Edit tour

Windows Analysis Report
https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph

Overview

General Information

Sample URL:	https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph
Analysis ID:	1676413
Infos:

Detection

Score:	1
Range:	0 - 100
Confidence:	80%

Signatures

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,5341923443139917202,3182975309698974738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2164 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,5341923443139917202,3182975309698974738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4936 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true

HTTP Parser: Number of links: 1

HTTP Parser: Base64 decoded: 0d8a3606-84ac-4766-a157-2687fa8223eb51453efe-b903-4bd4-ac94-a24648b66afa

HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.254:443 -> 192.168.2.5:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.5:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.8:443 -> 192.168.2.5:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.177:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.136:443 -> 192.168.2.5:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.177:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.167:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.7:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49711 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.254
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xPfEWvKhnte2adR&MD=v1GnP2pR HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET /common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0 HTTP/1.1host: login.microsoftonline.comupgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: nonesec-fetch-mode: navigatesec-fetch-user: ?1sec-fetch-dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_bazYuVH6rF7OQmuNhACwPg2.js HTTP/1.1host: aadcdn.msftauth.netorigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: scriptreferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1host: login.microsoftonline.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: imagereferer: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0accept-encoding: identityaccept-language: en-US,en;q=0.9cookie: esctx-EtTuzs0zE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEytvG2Rba_iZLIeIsVZm
Source: global traffic	HTTP traffic detected: GET /common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true HTTP/1.1host: login.microsoftonline.comsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"upgrade-insecure-requests: 1user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-fetch-site: same-originsec-fetch-mode: navigatesec-fetch-dest: documentreferer: https://login.microsoftonline.com/common/oauth2/authorize?cli
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_cwzkvppibgumnhupu2wjoa2.js HTTP/1.1host: aadcdn.msftauth.netorigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: scriptreferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1host: aadcdn.msftauth.netorigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: text/css,/;q=0.1sec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: stylereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=0
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_JXiTFACSOROsZgtGRJo1aA2.js HTTP/1.1host: aadcdn.msftauth.netorigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: corssec-fetch-dest: scriptreferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_41f36656d3c0bb04c90c.js HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4f75990aeef30238698e.js HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: /sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: scriptsec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1host: aadcdn.msftauth.netuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1host: aadcdn.msftauth.netuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1host: aadcdn.msftauth.netuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1host: aadcdn.msftauth.netuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1host: aadcdn.msftauth.netsec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: imagesec-fetch-storage-access: activereferer: https://login.microsoftonline.com/accept-encoding: identityaccept-language: en-US,en;q=0.9priority: i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1host: aadcdn.msftauth.netuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1host: aadcdn.msftauth.netuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9priority: u=1, i
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1host: login.microsoftonline.comuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: /sec-fetch-site: nonesec-fetch-mode: corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: identityaccept-language: en-US,en;q=0.9cookie: esctx-EtTuzs0zE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEytvG2Rba_iZLIeIsVZmezIxFm8IPoA0Wg_aiLlfVbO5RGeAQzOA4Ua-hgTpOiy16G16l6gNY2AKeZjYgQz2caxKmmtIqk49wjVLr-bjgO9NZ2C0oVuQK5c7f2SX2tZreQAHBZ2hoS5Sjr2LQcMTVICAAcookie: x-ms-gateway-slice=estsfdcookie: stsservicecookie=estsfdcookie: AADSSO=NA\|NoExtensioncookie: SSOCOOKIEPULLED=1cookie: buid=1.ASYAMe_N-B6jSkuT5F9XHpElWmfKzIC9VKtEhiVLecTcd3UBAAAmAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEcz2UiitxKdAyFNEbPH6W-QCgMY2zMNhBw6lAeJOmLaHyyuhoCg1YR6Tb3StDfioVAetDA2reQP-mWO6tWhmsb-bt9AJHbvJgLCixH_ctjKogAAcookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEzIdGJSbCoizotwObgpXq0ZNrnCatazQIBgf5aLuTWNcAxWT_vrl_-d2frfOUbTc9IqxFIorq_QkBhkvg8qZZoru9SKgLtJNclysp0IQI4NkRDDBQPb8xU3rrgQ2-kKnFHglklU7c3XGCNCwKXigVlh5RlwfDt4leqzoBaQpqvJ0gAAcookie: esctx-NWt4QO40b1w=AQABCQEAAABVrSpeuWamRam2jAF1XRQEt6VxrTBwGgF7P8wS3JpjmzhoC7ft5lWzB4C9Gb8lbijBBta6beUP0dv4TKOg8kPNRWlqIRIjcapwaEo6N4PG2GYxmBcb1O8u_pyyf9Z8p-Cw7mv-cXxW704dauSEk6qG4X6T4MoZnOka3LL-5td4QyAAcookie: fpc=Ah6nsSx-7zxJpyRRDaBOCAxc5p_pAQAAALmVod8OAAAAcookie: MicrosoftApplicationsTeleme
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xPfEWvKhnte2adR&MD=v1GnP2pR HTTP/1.1host: slscr.update.microsoft.comaccept: /user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33accept-encoding: identity
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=1800&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&hpgrequestid=aec0f2f3-1cb9-4e50-b115-b54ff1b06100 HTTP/1.1host: login.microsoftonline.comcontent-length: 325sec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"content-type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0accept: */*origin: https://login.microsoftonline.comsec-fetch-site: same-originsec-fetch-mode: no-corssec-fetch-dest: emptyreferer: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3D5SyoePmpx5MccNcOB2FQaT-1PