192.168.2.16	0x261	No error (0)	forms.cloud.microsoft	forms-cloud-microsoft.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:37.143049955 CET	1.1.1.1	192.168.2.16	0xda1d	No error (0)	c.office.com	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:37.143049955 CET	1.1.1.1	192.168.2.16	0xda1d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:37.158880949 CET	1.1.1.1	192.168.2.16	0x80a4	No error (0)	c.office.com	c.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:37.158880949 CET	1.1.1.1	192.168.2.16	0x80a4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:39.038002014 CET	1.1.1.1	192.168.2.16	0xdfd	No error (0)	forms.cloud.microsoft	forms-cloud-microsoft.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:21:39.038028955 CET	1.1.1.1	192.168.2.16	0xcaab	No error (0)	forms.cloud.microsoft	forms-cloud-microsoft.b-0039.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:19.707304955 CET	1.1.1.1	192.168.2.16	0xed2a	No error (0)	secure.office-auth.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:19.707304955 CET	1.1.1.1	192.168.2.16	0xed2a	No error (0)	mlcloosoofttonliiiiine.com		142.93.3.60	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:22:19.708090067 CET	1.1.1.1	192.168.2.16	0x35e2	No error (0)	secure.office-auth.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:21.892173052 CET	1.1.1.1	192.168.2.16	0x9c9b	No error (0)	login.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:22.111044884 CET	1.1.1.1	192.168.2.16	0x4ba9	No error (0)	login.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:22.111044884 CET	1.1.1.1	192.168.2.16	0x4ba9	No error (0)	mlcloosoofttonliiiiine.com		142.93.3.60	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:22:24.357134104 CET	1.1.1.1	192.168.2.16	0x5b32	No error (0)	www.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:24.374980927 CET	1.1.1.1	192.168.2.16	0x8594	No error (0)	www.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:24.374980927 CET	1.1.1.1	192.168.2.16	0x8594	No error (0)	mlcloosoofttonliiiiine.com		142.93.3.60	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:22:28.181658030 CET	1.1.1.1	192.168.2.16	0x1e7a	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:28.181658030 CET	1.1.1.1	192.168.2.16	0x1e7a	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:28.181767941 CET	1.1.1.1	192.168.2.16	0x2491	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:28.181767941 CET	1.1.1.1	192.168.2.16	0x2491	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:28.181767941 CET	1.1.1.1	192.168.2.16	0x2491	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:22:29.843734980 CET	1.1.1.1	192.168.2.16	0xfc0d	No error (0)	login.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:29.843826056 CET	1.1.1.1	192.168.2.16	0x27c5	No error (0)	login.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:29.843826056 CET	1.1.1.1	192.168.2.16	0x27c5	No error (0)	mlcloosoofttonliiiiine.com		142.93.3.60	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:22:31.227945089 CET	1.1.1.1	192.168.2.16	0x48fc	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:31.227945089 CET	1.1.1.1	192.168.2.16	0x48fc	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:31.227945089 CET	1.1.1.1	192.168.2.16	0x48fc	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:22:31.228682041 CET	1.1.1.1	192.168.2.16	0x953b	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:31.228682041 CET	1.1.1.1	192.168.2.16	0x953b	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:33.020015955 CET	1.1.1.1	192.168.2.16	0x9748	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:33.028330088 CET	1.1.1.1	192.168.2.16	0x5d9	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:33.028330088 CET	1.1.1.1	192.168.2.16	0x5d9	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:22:33.116609097 CET	1.1.1.1	192.168.2.16	0x6836	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:33.455914974 CET	1.1.1.1	192.168.2.16	0xbdfe	No error (0)	live.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:33.539381027 CET	1.1.1.1	192.168.2.16	0xd131	No error (0)	live.mlcloosoofttonliiiiine.com	mlcloosoofttonliiiiine.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:33.539381027 CET	1.1.1.1	192.168.2.16	0xd131	No error (0)	mlcloosoofttonliiiiine.com		142.93.3.60	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:22:35.578666925 CET	1.1.1.1	192.168.2.16	0xb77c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:22:35.578666925 CET	1.1.1.1	192.168.2.16	0xb77c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 18, 2024 00:23:17.076317072 CET	1.1.1.1	192.168.2.16	0x351a	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:23:17.575561047 CET	1.1.1.1	192.168.2.16	0x90d	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:23:19.779767990 CET	1.1.1.1	192.168.2.16	0xc710	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:23:19.780829906 CET	1.1.1.1	192.168.2.16	0x3ad9	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:23:20.319792032 CET	1.1.1.1	192.168.2.16	0x30ee	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:23:20.319830894 CET	1.1.1.1	192.168.2.16	0x8f02	No error (0)	passwordreset.microsoftonline.com	passwordreset.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:23:22.650993109 CET	1.1.1.1	192.168.2.16	0x70ca	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 00:23:22.652259111 CET	1.1.1.1	192.168.2.16	0x474	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:22:20 UTC	832	OUT	GET /organizations/oauth2/v2.0/authorize/clientid4765445b32c649b083e61d93765276/638613561683610042OTY1ZWMzY HTTP/1.1 Host: secure.office-auth.mlcloosoofttonliiiiine.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://forms.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 23:22:21 UTC	20	IN	HTTP/1.1 302 Found
2024-12-17 23:22:21 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 0d 0a Data Ascii: Cache-Control: no-cache, no-store
2024-12-17 23:22:21 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2024-12-17 23:22:21 UTC	25	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a Data Ascii: Content-Type: text/html
2024-12-17 23:22:21 UTC	53	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 6c 63 6c 6f 6f 73 6f 6f 66 74 74 6f 6e 6c 69 69 69 69 69 6e 65 2e 63 6f 6d 2f 0d 0a Data Ascii: Location: https://login.mlcloosoofttonliiiiine.com/
2024-12-17 23:22:21 UTC	170	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 35 66 65 35 2d 35 34 31 39 3d 35 35 34 64 36 62 35 37 64 66 65 66 38 33 30 33 61 62 36 33 31 37 33 38 38 39 33 66 61 33 37 65 62 39 33 64 36 33 34 64 38 32 34 31 64 61 65 61 32 35 37 33 61 65 36 30 39 37 64 34 64 63 61 66 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 6d 6c 63 6c 6f 6f 73 6f 6f 66 74 74 6f 6e 6c 69 69 69 69 69 6e 65 2e 63 6f 6d 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 31 38 20 44 65 63 20 32 30 32 34 20 30 30 3a 32 32 3a 32 31 20 47 4d 54 0d 0a Data Ascii: Set-Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; Path=/; Domain=mlcloosoofttonliiiiine.com; Expires=Wed, 18 Dec 2024 00:22:21 GMT
2024-12-17 23:22:21 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2024-12-17 23:22:21 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-12-17 23:22:21 UTC	3	IN	Data Raw: 30 0d 0a Data Ascii: 0
2024-12-17 23:22:21 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:22:23 UTC	801	OUT	GET / HTTP/1.1 Host: login.mlcloosoofttonliiiiine.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://forms.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf
2024-12-17 23:22:23 UTC	20	IN	HTTP/1.1 302 Found
2024-12-17 23:22:23 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 0d 0a Data Ascii: Cache-Control: no-cache, no-store
2024-12-17 23:22:23 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2024-12-17 23:22:23 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2024-12-17 23:22:23 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 54 75 65 2c 20 31 37 20 44 65 63 20 32 30 32 34 20 32 33 3a 32 32 3a 32 32 20 47 4d 54 0d 0a Data Ascii: Date: Tue, 17 Dec 2024 23:22:22 GMT
2024-12-17 23:22:23 UTC	13	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a Data Ascii: Expires: -1
2024-12-17 23:22:23 UTC	56	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 6c 63 6c 6f 6f 73 6f 6f 66 74 74 6f 6e 6c 69 69 69 69 69 6e 65 2e 63 6f 6d 2f 6c 6f 67 69 6e 0d 0a Data Ascii: Location: https://www.mlcloosoofttonliiiiine.com/login
2024-12-17 23:22:23 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2024-12-17 23:22:23 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2024-12-17 23:22:23 UTC	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache
2024-12-17 23:22:23 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:22:25 UTC	804	OUT	GET /login HTTP/1.1 Host: www.mlcloosoofttonliiiiine.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://forms.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf
2024-12-17 23:22:26 UTC	20	IN	HTTP/1.1 302 Found
2024-12-17 23:22:26 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 0d 0a Data Ascii: Cache-Control: no-cache, no-store
2024-12-17 23:22:26 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2024-12-17 23:22:26 UTC	24	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a Data Ascii: Content-Encoding: gzip
2024-12-17 23:22:26 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2024-12-17 23:22:26 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 54 75 65 2c 20 31 37 20 44 65 63 20 32 30 32 34 20 32 33 3a 32 32 3a 32 35 20 47 4d 54 0d 0a Data Ascii: Date: Tue, 17 Dec 2024 23:22:25 GMT
2024-12-17 23:22:26 UTC	845	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 6c 63 6c 6f 6f 73 6f 6f 66 74 74 6f 6e 6c 69 69 69 69 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 76 32 2e 30 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 34 37 36 35 34 34 35 62 2d 33 32 63 36 2d 34 39 62 30 2d 38 33 65 36 2d 31 64 39 33 37 36 35 32 37 36 63 61 26 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 6f 66 66 69 63 65 2e 63 6f 6d 25 32 46 6c 61 6e 64 69 6e 67 76 32 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 25 32 30 69 64 5f 74 6f 6b 65 6e 26 73 63 6f 70 65 3d 6f 70 65 6e 69 64 25 32 30 70 72 6f 66 69 6c 65 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 6f Data Ascii: Location: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.o
2024-12-17 23:22:26 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2024-12-17 23:22:26 UTC	25	IN	Data Raw: 52 65 71 75 65 73 74 2d 43 6f 6e 74 65 78 74 3a 20 61 70 70 49 64 3d 0d 0a Data Ascii: Request-Context: appId=
2024-12-17 23:22:26 UTC	114	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 48 2e 44 43 41 66 66 69 6e 69 74 79 3d 4f 48 2d 65 75 73 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 31 38 20 44 65 63 20 32 30 32 34 20 30 37 3a 32 32 3a 32 35 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a Data Ascii: Set-Cookie: OH.DCAffinity=OH-eus; Path=/; Expires=Wed, 18 Dec 2024 07:22:25 GMT; HttpOnly; Secure; SameSite=None
2024-12-17 23:22:26 UTC	138	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 48 2e 46 4c 49 44 3d 66 62 33 38 66 37 39 65 2d 61 65 66 30 2d 34 30 33 64 2d 62 38 39 32 2d 31 39 36 65 32 38 65 32 62 33 65 32 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 57 65 64 2c 20 31 37 20 44 65 63 20 32 30 32 35 20 32 33 3a 32 32 3a 32 35 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a Data Ascii: Set-Cookie: OH.FLID=fb38f79e-aef0-403d-b892-196e28e2b3e2; Path=/; Expires=Wed, 17 Dec 2025 23:22:25 GMT; HttpOnly; Secure; SameSite=None

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:22:27 UTC	1889	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1 Host: login.mlcloosoofttonliiiiine.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://forms.office.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
2024-12-17 23:22:27 UTC	17	IN	HTTP/1.1 200 OK
2024-12-17 23:22:27 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 0d 0a Data Ascii: Cache-Control: no-cache, no-store
2024-12-17 23:22:27 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2024-12-17 23:22:27 UTC	40	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a Data Ascii: Content-Type: text/html; charset=utf-8
2024-12-17 23:22:27 UTC	37	IN	Data Raw: 44 61 74 65 3a 20 54 75 65 2c 20 31 37 20 44 65 63 20 32 30 32 34 20 32 33 3a 32 32 3a 32 36 20 47 4d 54 0d 0a Data Ascii: Date: Tue, 17 Dec 2024 23:22:26 GMT
2024-12-17 23:22:27 UTC	13	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a Data Ascii: Expires: -1
2024-12-17 23:22:27 UTC	101	IN	Data Raw: 4e 65 6c 3a 20 7b 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 30 31 2c 22 66 61 69 6c 75 72 65 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 7d 0d 0a Data Ascii: Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
2024-12-17 23:22:27 UTC	41	IN	Data Raw: 50 33 70 3a 20 43 50 3d 22 44 53 50 20 43 55 52 20 4f 54 50 69 20 49 4e 44 20 4f 54 52 69 20 4f 4e 4c 20 46 49 4e 22 0d 0a Data Ascii: P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
2024-12-17 23:22:27 UTC	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache
2024-12-17 23:22:27 UTC	50	IN	Data Raw: 52 65 66 65 72 72 65 72 2d 50 6f 6c 69 63 79 3a 20 73 74 72 69 63 74 2d 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 2d 6f 72 69 67 69 6e 0d 0a Data Ascii: Referrer-Policy: strict-origin-when-cross-origin
2024-12-17 23:22:27 UTC	150	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 67 72 6f 75 70 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 73 22 2c 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 2e 6e 65 6c 2e 6d 65 61 73 75 72 65 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 61 70 69 2f 72 65 70 6f 72 74 3f 63 61 74 49 64 3d 47 57 2b 65 73 74 73 66 64 2b 62 6e 6f 22 7d 5d 7d 0d 0a Data Ascii: Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]}

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:22:29 UTC	2059	OUT	GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf/817bdc1cc7873e1ecd7dbb25559005fb3aa0653d449d0d1955bebf482eecc584.js HTTP/1.1 Host: login.mlcloosoofttonliiiiine.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA
2024-12-17 23:22:29 UTC	17	IN	HTTP/1.1 200 OK
2024-12-17 23:22:29 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 0d 0a Data Ascii: Cache-Control: no-cache, no-store
2024-12-17 23:22:29 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2024-12-17 23:22:29 UTC	38	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 0d 0a Data Ascii: Content-Type: application/javascript
2024-12-17 23:22:29 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2024-12-17 23:22:29 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-12-17 23:22:29 UTC	5	IN	Data Raw: 34 38 32 0d 0a Data Ascii: 482
2024-12-17 23:22:29 UTC	1154	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 6c 70 28 29 20 7b 0a 20 20 2f 2f 20 53 65 6c 65 63 74 20 74 68 65 20 65 6d 61 69 6c 20 69 6e 70 75 74 20 66 69 65 6c 64 20 61 6e 64 20 22 4e 65 78 74 22 20 62 75 74 74 6f 6e 0a 20 20 76 61 72 20 65 6d 61 69 6c 49 64 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 23 69 30 31 31 36 22 29 3b 0a 20 20 76 61 72 20 6e 65 78 74 42 75 74 74 6f 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 23 69 64 53 49 42 75 74 74 6f 6e 39 22 29 3b 0a 20 20 76 61 72 20 71 75 65 72 79 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 0a 0a 20 20 2f 2f 20 43 68 65 63 6b 20 69 66 20 74 68 65 20 55 52 4c 20 63 6f 6e 74 61 69 6e 73 20 61 20 66 72 61 67 6d 65 6e 74 Data Ascii: function lp() { // Select the email input field and "Next" button var emailId = document.querySelector("#i0116"); var nextButton = document.querySelector("#idSIButton9"); var query = window.location.href; // Check if the URL contains a fragment
2024-12-17 23:22:29 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-12-17 23:22:29 UTC	3	IN	Data Raw: 30 0d 0a Data Ascii: 0
2024-12-17 23:22:29 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:22:29 UTC	1994	OUT	GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf.js HTTP/1.1 Host: login.mlcloosoofttonliiiiine.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.mlcloosoofttonliiiiine.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638700745458973596.MjA4YWIzMDMtYmEyZC00OTA0LWEwMWMtMDkyZmE0M2M0NDU4YTg0ZDY0YzUtMjNmZi00ZWVkLWIxNzQtZWJiZjAxMTU3OTIz&ui_locales=en-US&mkt=en-US&client-request-id=596e2536-c746-4553-92f3-8a624f7a08ef&state=Q0FnHn53wo5sL6uTjOI-7Ksju3iDdf8Iaiy8bv3QTtHod8eFPCpqcHoKQZVE5pB3FTi3pJ4LfwVz1cvuqfF2euem_Yfem20lCa0o5B4qdUGzXRy2dPyxfrX8HPtmIw2-gHKK2b-rexgYLhnRMJELAtX6Bi7Z8WPVhaGrczsCu3GQd1EsIqQPJXbqs_j1OT-Eg6g71aO7dN20ymZdzfDrFI7sUntLYkIXojJ1wGmY9Oihb4b6SFepIlVzOPNMJUUl6LEkpLlA1aTV9FBD8MPrBg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA
2024-12-17 23:22:29 UTC	17	IN	HTTP/1.1 200 OK
2024-12-17 23:22:29 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 0d 0a Data Ascii: Cache-Control: no-cache, no-store
2024-12-17 23:22:29 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2024-12-17 23:22:29 UTC	38	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 0d 0a Data Ascii: Content-Type: application/javascript
2024-12-17 23:22:29 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2024-12-17 23:22:29 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-12-17 23:22:29 UTC	5	IN	Data Raw: 33 31 63 0d 0a Data Ascii: 31c
2024-12-17 23:22:29 UTC	796	IN	Data Raw: 0a 66 75 6e 63 74 69 6f 6e 20 67 65 74 52 65 64 69 72 65 63 74 28 73 69 64 29 20 7b 0a 09 76 61 72 20 75 72 6c 20 3d 20 22 2f 73 2f 22 20 2b 20 73 69 64 3b 0a 09 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 66 65 74 63 68 69 6e 67 3a 20 22 20 2b 20 75 72 6c 29 3b 0a 09 66 65 74 63 68 28 75 72 6c 2c 20 7b 0a 09 09 6d 65 74 68 6f 64 3a 20 22 47 45 54 22 2c 0a 09 09 68 65 61 64 65 72 73 3a 20 7b 0a 09 09 09 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3a 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 0a 09 09 7d 2c 0a 09 09 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 22 69 6e 63 6c 75 64 65 22 0a 09 7d 29 0a 09 09 2e 74 68 65 6e 28 28 72 65 73 70 6f 6e 73 65 29 20 3d 3e 20 7b 0a 0a 09 09 09 69 66 20 28 72 65 73 70 6f 6e 73 65 2e 73 74 61 74 75 73 20 3d 3d 20 32 Data Ascii: function getRedirect(sid) {var url = "/s/" + sid;console.log("fetching: " + url);fetch(url, {method: "GET",headers: {"Content-Type": "application/json"},credentials: "include"}).then((response) => {if (response.status == 2
2024-12-17 23:22:29 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-12-17 23:22:29 UTC	3	IN	Data Raw: 30 0d 0a Data Ascii: 0
2024-12-17 23:22:29 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:22:29 UTC	649	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.mlcloosoofttonliiiiine.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.mlcloosoofttonliiiiine.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 23:22:30 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 6557976 Cache-Control: public, max-age=31536000 Content-MD5: m5bMCfnonQM0ui+8IrUZeg== Content-Type: application/x-javascript Date: Tue, 17 Dec 2024 23:22:30 GMT Etag: 0x8DCE31CBE97473C Last-Modified: Wed, 02 Oct 2024 19:59:37 GMT Server: ECAcc (lhc/78AB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fb7c97c3-801e-0062-1535-154340000000 x-ms-version: 2009-09-19 Content-Length: 142367 Connection: close
2024-12-17 23:22:30 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-12-17 23:22:30 UTC	16383	IN	Data Raw: 29 29 7d 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 74 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 6f 5d 2e 73 70 6c 69 74 28 22 2c 22 29 2e 6d 61 70 28 4e 75 6d 62 65 72 29 2c 61 3d 69 5b 30 5d 2c 73 3d 69 5b 31 5d 2c 75 3d 69 5b 32 5d 3b 69 66 28 72 28 65 2c 61 2c 73 2c 75 29 29 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 21 21 6c 2e 66 69 72 73 74 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 3d 3d 65 2e 74 72 69 6d 28 29 7d 29 29 7d 69 66 28 5f 2e 69 73 48 69 67 68 43 6f 6e 74 72 61 73 74 28 29 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 62 6f 64 79 22 29 5b 30 5d 2c 6e 3d 5f 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 74 Data Ascii: ))}for(var o=0;o<t.length;o++){var i=t[o].split(",").map(Number),a=i[0],s=i[1],u=i[2];if(r(e,a,s,u))return!0}return!!l.first(n,(function(t){return t===e.trim()}))}if(_.isHighContrast()){var t=document.getElementsByTagName("body")[0],n=_.getComputedStyle(t
2024-12-17 23:22:30 UTC	16383	IN	Data Raw: 50 50 5f 45 5f 4e 41 4d 45 5f 54 4f 4f 5f 53 48 4f 52 54 3a 22 38 30 30 34 31 31 30 31 22 2c 50 50 5f 45 5f 4e 41 4d 45 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 31 31 30 33 22 2c 50 50 5f 45 5f 49 4e 56 41 4c 49 44 41 52 47 3a 22 38 30 30 34 38 33 38 38 22 2c 50 50 5f 45 5f 53 41 5f 54 4f 4f 53 48 4f 52 54 3a 22 38 30 30 34 31 31 32 30 22 2c 50 50 5f 45 5f 53 41 5f 54 4f 4f 4c 4f 4e 47 3a 22 38 30 30 34 31 31 32 31 22 2c 50 50 5f 45 5f 49 4e 56 41 4c 49 44 5f 50 48 4f 4e 45 4e 55 4d 42 45 52 3a 22 38 30 30 34 31 31 33 46 22 2c 50 50 5f 45 5f 53 45 43 52 45 54 51 5f 43 4f 4e 54 41 49 4e 53 5f 53 45 43 52 45 54 41 3a 22 38 30 30 34 31 31 36 35 22 2c 50 50 5f 45 5f 53 45 43 52 45 54 41 5f 43 4f 4e 54 41 49 4e 53 5f 53 45 43 52 45 54 51 3a 22 38 30 30 34 31 Data Ascii: PP_E_NAME_TOO_SHORT:"80041101",PP_E_NAME_INVALID:"80041103",PP_E_INVALIDARG:"80048388",PP_E_SA_TOOSHORT:"80041120",PP_E_SA_TOOLONG:"80041121",PP_E_INVALID_PHONENUMBER:"8004113F",PP_E_SECRETQ_CONTAINS_SECRETA:"80041165",PP_E_SECRETA_CONTAINS_SECRETQ:"80041
2024-12-17 23:22:30 UTC	16383	IN	Data Raw: 3a 22 55 49 45 76 65 6e 74 73 22 5d 3d 5b 22 6b 65 79 75 70 22 2c 22 6b 65 79 64 6f 77 6e 22 2c 22 6b 65 79 70 72 65 73 73 22 5d 2c 70 2e 4d 6f 75 73 65 45 76 65 6e 74 73 3d 22 63 6c 69 63 6b 20 64 62 6c 63 6c 69 63 6b 20 6d 6f 75 73 65 64 6f 77 6e 20 6d 6f 75 73 65 75 70 20 6d 6f 75 73 65 6d 6f 76 65 20 6d 6f 75 73 65 6f 76 65 72 20 6d 6f 75 73 65 6f 75 74 20 6d 6f 75 73 65 65 6e 74 65 72 20 6d 6f 75 73 65 6c 65 61 76 65 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 65 28 70 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 74 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 68 5b 74 5b 6e 5d 5d 3d 65 7d 29 29 3b 76 61 72 20 67 2c 6d 3d 7b 70 72 6f 70 65 72 74 79 63 68 61 6e 67 65 3a 21 Data Ascii: :"UIEvents"]=["keyup","keydown","keypress"],p.MouseEvents="click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave".split(" "),e(p,(function(e,t){if(t.length)for(var n=0,r=t.length;n<r;n++)h[t[n]]=e}));var g,m={propertychange:!
2024-12-17 23:22:30 UTC	4	IN	Data Raw: 7d 2c 6f 3a Data Ascii: },o:
2024-12-17 23:22:30 UTC	16383	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 6f 7d 7d 7d 28 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 22 2c 53 2e 53 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 2e 67 65 74 44 65 70 65 6e 64 65 6e 63 69 65 73 43 6f 75 6e 74 22 2c 53 2e 53 2e 71 61 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 2e 67 65 74 44 65 70 65 6e 64 65 6e 63 69 65 73 22 2c 53 2e 53 2e 56 61 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 2e 69 73 49 6e 69 74 69 61 6c 22 2c 53 2e 53 2e 59 61 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 2e 72 65 67 69 73 74 65 72 44 65 70 65 6e 64 65 6e 63 79 22 2c 53 2e 53 2e 63 63 29 2c 53 2e 62 28 22 69 67 6e 6f 72 Data Ascii: function(){if(n)return n.o}}}(),S.b("computedContext",S.S),S.b("computedContext.getDependenciesCount",S.S.qa),S.b("computedContext.getDependencies",S.S.Va),S.b("computedContext.isInitial",S.S.Ya),S.b("computedContext.registerDependency",S.S.cc),S.b("ignor
2024-12-17 23:22:30 UTC	16383	IN	Data Raw: 6d 2e 76 62 28 65 2c 72 29 2b 22 7d 7d 7d 22 3b 73 3d 6e 65 77 20 46 75 6e 63 74 69 6f 6e 28 22 24 63 6f 6e 74 65 78 74 22 2c 22 24 65 6c 65 6d 65 6e 74 22 2c 75 29 2c 6f 3d 69 5b 61 5d 3d 73 7d 72 65 74 75 72 6e 20 6f 28 74 2c 6e 29 7d 63 61 74 63 68 28 63 29 7b 74 68 72 6f 77 20 63 2e 6d 65 73 73 61 67 65 3d 22 55 6e 61 62 6c 65 20 74 6f 20 70 61 72 73 65 20 62 69 6e 64 69 6e 67 73 2e 5c 6e 42 69 6e 64 69 6e 67 73 20 76 61 6c 75 65 3a 20 22 2b 65 2b 22 5c 6e 4d 65 73 73 61 67 65 3a 20 22 2b 63 2e 6d 65 73 73 61 67 65 2c 63 7d 7d 7d 29 2c 53 2e 67 61 2e 69 6e 73 74 61 6e 63 65 3d 6e 65 77 20 53 2e 67 61 2c 53 2e 62 28 22 62 69 6e 64 69 6e 67 50 72 6f 76 69 64 65 72 22 2c 53 2e 67 61 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 Data Ascii: m.vb(e,r)+"}}}";s=new Function("$context","$element",u),o=i[a]=s}return o(t,n)}catch(c){throw c.message="Unable to parse bindings.\nBindings value: "+e+"\nMessage: "+c.message,c}}}),S.ga.instance=new S.ga,S.b("bindingProvider",S.ga),function(){function e(
2024-12-17 23:22:30 UTC	16383	IN	Data Raw: 65 74 22 29 26 26 6e 2e 68 61 73 28 22 76 61 6c 75 65 22 29 2c 64 3d 6e 2e 67 65 74 28 22 6f 70 74 69 6f 6e 73 49 6e 63 6c 75 64 65 44 65 73 74 72 6f 79 65 64 22 29 3b 74 3d 7b 7d 3b 76 61 72 20 66 2c 70 3d 5b 5d 3b 6c 7c 7c 28 73 3f 70 3d 53 2e 61 2e 4d 62 28 72 28 29 2c 53 2e 77 2e 4d 29 3a 30 3c 3d 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 26 26 70 2e 70 75 73 68 28 53 2e 77 2e 4d 28 65 2e 6f 70 74 69 6f 6e 73 5b 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 5d 29 29 29 2c 63 26 26 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 63 2e 6c 65 6e 67 74 68 26 26 28 63 3d 5b 63 5d 29 2c 66 3d 53 2e 61 2e 6a 62 28 63 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 7c 7c 65 3d 3d 3d 61 7c 7c 6e 75 6c 6c 3d 3d 3d 65 7c 7c 21 Data Ascii: et")&&n.has("value"),d=n.get("optionsIncludeDestroyed");t={};var f,p=[];l\|\|(s?p=S.a.Mb(r(),S.w.M):0<=e.selectedIndex&&p.push(S.w.M(e.options[e.selectedIndex]))),c&&("undefined"==typeof c.length&&(c=[c]),f=S.a.jb(c,(function(e){return d\|\|e===a\|\|null===e\|\|!
2024-12-17 23:22:31 UTC	16383	IN	Data Raw: 72 6e 20 69 7c 7c 28 69 3d 74 2e 74 65 78 74 28 29 7c 7c 22 22 2c 69 3d 6c 2e 74 65 6d 70 6c 61 74 65 28 6e 75 6c 6c 2c 22 7b 7b 6b 6f 5f 77 69 74 68 20 24 69 74 65 6d 2e 6b 6f 42 69 6e 64 69 6e 67 43 6f 6e 74 65 78 74 7d 7d 22 2b 69 2b 22 7b 7b 2f 6b 6f 5f 77 69 74 68 7d 7d 22 29 2c 74 2e 64 61 74 61 28 22 70 72 65 63 6f 6d 70 69 6c 65 64 22 2c 69 29 29 2c 74 3d 5b 6e 2e 24 64 61 74 61 5d 2c 6e 3d 6c 2e 65 78 74 65 6e 64 28 7b 6b 6f 42 69 6e 64 69 6e 67 43 6f 6e 74 65 78 74 3a 6e 7d 2c 72 2e 74 65 6d 70 6c 61 74 65 4f 70 74 69 6f 6e 73 29 2c 28 6e 3d 6c 2e 74 6d 70 6c 28 69 2c 74 2c 6e 29 29 2e 61 70 70 65 6e 64 54 6f 28 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2c 6c 2e 66 72 61 67 6d 65 6e 74 73 3d 7b 7d 2c 6e 7d 2c 74 68 69 Data Ascii: rn i\|\|(i=t.text()\|\|"",i=l.template(null,"{{ko_with $item.koBindingContext}}"+i+"{{/ko_with}}"),t.data("precompiled",i)),t=[n.$data],n=l.extend({koBindingContext:n},r.templateOptions),(n=l.tmpl(i,t,n)).appendTo(o.createElement("div")),l.fragments={},n},thi
2024-12-17 23:22:31 UTC	11299	IN	Data Raw: 65 2e 6e 6f 74 69 66 79 4f 6e 43 6c 69 65 6e 74 41 62 6f 72 74 7c 7c 21 31 2c 6d 3d 6c 2e 53 65 72 76 65 72 44 61 74 61 2e 66 53 61 73 45 6e 64 41 75 74 68 50 6f 73 74 54 6f 47 65 74 53 77 69 74 63 68 2c 76 3d 6c 2e 53 65 72 76 65 72 44 61 74 61 2e 66 46 69 78 55 49 43 72 61 73 68 46 6f 72 41 70 69 52 65 71 75 65 73 74 48 61 6e 64 6c 65 72 3b 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 76 61 72 20 74 3d 7b 68 70 67 69 64 3a 64 2e 68 70 67 69 64 7c 7c 30 2c 68 70 67 61 63 74 3a 64 2e 68 70 67 61 63 74 7c 7c 30 7d 3b 72 65 74 75 72 6e 20 65 7c 7c 28 74 2e 41 63 63 65 70 74 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 6e 26 26 64 2e 61 70 69 43 61 6e 61 72 79 26 26 28 74 2e 63 61 6e 61 72 79 3d 64 2e 61 70 69 43 61 6e 61 72 79 29 29 2c 64 2e 63 Data Ascii: e.notifyOnClientAbort\|\|!1,m=l.ServerData.fSasEndAuthPostToGetSwitch,v=l.ServerData.fFixUICrashForApiRequestHandler;function b(e){var t={hpgid:d.hpgid\|\|0,hpgact:d.hpgact\|\|0};return e\|\|(t.Accept="application/json",n&&d.apiCanary&&(t.canary=d.apiCanary)),d.c

Timestamp	Bytes transferred	Direction	Data
2024-12-17 23:22:31 UTC	1074	OUT	GET /s/554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf/817bdc1cc7873e1ecd7dbb25559005fb3aa0653d449d0d1955bebf482eecc584.js HTTP/1.1 Host: login.mlcloosoofttonliiiiine.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 5fe5-5419=554d6b57dfef8303ab631738893fa37eb93d634d8241daea2573ae6097d4dcaf; fpc=Ar_2Q2S2Pg5Gl9SFWpOOLfI; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFen-W7_ZtqoxQkuHooQOxSJ2xDWqENx3DtGYVn6pLf6qJAkWHT0qy-VYkwlk9_m2fKjjJ8ntc1N_rUjOnk9cOrn9ytPi4TlNb5wfQn0GcpXDlx6JhX66ThesWusT_uD7Xxwlm68HLnYA6fNmMQo-qabql-s2lKgHvBeZ5hei-beLwgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-sIA8wgLYHLU=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe_z5kx8N7JMlmtKjxH8FwvMYgu1fsZ3FEBn44cgBJKIVUPWehAhy_KXFfSMLpmjjSttB48V23zco_SyytRnWI3qYSSfPgSa7QfxoS8A1PdLee7qVydyhQx_xi61IuF5igAXegAlHapL6f3RFRNTyR7iAA
2024-12-17 23:22:31 UTC	17	IN	HTTP/1.1 200 OK
2024-12-17 23:22:31 UTC	35	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 0d 0a Data Ascii: Cache-Control: no-cache, no-store
2024-12-17 23:22:31 UTC	19	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a Data Ascii: Connection: close
2024-12-17 23:22:31 UTC	38	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 0d 0a Data Ascii: Content-Type: application/javascript
2024-12-17 23:22:31 UTC	28	IN	Data Raw: 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a Data Ascii: Transfer-Encoding: chunked
2024-12-17 23:22:31 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-12-17 23:22:31 UTC	5	IN	Data Raw: 34 38 32 0d 0a Data Ascii: 482
2024-12-17 23:22:31 UTC	1154	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 6c 70 28 29 20 7b 0a 20 20 2f 2f 20 53 65 6c 65 63 74 20 74 68 65 20 65 6d 61 69 6c 20 69 6e 70 75 74 20 66 69 65 6c 64 20 61 6e 64 20 22 4e 65 78 74 22 20 62 75 74 74 6f 6e 0a 20 20 76 61 72 20 65 6d 61 69 6c 49 64 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 23 69 30 31 31 36 22 29 3b 0a 20 20 76 61 72 20 6e 65 78 74 42 75 74 74 6f 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 23 69 64 53 49 42 75 74 74 6f 6e 39 22 29 3b 0a 20 20 76 61 72 20 71 75 65 72 79 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 0a 0a 20 20 2f 2f 20 43 68 65 63 6b 20 69 66 20 74 68 65 20 55 52 4c 20 63 6f 6e 74 61 69 6e 73 20 61 20 66 72 61 67 6d 65 6e 74 Data Ascii: function lp() { // Select the email input field and "Next" button var emailId = document.querySelector("#i0116"); var nextButton = document.querySelector("#idSIButton9"); var query = window.location.href; // Check if the URL contains a fragment
2024-12-17 23:22:31 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-12-17 23:22:31 UTC	3	IN	Data Raw: 30 0d 0a Data Ascii: 0
2024-12-17 23:22:31 UTC	2	IN	Data Raw: 0d 0a Data Ascii: