Edit tour

Windows Analysis Report
https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360

Overview

General Information

Sample URL:	https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360
Analysis ID:	1672210
Infos:

Detection

Score:	1
Range:	0 - 100
Confidence:	80%

Signatures

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2348,i,485283711926833969,11984244100879002866,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2408 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.195:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.176:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.222.3.228:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.176:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.176:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.134:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.164:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.132:443 -> 192.168.2.4:49767 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: insightonline.sharepoint.com to https://login.microsoftonline.com:443/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5fid=00000003%2d0000%2d0ff1%2dce00%2d000000000000&response%5fmode=form%5fpost&response%5ftype=code%20id%5ftoken&resource=00000003%2d0000%2d0ff1%2dce00%2d000000000000&scope=openid&nonce=96acdd1461fd30a051def9e273c923000f212785fffd59c9%2d5b5fc25fd28981c7c3d032909fa1fd7fb0e6c4feacc25cc481a4260897446b34&redirect%5furi=https%3a%2f%2finsightonline%2esharepoint%2ecom%2f%5fforms%2fdefault%2easpx&state=od0w&claims=%7b%22id%5ftoken%22%3a%7b%22xms%5fcc%22%3a%7b%22values%22%3a%5b%22cp1%22%5d%7d%7d%7d&wsucxt=1&cobrandid=11bd8083%2d87e0%2d41b5%2dbb78%2d0bc43c8a8e8a&client%2drequest%2did=c95697a1%2de060%2d7000%2d8cf5%2ded8c9602ffa7

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.73.19
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.73.19
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.73.19
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.73.19
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360 HTTP/1.1Host: insightonline.sharepoint.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/BranchActivity/_layouts/15/Authenticate.aspx?Source=%2Fsites%2FBranchActivity%3Fe%3D1%3A47dc38c788c14f5d8f61d085b29e2360 HTTP/1.1Host: insightonline.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2fsites%2fBranchActivity%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fsites%252FBranchActivity%253Fe%253D1%253A47dc38c788c14f5d8f61d085b29e2360&Source=cookie HTTP/1.1Host: insightonline.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: RpsContextCookie=U291cmNlPSUyRnNpdGVzJTJGQnJhbmNoQWN0aXZpdHklM0ZlJTNEMSUzQTQ3ZGMzOGM3ODhjMTRmNWQ4ZjYxZDA4NWIyOWUyMzYw
Source: global traffic	HTTP traffic detected: GET /6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7 HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; fpc=AvmamRdZkMxEhOz5hNzPZ-I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQENJeSLQyYTzfcrSyI5OPNLFNbXJcaeM4fvrbnBViIkYXqc0Qr08R39eKy-tnq8CTxX2WBvdhZL6y_LNiGdPSkHypoXbioxN_kD7q-FJ48_09y2h4cOJyBmot_pbJSsiLRphItl_r8iLtv8WUJKiZCt4ifY7I7nUPaachod7rPO0YgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; fpc=AvmamRdZkMxEhOz5hNzPZ-I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQENJeSLQyYTzfcrSyI5OPNLFNbXJcaeM4fvrbnBViIkYXqc0Qr08R39eKy-tnq8CTxX2WBvdhZL6y_LNiGdPSkHypoXbioxN_kD7q-FJ48_09y2h4cOJyBmot_pbJSsiLRphItl_r8iLtv8WUJKiZCt4ifY7I7nUPaachod7rPO0YgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-pf40mgalcnvgg-vse6vjsz2gcrgsefqyr125xohgjb4/logintenantbranding/0/illustration?ts=637457280173812764 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-pf40mgalcnvgg-vse6vjsz2gcrgsefqyr125xohgjb4/logintenantbranding/0/bannerlogo?ts=637457280183629469 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6c637512-c417-4e78-9d62-b61258e4b619/winauth/ssoprobe?client-request-id=c95697a1-e060-7000-8cf5-ed8c9602ffa7&_=1745421851808 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-pf40mgalcnvgg-vse6vjsz2gcrgsefqyr125xohgjb4/logintenantbranding/0/bannerlogo?ts=637457280183629469 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-pf40mgalcnvgg-vse6vjsz2gcrgsefqyr125xohgjb4/logintenantbranding/0/illustration?ts=637457280173812764 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AScAEnVjbBfEeE6dYrYSWOS2GQMAAAAAAPEPzgAAAAAAAAAnAAAnAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE8WmWoXCyNgPty1Hi5Lkl8ub1dd51MtxwG-xgvhfGD5vervAy1vfwa3rIrDOZP44K6ud_kBBTnNNRLS2V27mUM5d_pwgJJF2MIuCk2fp9iCwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEO-ERn3NBTtQnk1ZTfo3s4kqxoLr0RENg6z-ZmLsURPzjEjJRJ6LqAbyGkZ4K9U-WSoSuHedX_C1zSOjjNfhZj8z2LJwTEMiYv5rlDqTe3BUpp7Y6JLWnTQG3S32e6baY9CplkqI4xdEzEWP6H0bq7jgKfnTnCRODW7AexaNydHYgAA; esctx-MoOJ9ubg92Q=AQABCQEAAABVrSpeuWamRam2jAF1XRQEXmCRzPwucB3q9clkL22VIqC7w4UgOFpWLpISv6kGjC4QnHZr-6Yfu6N1j5veXOuvMPJqnk64ipDsfOXO729KDkW2Vvbs6eTHFNkXoRJ0ICEfgNGeo-KVBWk9NEmsHENW5-wMmGizLao-EXF8XgajgCAA; fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=eb2a1164-c77c-4551-81cc-8d53b3d829c0; brcap=0; ai_session=en2aAOqTXuUx0FUtfuZNKe\|1745421853128\|1745421853128
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AScAEnVjbBfEeE6dYrYSWOS2GQMAAAAAAPEPzgAAAAAAAAAnAAAnAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE8WmWoXCyNgPty1Hi5Lkl8ub1dd51MtxwG-xgvhfGD5vervAy1vfwa3rIrDOZP44K6ud_kBBTnNNRLS2V27mUM5d_pwgJJF2MIuCk2fp9iCwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEO-ERn3NBTtQnk1ZTfo3s4kqxoLr0RENg6z-ZmLsURPzjEjJRJ6LqAbyGkZ4K9U-WSoSuHedX_C1zSOjjNfhZj8z2LJwTEMiYv5rlDqTe3BUpp7Y6JLWnTQG3S32e6baY9CplkqI4xdEzEWP6H0bq7jgKfnTnCRODW7AexaNydHYgAA; esctx-MoOJ9ubg92Q=AQABCQEAAABVrSpeuWamRam2jAF1XRQEXmCRzPwucB3q9clkL22VIqC7w4UgOFpWLpISv6kGjC4QnHZr-6Yfu6N1j5veXOuvMPJqnk64ipDsfOXO729KDkW2Vvbs6eTHFNkXoRJ0ICEfgNGeo-KVBWk9NEmsHENW5-wMmGizLao-EXF8XgajgCAA; fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=eb2a1164-c77c-4551-81cc-8d53b3d829c0; brcap=0; ai_session=en2aAOqTXuUx0FUtfuZNKe\|1745421853128\|1745421853128; MSFPC=GUID=97709dc2b318443dadf47712765fc5bd&HASH=9770&LV=202504&V=4&LU=1745421858034

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: insightonline.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: unknown

HTTP traffic detected: POST /api/report?catId=GW+estsfd+wst HTTP/1.1Host: identity.nel.measure.office.netConnection: keep-aliveContent-Length: 1126Content-Type: application/reports+jsonOrigin: https://login.microsoftonline.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: c995771a-4de3-4e2a-bb6e-483f059b6500x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originContent-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-N0lGRXT9AYIabG-Jp-sPHA' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-AllX-XSS-Protection: 0Date: Wed, 23 Apr 2025 15:24:06 GMTConnection: closeContent-Length: 0

Source: chromecache_79.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_79.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_69.2.dr, chromecache_78.2.dr	String found in binary or memory: http://www.webdam.com
Source: chromecache_79.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.195:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.176:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.222.3.228:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.176:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.176:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.134:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.164:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.132:443 -> 192.168.2.4:49767 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@22/38@20/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2348,i,485283711926833969,11984244100879002866,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2408 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2348,i,485283711926833969,11984244100879002866,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2408 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://www.webdam.com	0%	Avira URL Cloud	safe
https://insightonline.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fsites%2fBranchActivity%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fsites%252FBranchActivity%253Fe%253D1%253A47dc38c788c14f5d8f61d085b29e2360&Source=cookie	0%	Avira URL Cloud	safe
https://insightonline.sharepoint.com/sites/BranchActivity/_layouts/15/Authenticate.aspx?Source=%2Fsites%2FBranchActivity%3Fe%3D1%3A47dc38c788c14f5d8f61d085b29e2360	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
e329293.dscd.akamaiedge.net	23.62.226.176	true	false	high
www.google.com	142.250.69.4	true	false	high
www.tm.a.prd.aadg.akadns.net	20.190.190.195	true	false	high
a1894.dscb.akamai.net	23.222.3.228	true	false	high
s-part-0043.t-0009.t-msedge.net	13.107.246.71	true	false	high
autologon.microsoftazuread-sso.com	20.190.151.134	true	false	high
insightonline.sharepoint.com	unknown	unknown	false	unknown
aadcdn.msauthimages.net	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	false		high
https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US	false		high
https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7	false		high
https://aadcdn.msauthimages.net/dbd5a2dd-pf40mgalcnvgg-vse6vjsz2gcrgsefqyr125xohgjb4/logintenantbranding/0/illustration?ts=637457280173812764	false		high
https://login.microsoftonline.com/favicon.ico	false		high
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est	false		high
https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360	false		unknown
https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true	false		high
https://login.microsoftonline.com/common/instrumentation/dssostatus	false		high
https://aadcdn.msauthimages.net/dbd5a2dd-pf40mgalcnvgg-vse6vjsz2gcrgsefqyr125xohgjb4/logintenantbranding/0/bannerlogo?ts=637457280183629469	false		high
https://autologon.microsoftazuread-sso.com/6c637512-c417-4e78-9d62-b61258e4b619/winauth/ssoprobe?client-request-id=c95697a1-e060-7000-8cf5-ed8c9602ffa7&_=1745421851808	false		high
https://insightonline.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fsites%2fBranchActivity%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fsites%252FBranchActivity%253Fe%253D1%253A47dc38c788c14f5d8f61d085b29e2360&Source=cookie	false	Avira URL Cloud: safe	unknown
https://insightonline.sharepoint.com/sites/BranchActivity/_layouts/15/Authenticate.aspx?Source=%2Fsites%2FBranchActivity%3Fe%3D1%3A47dc38c788c14f5d8f61d085b29e2360	false	Avira URL Cloud: safe	unknown
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.webdam.com	chromecache_69.2.dr, chromecache_78.2.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_79.2.dr	false		high
http://knockoutjs.com/	chromecache_79.2.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_79.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.62.226.176	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
23.62.226.164	unknown	United States	20940	AKAMAI-ASN1EU	false
23.222.3.228	a1894.dscb.akamai.net	United States	8612	TISCALI-IT	false
20.190.190.195	www.tm.a.prd.aadg.akadns.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.151.134	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.151.132	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1672210
Start date and time:	2025-04-23 17:22:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@22/38@20/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.178.49.174, 142.250.69.3, 142.250.68.238, 74.125.137.84, 142.250.69.14, 20.190.151.8, 192.178.49.202, 142.250.69.10, 142.250.68.234, 192.178.49.170, 20.189.173.5, 20.189.173.17, 192.178.49.195, 184.29.183.29, 13.107.246.71, 20.12.23.50, 20.190.151.6
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, onedscolprdwus04.westus.cloudapp.azure.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, onedscolprdwus22.westus.cloudapp.azure.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, login.live.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2025 17:23:56.493594885 CEST	53	54514	1.1.1.1	192.168.2.4
Apr 23, 2025 17:23:56.504779100 CEST	53	60951	1.1.1.1	192.168.2.4
Apr 23, 2025 17:23:57.349390030 CEST	53	49323	1.1.1.1	192.168.2.4
Apr 23, 2025 17:23:57.611244917 CEST	53	58357	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:00.424704075 CEST	51851	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:00.425160885 CEST	61981	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:00.566323996 CEST	53	51851	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:00.568692923 CEST	53	61981	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:02.160729885 CEST	51302	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:02.160880089 CEST	56226	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:02.308475971 CEST	53	51302	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:02.311984062 CEST	53	56226	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:04.189979076 CEST	58056	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:04.190280914 CEST	51675	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:04.330349922 CEST	53	58056	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:04.330390930 CEST	53	51675	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:05.261262894 CEST	65001	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:05.261369944 CEST	54761	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:05.401510954 CEST	53	65001	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:05.401737928 CEST	53	54761	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:07.569154024 CEST	64278	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:07.569473028 CEST	54405	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:07.709707022 CEST	53	54405	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:07.710340023 CEST	53	64278	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:12.719388008 CEST	61888	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:12.719547987 CEST	51065	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:12.846060991 CEST	52301	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:12.846401930 CEST	64457	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:12.859846115 CEST	53	51065	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:12.875463009 CEST	53	61888	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:12.986323118 CEST	53	52301	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:12.986758947 CEST	53	64457	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:13.451350927 CEST	58447	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:13.451406956 CEST	60660	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:13.592142105 CEST	53	60660	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:13.592164993 CEST	53	58447	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:14.707001925 CEST	53	59708	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:14.780561924 CEST	53	62524	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:15.051743031 CEST	62896	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:15.051879883 CEST	60041	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:24:15.192699909 CEST	53	62896	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:15.192708969 CEST	53	60041	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:33.753729105 CEST	53	54486	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:56.087630033 CEST	53	49435	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:56.769841909 CEST	53	58909	1.1.1.1	192.168.2.4
Apr 23, 2025 17:24:59.142864943 CEST	53	50570	1.1.1.1	192.168.2.4
Apr 23, 2025 17:25:01.352221012 CEST	138	138	192.168.2.4	192.168.2.255
Apr 23, 2025 17:25:08.168627024 CEST	55825	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:25:08.168804884 CEST	57753	53	192.168.2.4	1.1.1.1
Apr 23, 2025 17:25:08.308737993 CEST	53	55825	1.1.1.1	192.168.2.4
Apr 23, 2025 17:25:08.309359074 CEST	53	57753	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:02 UTC	735	OUT	GET /sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360 HTTP/1.1 Host: insightonline.sharepoint.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:24:03 UTC	2162	IN	HTTP/1.1 302 Found Content-Length: 280 Content-Type: text/html; charset=utf-8 Location: https://insightonline.sharepoint.com/sites/BranchActivity/_layouts/15/Authenticate.aspx?Source=%2Fsites%2FBranchActivity%3Fe%3D1%3A47dc38c788c14f5d8f61d085b29e2360 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,4194720,32,21,934643,2102272,2102272,22523 X-SharePointHealthScore: 3 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: c95697a1-e022-7000-8cf5-e61aa8525991 request-id: c95697a1-e022-7000-8cf5-e61aa8525991 MS-CV: oZdWySLgAHCM9eYaqFJZkQ.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-PHX31r4b&frontEnd=AFD&RemoteIP=173.244.56.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 38 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.26002 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7F314A414EA048959064219EA6C58199 Ref B: PHX31EDGE0516 Ref C: 2025-04-23T15:24:02Z Date: Wed, 23 Apr 2025 15:24:02 GMT Connection: close
2025-04-23 15:24:03 UTC	280	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6e 73 69 67 68 74 6f 6e 6c 69 6e 65 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 73 69 74 65 73 2f 42 72 61 6e 63 68 41 63 74 69 76 69 74 79 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 41 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 3f 53 6f 75 72 63 65 3d 25 32 46 73 69 74 65 73 25 32 46 42 72 61 6e 63 68 41 63 74 69 76 69 74 79 25 33 46 65 25 33 44 31 25 33 41 34 37 64 63 33 38 63 37 38 38 63 31 34 66 35 64 38 66 36 31 64 30 38 35 62 32 39 65 32 33 36 30 22 3e 68 65 72 65 3c 2f 61 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://insightonline.sharepoint.com/sites/BranchActivity/_layouts/15/Authenticate.aspx?Source=%2Fsites%2FBranchActivity%3Fe%3D1%3A47dc38c788c14f5d8f61d085b29e2360">here</a

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:03 UTC	804	OUT	GET /sites/BranchActivity/_layouts/15/Authenticate.aspx?Source=%2Fsites%2FBranchActivity%3Fe%3D1%3A47dc38c788c14f5d8f61d085b29e2360 HTTP/1.1 Host: insightonline.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:24:03 UTC	1849	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 317 Content-Type: text/html; charset=utf-8 Location: /_forms/default.aspx?ReturnUrl=%2fsites%2fBranchActivity%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fsites%252FBranchActivity%253Fe%253D1%253A47dc38c788c14f5d8f61d085b29e2360&Source=cookie P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: RpsContextCookie=U291cmNlPSUyRnNpdGVzJTJGQnJhbmNoQWN0aXZpdHklM0ZlJTNEMSUzQTQ3ZGMzOGM3ODhjMTRmNWQ4ZjYxZDA4NWIyOWUyMzYw; expires=Wed, 23-Apr-2025 15:34:03 GMT; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 3,4194720,89417,1737,301414,5998661,5998661,18674 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: c95697a1-9031-7000-8cf5-e014f1117869 request-id: c95697a1-9031-7000-8cf5-e014f1117869 MS-CV: oZdWyTGQAHCM9eAU8RF4aQ.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-PHX31r4b&frontEnd=AFD&RemoteIP=173.244.56.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 20 SPIisLatency: 2 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.26002 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 2BA025A5C9CE49998A4FD16C48F67848 Ref B: PHX31EDGE0612 Ref C: 2025-04-23T15:24:03Z Date: Wed, 23 Apr 2025 15:24:03 GMT Connection: close
2025-04-23 15:24:03 UTC	317	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 5f 66 6f 72 6d 73 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 3f 52 65 74 75 72 6e 55 72 6c 3d 25 32 66 73 69 74 65 73 25 32 66 42 72 61 6e 63 68 41 63 74 69 76 69 74 79 25 32 66 5f 6c 61 79 6f 75 74 73 25 32 66 31 35 25 32 66 41 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 25 33 66 53 6f 75 72 63 65 25 33 64 25 32 35 32 46 73 69 74 65 73 25 32 35 32 46 42 72 61 6e 63 68 41 63 74 69 76 69 74 79 25 32 35 33 46 65 25 32 35 33 44 31 25 32 35 33 41 34 37 64 63 33 38 63 37 38 38 63 31 34 66 35 64 38 66 36 31 64 30 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/_forms/default.aspx?ReturnUrl=%2fsites%2fBranchActivity%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fsites%252FBranchActivity%253Fe%253D1%253A47dc38c788c14f5d8f61d0

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:03 UTC	1000	OUT	GET /_forms/default.aspx?ReturnUrl=%2fsites%2fBranchActivity%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fsites%252FBranchActivity%253Fe%253D1%253A47dc38c788c14f5d8f61d085b29e2360&Source=cookie HTTP/1.1 Host: insightonline.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: RpsContextCookie=U291cmNlPSUyRnNpdGVzJTJGQnJhbmNoQWN0aXZpdHklM0ZlJTNEMSUzQTQ3ZGMzOGM3ODhjMTRmNWQ4ZjYxZDA4NWIyOWUyMzYw
2025-04-23 15:24:04 UTC	3751	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 884 Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://login.microsoftonline.com:443/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: nSGt-96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9=gYEwMDU5NjA1MTZGNTkyQUY5QjE2NEZFMkRGQTZDNTk4MkI3RjlGQzk3RkNCMTY1OTJFMDk2QUNERDE0NjFGRDMwQTA1MURFRjlFMjczQzkyMzAwMEYyMTI3ODVGRkZENTlDORIxMzM4OTg5NTY4NDAxNDEwNTUcaW5zaWdodG9ubGluZS5zaGFyZXBvaW50LmNvbTud+oiHVNSyFg8HzvFnvisTrzb3gaCW18AJZH7xQxaestBO9+fihnM5H/mp9xE/PdcN9c+PjXfhmPVY6GnMGkYLi4z7JpyX66sqVh5obDqXQuNHVNg9QYimlBYBO3pn8sir5t7vgrt27e+bnThP7K7LhMapFa0H+WV1NokYNsOfkubDNf9pwKavjk5WcEVB8MTra6QVz1uqn7V/EAtwuW1MbWuFDDDNf0JOfqtC9gngrhdiZPE4CK+bOgwHK4WlMNiqTH/T3lHb+jdvQuVPJ0ldqGTRoaaECe/UqGDtHUpJ8rsTKzdT38vFMRHEi/VPDmfTohcyJ8+z8nouYNDhEkiUAAAA; expires=Wed, 23-Apr-2025 15:28:04 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: nSGt-96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly Set-Cookie: RpsContextCookie=U291cmNlPSUyRnNpdGVzJTJGQnJhbmNoQWN0aXZpdHklM0ZlJTNEMSUzQTQ3ZGMzOGM3ODhjMTRmNWQ4ZjYxZDA4NWIyOWUyMzYwJlByZXZpb3VzUmVxdWVzdENvcnJlbGF0aW9uSWQ9Yzk1Njk3YTElMkRlMDYwJTJENzAwMCUyRDhjZjUlMkRlZDhjOTYwMmZmYTcmUmV0dXJuVXJsPSUyRnNpdGVzJTJGQnJhbmNoQWN0aXZpdHklMkYlNUZsYXlvdXRzJTJGMTUlMkZBdXRoZW50aWNhdGUlMkVhc3B4JTNGU291cmNlJTNEJTI1MkZzaXRlcyUyNTJGQnJhbmNoQWN0aXZpdHklMjUzRmUlMjUzRDElMjUzQTQ3ZGMzOGM3ODhjMTRmNWQ4ZjYxZDA4NWIyOWUyMzYw; expires=Wed, 23-Apr-2025 15:34:04 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: RpsContextCookie=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 1,4194720,26,2,1692946,1051136,1051136,22343 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: c95697a1-e060-7000-8cf5-ed8c9602ffa7 request-id: c95697a1-e060-7000-8cf5-ed8c9602ffa7 MS-CV: oZdWyWDgAHCM9e2MlgL/pw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=6c637512-c417-4e78-9d62-b61258e4b619&destinationEndpoint=Edge-Prod-PHX31r4b&frontEnd=AFD&RemoteIP=173.244.56.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 51 SPIisLatency: 2 Include-Referred-Token-Binding-ID: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.26002 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: C880871B743E4D9EA0BE28A4657010FF Ref B: PHX31EDGE0608 Ref C: 2025-04-23T15:24:03Z Date: Wed, 23 Apr 2025 15:24:03 GMT Connection: close
2025-04-23 15:24:04 UTC	884	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 3a 34 34 33 2f 36 63 36 33 37 35 31 32 2d 63 34 31 37 2d 34 65 37 38 2d 39 64 36 32 2d 62 36 31 32 35 38 65 34 62 36 31 39 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 25 35 46 69 64 3d 30 30 30 30 30 30 30 33 25 32 44 30 30 30 30 25 32 44 30 66 66 31 25 32 44 63 65 30 30 25 32 44 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 73 70 6f 6e 73 65 25 35 46 6d 6f 64 65 3d 66 6f 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com:443/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=for

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:04 UTC	1360	OUT	GET /6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7 HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:24:05 UTC	2209	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 55086b6f-4982-4b77-9f60-1d6dc15c4b00 x-ms-ests-server: 2.1.20540.5 - NCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-Aw5kNxdJwMptLGjQxOCFjA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AvmamRdZkMxEhOz5hNzPZ-I; expires=Fri, 23-May-2025 15:24:05 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQENJeSLQyYTzfcrSyI5OPNLFNbXJcaeM4fvrbnBViIkYXqc0Qr08R39eKy-tnq8CTxX2WBvdhZL6y_LNiGdPSkHypoXbioxN_kD7q-FJ48_09y2h4cOJyBmot_pbJSsiLRphItl_r8iLtv8WUJKiZCt4ifY7I7nUPaachod7rPO0YgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:24:04 GMT Connection: close Content-Length: 21189
2025-04-23 15:24:05 UTC	14175	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head> <title>Redirecting</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" conten
2025-04-23 15:24:05 UTC	7014	IN	Data Raw: 64 65 72 2e 4c 6f 61 64 28 29 20 66 61 69 6c 65 64 20 64 65 73 70 69 74 65 20 69 6e 69 74 69 61 6c 20 6c 6f 61 64 20 73 75 63 63 65 73 73 2e 20 5b 27 22 2b 6e 2b 22 27 5d 22 7d 73 26 26 28 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 65 72 72 6f 72 2e 61 73 70 78 3f 65 72 72 3d 35 30 34 22 29 7d 29 7d 2c 63 2e 4f 6e 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 65 2e 73 72 63 7c 7c 65 2e 68 72 65 66 7c 7c 22 22 2c 6f 3d 69 28 29 2c 73 3d 61 28 29 3b 69 66 28 21 65 29 7b 74 68 72 6f 77 22 54 68 65 20 74 61 72 67 65 74 20 65 6c 65 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 22 7d 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a Data Ascii: der.Load() failed despite initial load success. ['"+n+"']"}s&&(document.location.href="/error.aspx?err=504")})},c.OnError=function(e,t){var n=e.src\|\|e.href\|\|"",o=i(),s=a();if(!e){throw"The target element must be provided and cannot be null."}r("[$Loader]:

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:05 UTC	642	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive Origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:24:06 UTC	662	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript Content-MD5: R7Y1mgm77mqkG4LgbFphBQ== Last-Modified: Wed, 29 Jan 2025 22:54:06 GMT ETag: "0x8DD40B7D5C9F36B" x-ms-request-id: 10951c84-601e-00f7-6a6a-76e0be000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=24721945 Date: Wed, 23 Apr 2025 15:24:05 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.906d3e17.1745421845.cb8d8d35
2025-04-23 15:24:06 UTC	15722	IN	Data Raw: 30 30 30 30 42 30 32 33 0d 0a 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 Data Ascii: 0000B023/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyrigh
2025-04-23 15:24:06 UTC	15675	IN	Data Raw: 65 64 69 61 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 20 61 63 74 69 76 65 29 20 7b 20 20 2e 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 64 65 74 65 63 74 69 6f 6e 3a 3a 62 65 66 6f 72 65 20 7b 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 61 63 74 69 76 65 22 3b 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 20 7d 7d 40 6d 65 64 69 61 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 20 62 6c 61 63 6b 2d 6f 6e 2d 77 68 69 74 65 29 20 7b 20 20 2e 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 64 65 74 65 63 74 69 6f 6e 3a 3a 62 65 66 6f 72 65 20 7b 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 77 68 69 74 65 22 3b 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 20 7d 7d 40 6d 65 64 69 61 20 28 2d 6d 73 2d 68 69 67 68 2d 63 Data Ascii: edia (-ms-high-contrast: active) { .high-contrast-detection::before { content: "active"; display: none; }}@media (-ms-high-contrast: black-on-white) { .high-contrast-detection::before { content: "white"; display: none; }}@media (-ms-high-c
2025-04-23 15:24:06 UTC	13706	IN	Data Raw: 3a 22 48 52 22 2c 45 52 52 5f 4d 53 47 3a 22 45 72 72 6f 72 4d 65 73 73 61 67 65 22 2c 45 58 54 5f 45 52 52 4f 52 3a 22 45 78 74 45 72 72 22 2c 45 52 52 5f 55 52 4c 3a 22 45 72 72 55 72 6c 22 2c 44 41 54 4f 4b 45 4e 3a 22 44 41 54 6f 6b 65 6e 22 2c 44 41 5f 53 45 53 4b 45 59 3a 22 44 41 53 65 73 73 69 6f 6e 4b 65 79 22 2c 44 41 5f 53 54 41 52 54 3a 22 44 41 53 74 61 72 74 54 69 6d 65 22 2c 44 41 5f 45 58 50 49 52 45 3a 22 44 41 45 78 70 69 72 65 73 22 2c 53 54 53 5f 49 4c 46 54 3a 22 53 54 53 49 6e 6c 69 6e 65 46 6c 6f 77 54 6f 6b 65 6e 22 2c 53 49 47 4e 49 4e 4e 41 4d 45 3a 22 53 69 67 6e 69 6e 4e 61 6d 65 22 2c 46 49 52 53 54 5f 4e 41 4d 45 3a 22 4c 61 73 74 4e 61 6d 65 22 2c 4c 41 53 54 5f 4e 41 4d 45 3a 22 46 69 72 73 74 4e 61 6d 65 22 2c 54 49 4c 45 Data Ascii: :"HR",ERR_MSG:"ErrorMessage",EXT_ERROR:"ExtErr",ERR_URL:"ErrUrl",DATOKEN:"DAToken",DA_SESKEY:"DASessionKey",DA_START:"DAStartTime",DA_EXPIRE:"DAExpires",STS_ILFT:"STSInlineFlowToken",SIGNINNAME:"SigninName",FIRST_NAME:"LastName",LAST_NAME:"FirstName",TILE
2025-04-23 15:24:06 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 76 65 6e 74 41 72 67 73 3a 74 2c 65 76 65 6e 74 4f 70 74 69 6f 6e 73 3a 72 7d 29 2c 6e 7d 2c 73 2e 67 65 74 50 72 6f 70 65 72 74 79 4c 6f 67 4f 70 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 74 3d 74 7c 7c 7b 7d 29 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 74 72 61 63 69 6e 67 50 72 6f 70 65 72 74 79 43 68 61 6e 67 65 22 29 7c 7c 28 74 2e 74 72 61 63 69 6e 67 50 72 6f 70 65 72 74 79 43 68 61 6e 67 65 3d 21 30 29 2c 74 2e 65 76 65 6e 74 4c 65 76 65 6c 3d 74 2e 65 76 65 6e 74 4c 65 76 65 6c 7c 7c 72 2e 45 76 65 6e 74 4c 65 76 65 6c 2e 49 6e 66 6f 2c 7b 76 69 65 77 4d 6f 64 65 6c 3a 65 2c 74 72 61 63 69 6e 67 4f 70 74 69 6f 6e 73 3a 74 7d 7d 2c 73 2e 67 65 74 44 65 66 61 75 6c 74 54 Data Ascii: 00004000eventArgs:t,eventOptions:r}),n},s.getPropertyLogOption=function(e,t){return(t=t\|\|{}).hasOwnProperty("tracingPropertyChange")\|\|(t.tracingPropertyChange=!0),t.eventLevel=t.eventLevel\|\|r.EventLevel.Info,{viewModel:e,tracingOptions:t}},s.getDefaultT
2025-04-23 15:24:06 UTC	12	IN	Data Raw: 69 7a 65 44 6f 6d 4e 6f 64 65 0d 0a Data Ascii: izeDomNode
2025-04-23 15:24:06 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 41 6e 64 44 65 73 63 65 6e 64 61 6e 74 73 22 2c 53 2e 61 61 2e 63 64 29 2c 53 2e 6e 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 69 66 28 72 29 66 6f 72 28 76 61 72 20 65 2c 74 3d 72 2c 6f 3d 30 3b 69 3c 72 3b 29 69 66 28 65 3d 6e 5b 69 2b 2b 5d 29 7b 69 66 28 69 3e 74 29 7b 69 66 28 35 65 33 3c 3d 2b 2b 6f 29 7b 69 3d 72 2c 53 2e 61 2e 47 63 28 45 72 72 6f 72 28 22 27 54 6f 6f 20 6d 75 63 68 20 72 65 63 75 72 73 69 6f 6e 27 20 61 66 74 65 72 20 70 72 6f 63 65 73 73 69 6e 67 20 22 2b 6f 2b 22 20 74 61 73 6b 20 67 72 6f 75 70 73 2e 22 29 29 3b 62 72 65 61 6b 7d 74 3d 72 7d 74 72 79 7b 65 28 29 7d 63 61 74 63 68 28 61 29 7b 53 2e 61 2e 47 63 28 61 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 28 29 Data Ascii: 00004000AndDescendants",S.aa.cd),S.na=function(){function e(){if(r)for(var e,t=r,o=0;i<r;)if(e=n[i++]){if(i>t){if(5e3<=++o){i=r,S.a.Gc(Error("'Too much recursion' after processing "+o+" task groups."));break}t=r}try{e()}catch(a){S.a.Gc(a)}}}function t()
2025-04-23 15:24:06 UTC	12	IN	Data Raw: 2f 2c 69 3d 7b 22 69 6e 22 3a 0d 0a Data Ascii: /,i={"in":
2025-04-23 15:24:06 UTC	13296	IN	Data Raw: 30 30 30 30 33 33 45 34 0d 0a 31 2c 22 72 65 74 75 72 6e 22 3a 31 2c 22 74 79 70 65 6f 66 22 3a 31 7d 2c 61 3d 7b 7d 3b 72 65 74 75 72 6e 7b 52 61 3a 5b 5d 2c 77 61 3a 61 2c 61 63 3a 65 2c 76 62 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 72 29 7b 76 61 72 20 6f 3b 69 66 28 21 6c 29 7b 76 61 72 20 64 3d 53 2e 67 65 74 42 69 6e 64 69 6e 67 48 61 6e 64 6c 65 72 28 65 29 3b 69 66 28 64 26 26 64 2e 70 72 65 70 72 6f 63 65 73 73 26 26 21 28 72 3d 64 2e 70 72 65 70 72 6f 63 65 73 73 28 72 2c 65 2c 69 29 29 29 72 65 74 75 72 6e 3b 28 64 3d 61 5b 65 5d 29 26 26 28 6f 3d 72 2c 30 3c 3d 53 2e 61 2e 41 28 74 2c 6f 29 3f 6f 3d 21 31 3a 28 64 3d 6f 2e 6d 61 74 63 68 28 6e 29 2c 6f 3d 6e 75 6c 6c 21 3d 3d 64 26 26 28 64 5b 31 5d Data Ascii: 000033E41,"return":1,"typeof":1},a={};return{Ra:[],wa:a,ac:e,vb:function(r,o){function i(e,r){var o;if(!l){var d=S.getBindingHandler(e);if(d&&d.preprocess&&!(r=d.preprocess(r,e,i)))return;(d=a[e])&&(o=r,0<=S.a.A(t,o)?o=!1:(d=o.match(n),o=null!==d&&(d[1]
2025-04-23 15:24:06 UTC	16384	IN	Data Raw: 30 30 30 30 43 38 46 35 0d 0a 5b 63 5d 29 6e 28 74 5b 63 5d 29 3b 65 6c 73 65 20 69 66 28 22 69 6e 73 74 61 6e 63 65 22 69 6e 20 74 29 7b 76 61 72 20 6f 3d 74 2e 69 6e 73 74 61 6e 63 65 3b 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 29 29 7d 65 6c 73 65 22 76 69 65 77 4d 6f 64 65 6c 22 69 6e 20 74 3f 72 28 65 2c 74 2e 76 69 65 77 4d 6f 64 65 6c 2c 6e 29 3a 65 28 22 55 6e 6b 6e 6f 77 6e 20 76 69 65 77 4d 6f 64 65 6c 20 76 61 6c 75 65 3a 20 22 2b 74 29 7d 28 69 28 65 29 2c 74 2c 6e 29 7d 7d 3b 76 61 72 20 63 3d 22 63 72 65 61 74 65 56 69 65 77 4d 6f 64 65 6c 22 3b 53 2e 62 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2e 72 65 67 69 73 74 65 72 22 2c 53 2e 6a 2e 72 65 67 69 73 74 65 72 29 2c 53 2e 62 28 22 63 6f 6d 70 6f 6e 65 6e 74 73 2e 69 Data Ascii: 0000C8F5[c])n(t[c]);else if("instance"in t){var o=t.instance;n((function(){return o}))}else"viewModel"in t?r(e,t.viewModel,n):e("Unknown viewModel value: "+t)}(i(e),t,n)}};var c="createViewModel";S.b("components.register",S.j.register),S.b("components.i
2025-04-23 15:24:06 UTC	16384	IN	Data Raw: 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7d 29 7d 2c 53 2e 62 28 22 74 65 6d 70 6c 61 74 65 53 6f 75 72 63 65 73 22 2c 53 2e 43 29 2c 53 2e 62 28 22 74 65 6d 70 6c 61 74 65 53 6f 75 72 63 65 73 2e 64 6f 6d 45 6c 65 6d 65 6e 74 22 2c 53 2e 43 2e 46 29 2c 53 2e 62 28 22 74 65 6d 70 6c 61 74 65 53 6f 75 72 63 65 73 2e 61 6e 6f 6e 79 6d 6f 75 73 54 65 6d 70 6c 61 74 65 22 2c 53 2e 43 2e 69 61 29 7d 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 66 6f 72 28 74 3d 53 2e 68 2e 6e 65 78 74 53 69 62 6c 69 6e 67 28 74 29 3b 65 26 26 28 72 3d 65 29 21 3d 3d 74 3b 29 6e 28 72 2c 65 3d 53 2e 68 2e 6e 65 78 74 53 69 62 6c 69 6e 67 28 72 29 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 6e 29 7b 69 66 28 74 2e Data Ascii: arguments[0]})},S.b("templateSources",S.C),S.b("templateSources.domElement",S.C.F),S.b("templateSources.anonymousTemplate",S.C.ia)}(),function(){function e(e,t,n){var r;for(t=S.h.nextSibling(t);e&&(r=e)!==t;)n(r,e=S.h.nextSibling(r))}function t(t,n){if(t.

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:07 UTC	2643	OUT	GET /6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; fpc=AvmamRdZkMxEhOz5hNzPZ-I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQENJeSLQyYTzfcrSyI5OPNLFNbXJcaeM4fvrbnBViIkYXqc0Qr08R39eKy-tnq8CTxX2WBvdhZL6y_LNiGdPSkHypoXbioxN_kD7q-FJ48_09y2h4cOJyBmot_pbJSsiLRphItl_r8iLtv8WUJKiZCt4ifY7I7nUPaachod7rPO0YgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-04-23 15:24:07 UTC	2833	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control: on P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 6e2ed502-1c47-4490-98e4-142fd3d80100 x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-4rZvBuY3yRdd-6rjaO-8Jw' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: buid=1.AScAEnVjbBfEeE6dYrYSWOS2GQMAAAAAAPEPzgAAAAAAAAAnAAAnAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE8WmWoXCyNgPty1Hi5Lkl8ub1dd51MtxwG-xgvhfGD5vervAy1vfwa3rIrDOZP44K6ud_kBBTnNNRLS2V27mUM5d_pwgJJF2MIuCk2fp9iCwgAA; expires=Fri, 23-May-2025 15:24:07 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEO-ERn3NBTtQnk1ZTfo3s4kqxoLr0RENg6z-ZmLsURPzjEjJRJ6LqAbyGkZ4K9U-WSoSuHedX_C1zSOjjNfhZj8z2LJwTEMiYv5rlDqTe3BUpp7Y6JLWnTQG3S32e6baY9CplkqI4xdEzEWP6H0bq7jgKfnTnCRODW7AexaNydHYgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-MoOJ9ubg92Q=AQABCQEAAABVrSpeuWamRam2jAF1XRQEXmCRzPwucB3q9clkL22VIqC7w4UgOFpWLpISv6kGjC4QnHZr-6Yfu6N1j5veXOuvMPJqnk64ipDsfOXO729KDkW2Vvbs6eTHFNkXoRJ0ICEfgNGeo-KVBWk9NEmsHENW5-wMmGizLao-EXF8XgajgCAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; expires=Fri, 23-May-2025 15:24:07 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:24:07 GMT Connection: close Content-Length: 44818
2025-04-23 15:24:07 UTC	13551	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
2025-04-23 15:24:07 UTC	16384	IN	Data Raw: 74 50 48 47 51 39 46 6e 69 44 77 32 5c 75 30 30 32 36 65 73 74 73 66 65 64 3d 31 5c 75 30 30 32 36 75 61 69 64 3d 63 39 35 36 39 37 61 31 65 30 36 30 37 30 30 30 38 63 66 35 65 64 38 63 39 36 30 32 66 66 61 37 5c 75 30 30 32 36 63 6f 62 72 61 6e 64 69 64 3d 31 31 62 64 38 30 38 33 2d 38 37 65 30 2d 34 31 62 35 2d 62 62 37 38 2d 30 62 63 34 33 63 38 61 38 65 38 61 5c 75 30 30 32 36 66 63 69 3d 30 30 30 30 30 30 30 33 2d 30 30 30 30 2d 30 66 66 31 2d 63 65 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 5c 75 30 30 32 36 77 73 75 63 78 74 3d 31 22 2c 22 75 72 6c 44 65 76 69 63 65 46 69 6e 67 65 72 70 72 69 6e 74 69 6e 67 22 3a 22 22 2c 22 75 72 6c 50 49 41 45 6e 64 41 75 74 68 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e Data Ascii: tPHGQ9FniDw2\u0026estsfed=1\u0026uaid=c95697a1e06070008cf5ed8c9602ffa7\u0026cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a\u0026fci=00000003-0000-0ff1-ce00-000000000000\u0026wsucxt=1","urlDeviceFingerprinting":"","urlPIAEndAuth":"https://login.microsofton
2025-04-23 15:24:07 UTC	14883	IN	Data Raw: 4c 6f 67 29 7b 76 61 72 20 6e 3d 5b 5d 2c 6f 3d 30 3b 72 2e 61 70 70 65 6e 64 4c 6f 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 74 2e 6d 61 78 44 65 62 75 67 4c 6f 67 7c 7c 32 35 2c 69 3d 28 6e 65 77 20 44 61 74 65 29 2e 74 6f 55 54 43 53 74 72 69 6e 67 28 29 2b 22 3a 22 2b 65 3b 6e 2e 70 75 73 68 28 6f 2b 22 3a 22 2b 69 29 2c 6e 2e 6c 65 6e 67 74 68 3e 72 26 26 6e 2e 73 68 69 66 74 28 29 2c 6f 2b 2b 7d 2c 72 2e 67 65 74 4c 6f 67 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 7d 7d 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 72 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 69 29 7b 76 61 72 20 61 3d 65 5b 69 5d 3b 69 66 28 69 3c 6e 2d 31 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 28 6f 2e 72 5b Data Ascii: Log){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:07 UTC	1848	OUT	GET /favicon.ico HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; fpc=AvmamRdZkMxEhOz5hNzPZ-I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQENJeSLQyYTzfcrSyI5OPNLFNbXJcaeM4fvrbnBViIkYXqc0Qr08R39eKy-tnq8CTxX2WBvdhZL6y_LNiGdPSkHypoXbioxN_kD7q-FJ48_09y2h4cOJyBmot_pbJSsiLRphItl_r8iLtv8WUJKiZCt4ifY7I7nUPaachod7rPO0YgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-04-23 15:24:07 UTC	1336	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: c995771a-4de3-4e2a-bb6e-483f059b6500 x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-N0lGRXT9AYIabG-Jp-sPHA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Date: Wed, 23 Apr 2025 15:24:06 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:08 UTC	441	OUT	OPTIONS /api/report?catId=GW+estsfd+wst HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.microsoftonline.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:24:08 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Wed, 23 Apr 2025 15:24:08 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-04-23 15:24:08 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:08 UTC	417	OUT	POST /api/report?catId=GW+estsfd+wst HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 1126 Content-Type: application/reports+json Origin: https://login.microsoftonline.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:24:08 UTC	1126	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 38 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 36 63 36 33 37 35 31 32 2d 63 34 31 37 2d 34 65 37 38 2d 39 64 36 32 2d 62 36 31 32 35 38 65 34 62 36 31 39 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 25 35 46 69 64 3d 30 30 30 30 30 30 30 33 25 32 44 30 30 30 30 25 32 44 30 66 66 31 25 32 44 63 65 30 30 25 32 44 30 30 30 30 30 30 30 30 30 30 30 30 26 72 65 Data Ascii: [{"age":0,"body":{"elapsed_time":788,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&re
2025-04-23 15:24:13 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:27277200-e19a-465d-951d-bb90a149c996 Date: Wed, 23 Apr 2025 15:24:13 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2, software=WebDAM http://www.webdam.com], baseline, precision 8, 1152x648, components 3
Category:	dropped
Size (bytes):	218711
Entropy (8bit):	7.963856000495739
Encrypted:	false
SSDEEP:	6144:gcql7YocjiuoBomFSdWH6UJjhRpW/TiztGSEQu+YFC:gRYowWBokHJtK/2xtEIuC
MD5:	5B5C12E61B3CEB42D74773D27028D83C
SHA1:	45FF90BE5386C44C73CDA6AF588B8E50314100ED
SHA-256:	009DE6C599F997AAB2CB3830E0D203EAF3780DA1F49CF2A1816662F25F8D0E22
SHA-512:	B197073053FB548EA28281211E5081D16CC5E4619ABDB834797194256D436E3664513CD0E6DC1B2EA80CC5FDBF51567B283E82FEE545CEF6062B200B262F8D04
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H......Exif..MM..............................V...........^.(...........1.........f...................H.......H....WebDAM http://www.webdam.com.....,Photoshop 3.0.8BIM.........H.......H.........C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:..c..tjW.g9.uj1...f.A...D;~...c>..2...vS....P.<.{...?..N...U.O.h.2.[..N.sN.....=.M)..N...oj.=.....n.u..gw..<..Z........z....X.H......G4./...v...(e8.#).....8..?.)\t..(.-.=)T}....

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:13 UTC	742	OUT	GET /dbd5a2dd-pf40mgalcnvgg-vse6vjsz2gcrgsefqyr125xohgjb4/logintenantbranding/0/illustration?ts=637457280173812764 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:24:13 UTC	712	IN	HTTP/1.1 200 OK Content-Length: 218711 Content-Type: image/* Content-MD5: W1wS5hs860LXR3PScCjYPA== Last-Modified: Fri, 08 Jan 2021 18:40:17 GMT ETag: 0x8D8B404D88180C7 x-ms-request-id: 893b697d-701e-0016-0465-67b535000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=30946 Date: Wed, 23 Apr 2025 15:24:13 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.846d3e17.1745421853.a1af8ee
2025-04-23 15:24:13 UTC	15672	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 8c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 06 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 56 01 1b 00 05 00 00 00 01 00 00 00 5e 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1d 00 00 00 66 02 13 00 03 00 00 00 01 00 01 00 00 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 57 65 62 44 41 4d 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 65 62 64 61 6d 2e 63 6f 6d 00 00 ff ed 00 2c 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 03 ed 00 00 00 00 00 10 00 48 00 00 00 01 00 01 00 48 00 00 00 01 00 01 ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 Data Ascii: JFIFHHExifMM*V^(1fHHWebDAM http://www.webdam.com,Photoshop 3.08BIMHHC
2025-04-23 15:24:13 UTC	16384	IN	Data Raw: 13 b4 64 0e 4f cd 80 c0 03 02 f3 c0 96 3e 20 2a da a4 d7 9e 29 91 08 74 9b 55 31 dc 5a a3 0f ba f0 da 2a ad a8 75 ea b3 79 3b c6 46 5e 4e 71 9d f1 63 e3 57 86 fe 08 fc 3d d4 bc 5d e2 df 10 d8 78 6f c3 7a 79 1f 6b d6 35 09 59 95 a4 20 ed 8e 30 37 49 71 3b 05 c2 46 81 dd b1 f2 ab 6d 20 78 7f fc 14 23 fe 0a 8b e0 1f d8 57 4f b8 d3 35 22 be 29 f8 85 24 21 ed 7c 21 67 70 16 4b 6d eb b9 25 d4 a6 50 45 ac 64 10 de 5e 1a 69 15 86 d4 d8 de 72 7e 23 7e d7 7f b6 df c4 0f db 33 c7 8d e2 4f 1e 6b 52 ea 72 59 87 fe cf d3 6d 50 c3 a6 e8 b1 37 2d 1d ad b8 25 63 04 00 19 89 69 64 da a5 de 46 00 d0 07 d5 7f f0 50 8f f8 2d c7 89 bf 68 7b 5d 4f c1 ff 00 0c 46 a5 e0 5f 87 f7 5b a1 bc bd 79 04 7a ef 88 e3 23 04 4f 22 31 16 b0 32 f1 e4 44 c4 b2 e5 64 91 d0 88 97 e0 f1 2a ec db Data Ascii: dO> )tU1Zuy;F^NqcW=]xozyk5Y 07Iq;Fm x#WO5")$!\|!gpKm%PEd^ir~#~3OkRrYmP7-%cidFP-h{]OF_[yz#O"12Dd*
2025-04-23 15:24:13 UTC	1391	IN	Data Raw: 71 ff 00 09 5d 9a ce 17 4e d2 f5 88 42 db 6b 7a 4d c5 f3 66 31 69 a9 c0 52 ee d2 e3 32 30 bc 8e c2 e5 36 85 b8 6a 00 e2 ed 7c 41 f1 0b c3 9f 18 a6 b8 b7 85 ed be 25 78 5f c5 12 c5 2c cc 52 3f ed 1f 16 cf 65 37 9b 14 79 24 c5 6f e2 5b 2b 65 9c 09 22 60 75 5b 29 55 16 15 94 35 6c 2f c3 c7 d4 bf 68 1b 1f 11 7c 2d d0 b5 0f 1c e8 bf 14 34 e9 bc 71 e0 eb 13 04 92 5b 5d b9 82 58 3c 41 e1 db d8 62 06 2b 68 75 1b 79 2e 21 91 c2 01 15 e4 76 4b 98 a3 0e eb f7 27 80 3f e0 92 fa 7e b9 73 67 ad 7c 5e f1 55 cf 8b 35 cf f8 46 c7 85 f5 d8 f4 67 7b 1b 7f 14 db 5b dd 2c f6 37 97 93 90 27 4b b8 bc 8b 59 4c 90 34 4c 27 80 32 ca c9 95 6f a7 7c 19 e1 7d 03 e1 de 91 71 a6 78 3f c3 ba 76 97 63 7d 73 25 ed c4 5a 6d b2 da 5a 5c 4f 2b b3 bc f3 48 06 6e 1d 9d 98 b4 a3 cd 62 c4 ee 39 Data Ascii: q]NBkzMf1iR206j\|A%x_,R?e7y$o[+e"`u[)U5l/h\|-4q[]X<Ab+huy.!vK'?~sg\|^U5Fg{[,7'KYL4L'2o\|}qx?vc}s%ZmZ\O+Hnb9
2025-04-23 15:24:13 UTC	16384	IN	Data Raw: e7 cc b7 af d0 f8 bc 63 a1 41 6f 6d a2 e9 77 9a 76 93 a7 e9 50 a5 9c 1a 5e 97 6f 9b db 78 10 61 21 82 c6 d9 0b da 42 aa 30 15 63 57 50 58 2a c2 c8 ac da 51 fc 15 d1 f5 19 56 6d 6e de 4f 10 48 ac 24 8e 2d 5a ee 7d 52 de d0 83 c1 86 3b 97 91 63 6f f6 90 03 9c e3 6a 90 83 a0 b8 b9 b0 f0 a6 91 0c 6c 16 de dd 4f 95 6d 6f 14 64 ef 6c 67 64 71 a8 c9 21 41 62 14 70 aa cc 70 aa 48 00 c2 d2 b5 99 22 82 3b 5d 17 c3 7a a4 d0 92 7c 99 65 48 ec a0 dc c4 b1 dc ae df 69 52 58 92 4f d9 d8 96 62 4e 49 35 4e 2d 63 c5 7e 29 95 7f b3 24 f0 d6 9f 6d bb 12 ce 23 9f 54 8f 00 f3 e4 4a 5a db 7b 71 8c 98 8c 6a 49 e5 d9 1a 2a de 7d 26 e3 c5 11 b0 d4 a3 10 e9 ef c0 d3 c3 07 f3 41 ed 70 c3 87 c8 e0 c4 a4 c5 f3 38 63 38 28 cb b1 1c 6b 1a e3 f8 68 03 8f d2 be 10 08 5e 49 75 0f 11 78 af Data Ascii: cAomwvP^oxa!B0cWPXQVmnOH$-Z}R;cojlOmodlgdq!AbppH";]z\|eHiRXObNI5N-c~)$m#TJZ{qjI}&Ap8c8(kh^Iux
2025-04-23 15:24:13 UTC	16384	IN	Data Raw: f0 ce 9b a6 ea 10 4a 34 89 22 d3 e6 8e d6 e6 45 3b e5 b7 41 e7 b1 86 46 59 3c d1 b4 95 fd e2 80 44 db e3 50 0a fa d8 f0 16 a9 aa e8 1e 27 f0 ef 83 7e 27 68 7e 15 9e 45 fe d0 b4 8a ff 00 57 d4 2d 6e ad df 28 24 b5 bb d9 2e c9 92 5d 9b 51 b7 c7 23 12 a7 69 e6 ba 8b 8d 77 e0 8f 89 3c 2d 34 3f f0 b1 3e 32 d8 f8 73 57 f2 e7 6b 5d 6e 3d 36 6d 3a e8 29 00 2b 24 d6 ee 92 6c 60 19 19 8b 0c a9 4c a7 12 1c ad 3a 7f 18 fc 1d f1 35 bf 84 e3 d3 fc 2b 67 6b e2 8b b9 8d bb bd ed cc 16 06 e6 65 2d e4 af ee 1d a0 f3 76 ba c5 1c 60 23 3c 72 88 c0 28 58 d9 f0 d7 89 7c 59 f0 3f 5e 5f 0a ff 00 c2 3f a7 fd 8f c5 da 84 af 69 1c 1a d9 16 51 dd ca a6 4f 2a 07 31 40 6d cc ac 92 18 e3 38 1e 64 4f e4 84 da 45 00 6a 78 47 55 f0 b7 c3 8d 26 e2 df e1 2f ed 11 e1 6d 15 da 48 ee 2d f4 eb Data Ascii: J4"E;AFY<DP'~'h~EW-n($.]Q#iw<-4?>2sWk]n=6m:)+$l`L:5+gke-v`#<r(X\|Y?^_?iQO*1@m8dOEjxGU&/mH-
2025-04-23 15:24:13 UTC	7952	IN	Data Raw: fb 3b e8 96 68 a6 1a e4 9b 26 46 19 07 e5 03 d7 a7 04 12 41 c1 a8 7c 49 fb 38 e9 22 19 23 8f 50 f1 15 b2 ea 11 88 22 bc 7d 52 e2 63 a7 dd 9e 22 91 94 be d9 11 c9 44 da d8 f9 95 50 67 ce 1b 00 33 ed 27 bc d4 34 d8 2e 3f b1 35 4d cc 89 31 c4 b6 bb 57 20 16 1c cc 0f 1c f5 03 a7 20 11 c5 b9 2d af a4 75 ff 00 89 36 a5 ce 50 86 92 df d0 90 4e 25 3e e3 f1 3f 4a f3 6f 80 1a 66 97 ff 00 0b 1b 52 f0 1f 8f ac 59 f5 98 e6 61 60 d3 6a 77 0a 19 c6 0b 5b f0 ea 24 dc 0a c9 1c 84 66 44 70 4f 2e aa 3d b2 f7 f6 78 f0 2c d6 b2 c3 fd 8b a6 da cc c3 11 ce d3 c9 2b 42 c3 90 db 5e 4c 36 0f 55 3c 30 c8 3d 68 03 07 4d 8a f3 49 bd 9a 3f ec b9 16 39 7f 7a a2 4b 85 5c 1e 43 81 d4 76 42 71 dd c9 fe 2c d3 a5 d6 9e 1b 77 57 8f 45 8d a3 c8 06 6d 50 2e 48 19 07 3e 59 ed b4 ff 00 fa c8 af Data Ascii: ;h&FA\|I8"#P"}Rc"DPg3'4.?5M1W -u6PN%>?JofRYa`jw[$fDpO.=x,+B^L6U<0=hMI?9zK\CvBq,wWEmP.H>Y
2025-04-23 15:24:13 UTC	16384	IN	Data Raw: 2e af 84 7f 67 7d 7b e2 17 c4 7b cf 0d ea df 11 ef bc 2d 73 6f 6a 97 36 f6 7a 6e 8b 6c df da b1 1d fb e7 b7 b9 98 2b af 28 df 23 c4 5d 0c 72 a9 c3 43 34 71 00 7a a3 7c 4a d1 8d d2 f9 1e 64 ac bc 3a f9 88 55 57 9d c0 ed 27 df 1c 72 c0 56 5e bb f1 ff 00 45 d0 e1 91 ae 9b 4f b2 58 40 77 96 ee f3 cb 58 88 27 6b 12 ca 31 f9 e0 f4 e7 a5 73 1e 3a fd 92 fc 3d f0 82 6d 3a 5f 11 b7 8a 3c 71 e1 58 67 79 35 24 be d5 27 86 f1 62 90 84 59 d7 ec a6 0f 36 38 d9 a3 57 88 ee c3 32 30 c2 4e 16 d7 d1 3c 47 fb 34 f8 3b 44 f0 7c 5a 87 c3 dd 2f c3 fe 1f b9 84 47 7f 6b 7f 65 62 af 6f 21 51 e6 24 93 cb b1 bc db 76 18 df e6 6f 0b 95 97 07 64 b1 5c 00 70 e9 fb 5c 78 7f c4 6c d1 e9 32 d8 6a 83 71 1b ec 63 7b d5 5c 83 f2 ee 8d 8a ee 21 58 85 07 71 0a d8 07 07 1d 0f 89 3c 6d e3 5d 1b Data Ascii: .g}{{-soj6znl+(#]rC4qz\|Jd:UW'rV^EOX@wX'k1s:=m:_<qXgy5$'bY68W20N<G4;D\|Z/Gkebo!Q$vod\p\xl2jqc{\!Xq<m]
2025-04-23 15:24:13 UTC	16384	IN	Data Raw: a2 df 2a bd dd b8 81 ed e3 bc 80 b9 44 ba 85 1c 6e 42 0e 46 0e 76 31 31 92 43 23 3f d6 be 18 f1 24 9e 32 f0 fd 96 a9 a6 cb a5 36 9f a8 46 27 b7 b9 59 e4 b8 0c a7 d5 36 26 08 e8 46 fe 08 20 f2 28 03 c7 3f 68 9f d9 d9 7e 24 e8 d2 ea 1a 4e 9b 6d 6b e2 ed 16 04 4b cb 1b 18 44 71 ea f6 e3 70 8e 48 13 3f eb 40 0c 23 0c 72 d8 6b 77 62 56 29 63 9b f6 46 fd a2 db e2 2d bc 3e 15 f1 05 ca b7 88 2d 62 06 c2 f1 98 9f ed 98 00 eb ce 09 95 54 73 9c 16 0a 49 01 95 c5 7b 16 b3 e1 5b ad 65 23 94 6a 9f 65 be b5 de 6d 66 82 d9 52 34 2e 06 e5 75 62 ec d1 b6 d5 dc 9b 80 25 11 86 1d 11 97 e7 6f da 73 e0 34 d3 c1 73 e3 4f 0f c7 3d 96 a9 a7 4c d3 eb 56 b9 df 25 a4 e3 12 3d da b0 1c 8c 30 79 08 07 72 34 73 a8 1f bc 59 00 3e 95 d4 ee 6c 6c 11 ed 75 19 ac 63 8e e1 1a 27 82 ed 90 2c Data Ascii: *DnBFv11C#?$26F'Y6&F (?h~$NmkKDqpH?@#rkwbV)cF->-bTsI{[e#jemfR4.ub%os4sO=LV%=0yr4sY>lluc',
2025-04-23 15:24:13 UTC	7952	IN	Data Raw: 1c 51 c7 1c 51 46 a1 55 11 76 aa 80 00 00 0e c0 00 00 1d 00 18 ab 01 00 ff 00 1a 00 68 42 3b 1a 72 2e 69 ca 37 0f e9 52 28 e3 75 17 00 55 cf f3 14 e2 b9 fe 1f d2 9a d2 2a fd 6b 3f c4 1e 2a b5 d0 04 2b 37 9d 35 c5 d6 ef b3 5a c2 a1 ee 2e b6 ed dd b1 49 03 0b b9 43 3b b2 c6 9b d4 bb a0 3b aa 35 60 67 fc 4e f8 5b a1 fc 5d f0 7d d6 87 e2 0b 08 6f f4 db 81 bb 6b 8c 34 2e bc 89 11 81 05 1d 71 b8 32 e0 82 01 ed 5e 0f e1 9f 8d fe 28 f8 27 a8 da f8 6f c4 9a b4 77 de 0c d4 27 16 ba 17 c4 2b b8 fc c5 d8 40 d9 04 cb 8d b2 48 41 c4 77 8f fb 87 f9 5f 6c ff 00 32 3f b9 0f 0c 5e 78 cd c4 9a f7 92 6d 37 06 4d 2e 26 2f 6c b8 c6 d3 31 60 0d c3 03 96 01 95 63 53 b0 88 cc 91 2c ed b1 e2 7f 09 e9 fe 32 f0 fd ee 95 ab 59 c1 a8 e9 fa 94 6d 15 d5 bd c2 ef 59 c3 75 dd 9e a4 f3 cf Data Ascii: QQFUvhB;r.i7R(uUk?+75Z.IC;;5`gN[]}ok4.q2^('ow'+@HAw_l2?^xm7M.&/l1`cS,2YmYu
2025-04-23 15:24:13 UTC	12216	IN	Data Raw: c9 05 af d8 02 72 51 87 15 da da f8 52 c7 c0 7e 19 b7 bc d5 26 b1 d0 96 60 93 83 1d b8 f3 a6 32 b3 e1 63 92 6d f2 4a 49 59 70 22 50 c4 45 21 e4 23 b0 ad 6b f1 77 c2 f7 3a a3 26 9b a2 f8 b7 c5 5a f4 72 b2 43 0d be 9f e6 ef 38 07 73 5d dc 49 ba 35 39 20 18 22 9d 81 0d b9 17 14 01 4f 48 f0 06 b9 f1 0d 16 3d 6b 5d b8 d4 16 d2 28 e2 8e 2f 0e d9 7f 65 d9 c4 aa cc cb b5 d5 a3 40 e3 82 65 32 bc 84 9c 6f 2a a8 89 d5 f8 23 f6 68 d2 7c 13 a5 dc 5f 5b e8 da 3e 93 6e 98 9f 50 bf 9d 0c c6 34 63 92 f7 33 11 14 29 92 0f cf 36 e1 9e ad d6 b9 6d 77 e2 1f 89 bf b6 5f 4d d6 35 ef 0b fc 2b 81 6e 64 86 ea 0d b3 eb 9a ba b0 5f de 47 2b 24 12 62 50 a3 6a 88 ac e0 99 0f 23 e6 50 cb 9d 75 e0 cf 0b 5c c6 9a 95 b7 86 75 df 17 5e 44 a5 63 d7 3c 51 73 1e 8f a5 5b ca a8 71 2c 41 cc b7 Data Ascii: rQR~&`2cmJIYp"PE!#kw:&ZrC8s]I59 "OH=k](/e@e2o*#h\|_[>nP4c3)6mw_M5+nd_G+$bPj#Pu\u^Dc<Qs[q,A

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:13 UTC	768	OUT	GET /6c637512-c417-4e78-9d62-b61258e4b619/winauth/ssoprobe?client-request-id=c95697a1-e060-7000-8cf5-ed8c9602ffa7&_=1745421851808 HTTP/1.1 Host: autologon.microsoftazuread-sso.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:24:14 UTC	1733	IN	HTTP/1.1 401 Unauthorized Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: image/png; charset=utf-8 Expires: -1 Vary: Origin X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://login.microsoftonline.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 65b3bef0-626e-4356-bd4b-3d53b4bb0100 x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-gva5ujLodxJNcFBgAxiUAg' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 WWW-Authenticate: Negotiate Set-Cookie: fpc=AmiSop8XaftKh7gJuzr8S88; expires=Fri, 23-May-2025 15:24:13 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:24:13 GMT Connection: close Content-Length: 12
2025-04-23 15:24:14 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:14 UTC	2858	OUT	POST /common/instrumentation/dssostatus HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Content-Length: 67 sec-ch-ua-platform: "Windows" hpgid: 1104 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 1800 canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQEkZ4NRToYm6NRHya88nMZer9BZP5SKj9r7SUldfDMQn6icT7Nc2-WNDIByq6LNIulS8iOaiPsP1pPnBDzCBRxJamAnVWwXxKcGnl1t1DGz-4OZVl97Ml1oSpT_Ib1-03AYadqZDMxkGoCGxC8NUlptbKVims9BIBCILLlH_AYcT4vbUnxDVGOazSJy3pdFa9GtgwDWkpfOVhQ-1FbTx943CAA sec-ch-ua-mobile: ?0 client-request-id: c95697a1-e060-7000-8cf5-ed8c9602ffa7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json hpgrequestid: 6e2ed502-1c47-4490-98e4-142fd3d80100 Content-type: application/json; charset=UTF-8 Origin: https://login.microsoftonline.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AScAEnVjbBfEeE6dYrYSWOS2GQMAAAAAAPEPzgAAAAAAAAAnAAAnAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE8WmWoXCyNgPty1Hi5Lkl8ub1dd51MtxwG-xgvhfGD5vervAy1vfwa3rIrDOZP44K6ud_kBBTnNNRLS2V27mUM5d_pwgJJF2MIuCk2fp9iCwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEO-ERn3NBTtQnk1ZTfo3s4kqxoLr0RENg6z-ZmLsURPzjEjJRJ6LqAbyGkZ4K9U-WSoSuHedX_C1zSOjjNfhZj8z2LJwTEMiYv5rlDqTe3BUpp7Y6JLWnTQG3S32e6baY9CplkqI4xdEzEWP6H0bq7jgKfnTnCRODW7AexaNydHYgAA; esctx-MoOJ9ubg92Q=AQABCQEAAABVrSpeuWamRam2jAF1XRQEXmCRzPwucB3q9clkL22VIqC7w4UgOFpWLpISv6kGjC4QnHZr-6Yfu6N1j5veXOuvMPJqnk64ipDsfOXO729KDkW2Vvbs6eTHFNkXoRJ0ICEfgNGeo-KVBWk9NEmsHENW5-wMmGizLao-EXF8XgajgCAA; fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=eb2a [TRUNCATED]
2025-04-23 15:24:14 UTC	67	OUT	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 32 2c 22 73 73 6f 44 65 6c 61 79 22 3a 30 2c 22 6c 6f 67 22 3a 22 50 72 6f 62 65 20 69 6d 61 67 65 20 65 72 72 6f 72 20 65 76 65 6e 74 20 66 69 72 65 64 22 7d Data Ascii: {"resultCode":2,"ssoDelay":0,"log":"Probe image error event fired"}
2025-04-23 15:24:14 UTC	1777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://autologon.microsoftazuread-sso.com/ Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: c95697a1-e060-7000-8cf5-ed8c9602ffa7 x-ms-request-id: 52ac2193-8b61-4b4a-8aa6-23827df44700 x-ms-ests-server: 2.1.20540.5 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-cFUFJpMONRHOW_8tFtZeFQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; expires=Fri, 23-May-2025 15:24:14 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:24:14 GMT Connection: close Content-Length: 265
2025-04-23 15:24:14 UTC	265	IN	Data Raw: 7b 22 61 70 69 43 61 6e 61 72 79 22 3a 22 50 41 51 41 42 44 67 45 41 41 41 42 56 72 53 70 65 75 57 61 6d 52 61 6d 32 6a 41 46 31 58 52 51 45 5a 54 44 73 7a 7a 67 61 72 5a 48 35 69 6e 36 64 5f 75 44 6e 34 35 7a 6a 5a 31 44 6f 6a 67 73 46 66 79 6f 48 38 45 37 66 52 78 66 44 34 72 71 59 47 4b 47 44 6b 69 78 48 68 4d 59 56 55 6e 74 68 58 69 36 34 4a 4f 5a 6f 6e 53 59 50 75 39 62 43 52 39 30 4e 74 65 72 31 6c 5a 38 4b 53 34 35 35 61 42 39 71 5f 66 37 6e 6c 42 4c 4f 57 70 4a 4f 46 77 34 43 70 37 77 66 2d 66 5a 6b 58 51 46 6f 44 36 36 59 76 79 5a 62 5a 70 49 43 6e 53 48 79 46 4c 4f 44 4f 4f 6e 37 62 4e 30 2d 54 70 61 69 6a 76 39 52 39 43 37 70 62 53 34 49 44 70 4c 57 32 67 5f 78 77 63 53 69 4b 65 41 4d 6b 6c 63 43 48 78 54 35 57 75 54 72 4b 55 52 78 45 72 51 38 Data Ascii: {"apiCanary":"PAQABDgEAAABVrSpeuWamRam2jAF1XRQEZTDszzgarZH5in6d_uDn45zjZ1DojgsFfyoH8E7fRxfD4rqYGKGDkixHhMYVUnthXi64JOZonSYPu9bCR90Nter1lZ8KS455aB9q_f7nlBLOWpJOFw4Cp7wf-fZkXQFoD66YvyZbZpICnSHyFLODOOn7bN0-Tpaijv9R9C7pbS4IDpLW2g_xwcSiKeAMklcCHxT5WuTrKURxErQ8

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:15 UTC	1552	OUT	GET /common/instrumentation/dssostatus HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AScAEnVjbBfEeE6dYrYSWOS2GQMAAAAAAPEPzgAAAAAAAAAnAAAnAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE8WmWoXCyNgPty1Hi5Lkl8ub1dd51MtxwG-xgvhfGD5vervAy1vfwa3rIrDOZP44K6ud_kBBTnNNRLS2V27mUM5d_pwgJJF2MIuCk2fp9iCwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEO-ERn3NBTtQnk1ZTfo3s4kqxoLr0RENg6z-ZmLsURPzjEjJRJ6LqAbyGkZ4K9U-WSoSuHedX_C1zSOjjNfhZj8z2LJwTEMiYv5rlDqTe3BUpp7Y6JLWnTQG3S32e6baY9CplkqI4xdEzEWP6H0bq7jgKfnTnCRODW7AexaNydHYgAA; esctx-MoOJ9ubg92Q=AQABCQEAAABVrSpeuWamRam2jAF1XRQEXmCRzPwucB3q9clkL22VIqC7w4UgOFpWLpISv6kGjC4QnHZr-6Yfu6N1j5veXOuvMPJqnk64ipDsfOXO729KDkW2Vvbs6eTHFNkXoRJ0ICEfgNGeo-KVBWk9NEmsHENW5-wMmGizLao-EXF8XgajgCAA; fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=eb2a [TRUNCATED]
2025-04-23 15:24:16 UTC	1721	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://autologon.microsoftazuread-sso.com/ Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 5805971a-b8c5-4845-ade5-c06eb2a44e00 x-ms-ests-server: 2.1.20540.5 - NCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-aSfEpzRCykJy6TpOLQcYKw' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; expires=Fri, 23-May-2025 15:24:16 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:24:15 GMT Connection: close Content-Length: 164
2025-04-23 15:24:16 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 63 32 32 38 63 37 33 61 2d 62 32 39 32 2d 34 37 39 35 2d 62 33 62 63 2d 35 37 37 39 64 63 65 34 33 34 64 31 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 34 2d 32 33 20 31 35 3a 32 34 3a 31 36 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"c228c73a-b292-4795-b3bc-5779dce434d1","timestamp":"2025-04-23 15:24:16Z","message":"AADSTS900561"}}

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:31 UTC	3010	OUT	POST /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Content-Length: 1751 sec-ch-ua-platform: "Windows" hpgid: 1104 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 1800 canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQEkZ4NRToYm6NRHya88nMZer9BZP5SKj9r7SUldfDMQn6icT7Nc2-WNDIByq6LNIulS8iOaiPsP1pPnBDzCBRxJamAnVWwXxKcGnl1t1DGz-4OZVl97Ml1oSpT_Ib1-03AYadqZDMxkGoCGxC8NUlptbKVims9BIBCILLlH_AYcT4vbUnxDVGOazSJy3pdFa9GtgwDWkpfOVhQ-1FbTx943CAA sec-ch-ua-mobile: ?0 client-request-id: c95697a1-e060-7000-8cf5-ed8c9602ffa7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json hpgrequestid: 6e2ed502-1c47-4490-98e4-142fd3d80100 Content-type: application/json; charset=UTF-8 Origin: https://login.microsoftonline.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.microsoftonline.com/6c637512-c417-4e78-9d62-b61258e4b619/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=96ACDD1461FD30A051DEF9E273C923000F212785FFFD59C9%2D5B5FC25FD28981C7C3D032909FA1FD7FB0E6C4FEACC25CC481A4260897446B34&redirect%5Furi=https%3A%2F%2Finsightonline%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=c95697a1%2De060%2D7000%2D8cf5%2Ded8c9602ffa7&sso_reload=true Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AScAEnVjbBfEeE6dYrYSWOS2GQMAAAAAAPEPzgAAAAAAAAAnAAAnAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE8WmWoXCyNgPty1Hi5Lkl8ub1dd51MtxwG-xgvhfGD5vervAy1vfwa3rIrDOZP44K6ud_kBBTnNNRLS2V27mUM5d_pwgJJF2MIuCk2fp9iCwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEO-ERn3NBTtQnk1ZTfo3s4kqxoLr0RENg6z-ZmLsURPzjEjJRJ6LqAbyGkZ4K9U-WSoSuHedX_C1zSOjjNfhZj8z2LJwTEMiYv5rlDqTe3BUpp7Y6JLWnTQG3S32e6baY9CplkqI4xdEzEWP6H0bq7jgKfnTnCRODW7AexaNydHYgAA; esctx-MoOJ9ubg92Q=AQABCQEAAABVrSpeuWamRam2jAF1XRQEXmCRzPwucB3q9clkL22VIqC7w4UgOFpWLpISv6kGjC4QnHZr-6Yfu6N1j5veXOuvMPJqnk64ipDsfOXO729KDkW2Vvbs6eTHFNkXoRJ0ICEfgNGeo-KVBWk9NEmsHENW5-wMmGizLao-EXF8XgajgCAA; fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=eb2a [TRUNCATED]
2025-04-23 15:24:31 UTC	1751	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 22 38 63 67 7a 70 30 40 74 79 77 2e 69 6f 22 2c 22 69 73 4f 74 68 65 72 49 64 70 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 63 68 65 63 6b 50 68 6f 6e 65 73 22 3a 66 61 6c 73 65 2c 22 69 73 52 65 6d 6f 74 65 4e 47 43 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 69 73 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 53 68 6f 77 6e 22 3a 66 61 6c 73 65 2c 22 69 73 46 69 64 6f 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e 61 6c 52 65 71 75 65 73 74 22 3a 22 72 51 51 49 41 52 41 41 6e 56 45 39 61 4e 52 67 47 45 34 75 31 39 67 37 57 33 73 57 42 77 63 48 43 5a 32 4b 75 65 52 4c 76 6e 7a 35 63 74 41 68 6c 39 7a 58 71 7a 39 74 46 5a 56 61 6b 54 4e 5f 31 30 74 37 6c 39 77 6c 75 66 5a 73 4b 59 69 54 51 38 Data Ascii: {"username":"8cgzp0@tyw.io","isOtherIdpSupported":true,"checkPhones":false,"isRemoteNGCSupported":true,"isCookieBannerShown":false,"isFidoSupported":true,"originalRequest":"rQQIARAAnVE9aNRgGE4u19g7W3sWBwcHCZ2KueRLvnz5ctAhl9zXqz9tFZVakTN_10t7l9wlufZsKYiTQ8
2025-04-23 15:24:31 UTC	1620	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: c95697a1-e060-7000-8cf5-ed8c9602ffa7 x-ms-request-id: d36bba6b-d2ca-4a62-bb4a-1a31168b2d00 x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-ZP2aBk09NNLTlDvn3ObvJA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; expires=Fri, 23-May-2025 15:24:31 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:24:31 GMT Connection: close Content-Length: 1261
2025-04-23 15:24:31 UTC	1261	IN	Data Raw: 7b 22 55 73 65 72 6e 61 6d 65 22 3a 22 38 63 67 7a 70 30 40 74 79 77 2e 69 6f 22 2c 22 44 69 73 70 6c 61 79 22 3a 22 38 63 67 7a 70 30 40 74 79 77 2e 69 6f 22 2c 22 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 22 3a 31 2c 22 49 73 55 6e 6d 61 6e 61 67 65 64 22 3a 66 61 6c 73 65 2c 22 54 68 72 6f 74 74 6c 65 53 74 61 74 75 73 22 3a 31 2c 22 43 72 65 64 65 6e 74 69 61 6c 73 22 3a 7b 22 50 72 65 66 43 72 65 64 65 6e 74 69 61 6c 22 3a 31 2c 22 48 61 73 50 61 73 73 77 6f 72 64 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 65 4e 67 63 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 46 69 64 6f 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 51 72 43 6f 64 65 50 69 6e 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 53 61 73 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 43 65 72 74 41 75 74 68 Data Ascii: {"Username":"8cgzp0@tyw.io","Display":"8cgzp0@tyw.io","IfExistsResult":1,"IsUnmanaged":false,"ThrottleStatus":1,"Credentials":{"PrefCredential":1,"HasPassword":true,"RemoteNgcParams":null,"FidoParams":null,"QrCodePinParams":null,"SasParams":null,"CertAuth

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:32 UTC	1639	OUT	GET /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-4sMAHNADNq0=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs8WDq54yv58AYn9omDBUvW8BIW3koTQ0T4JL-WOh8VADcGY8-jBQ5sN_tbg5M3hr3gYw7SsXXTqu9jSeN73-wRHNssFBqVKzR5xDYlEg4dpJ_XkooPq6dhbRQy36tUWURiFJBSNyhZi-FnuD7DJhNiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AScAEnVjbBfEeE6dYrYSWOS2GQMAAAAAAPEPzgAAAAAAAAAnAAAnAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE8WmWoXCyNgPty1Hi5Lkl8ub1dd51MtxwG-xgvhfGD5vervAy1vfwa3rIrDOZP44K6ud_kBBTnNNRLS2V27mUM5d_pwgJJF2MIuCk2fp9iCwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEO-ERn3NBTtQnk1ZTfo3s4kqxoLr0RENg6z-ZmLsURPzjEjJRJ6LqAbyGkZ4K9U-WSoSuHedX_C1zSOjjNfhZj8z2LJwTEMiYv5rlDqTe3BUpp7Y6JLWnTQG3S32e6baY9CplkqI4xdEzEWP6H0bq7jgKfnTnCRODW7AexaNydHYgAA; esctx-MoOJ9ubg92Q=AQABCQEAAABVrSpeuWamRam2jAF1XRQEXmCRzPwucB3q9clkL22VIqC7w4UgOFpWLpISv6kGjC4QnHZr-6Yfu6N1j5veXOuvMPJqnk64ipDsfOXO729KDkW2Vvbs6eTHFNkXoRJ0ICEfgNGeo-KVBWk9NEmsHENW5-wMmGizLao-EXF8XgajgCAA; fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=eb2a [TRUNCATED]
2025-04-23 15:24:33 UTC	1562	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: b94a1dc1-fa54-4214-af2c-88a6ded94600 x-ms-ests-server: 2.1.20540.5 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-M4grHl4uBuShDkqDZBYxjg' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AvmamRdZkMxEhOz5hNzPZ-JNFcaAAQAAABb9mt8OAAAA; expires=Fri, 23-May-2025 15:24:33 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:24:32 GMT Connection: close Content-Length: 164
2025-04-23 15:24:33 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 36 37 62 61 37 30 64 62 2d 30 31 61 33 2d 34 34 35 65 2d 62 62 30 37 2d 35 37 35 37 34 66 64 35 38 37 39 36 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 34 2d 32 33 20 31 35 3a 32 34 3a 33 33 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"67ba70db-01a3-445e-bb07-57574fd58796","timestamp":"2025-04-23 15:24:33Z","message":"AADSTS900561"}}

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:25:07 UTC	450	OUT	OPTIONS /api/report?catId=GW+estsfd+est HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://autologon.microsoftazuread-sso.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:25:08 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Wed, 23 Apr 2025 15:25:08 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-04-23 15:25:08 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:25:08 UTC	425	OUT	POST /api/report?catId=GW+estsfd+est HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 568 Content-Type: application/reports+json Origin: https://autologon.microsoftazuread-sso.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:25:08 UTC	568	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 33 35 30 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 32 33 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 32 30 2e 31 39 30 2e 31 35 31 2e 31 33 34 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 Data Ascii: [{"age":53500,"body":{"elapsed_time":1233,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.microsoftonline.com/","sampling_fraction":1.0,"server_ip":"20.190.151.134","status_code":401,"type":"http.error"},"type":"networ
2025-04-23 15:25:09 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:41ca65cb-08a6-4a29-94ab-18b081ee8b8b Date: Wed, 23 Apr 2025 15:25:08 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	1
Start time:	11:23:50
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	11:23:54
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2348,i,485283711926833969,11984244100879002866,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2408 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360

Target ID:	6
Start time:	11:24:01
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://insightonline.sharepoint.com/sites/BranchActivity?e=1:47dc38c788c14f5d8f61d085b29e2360"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre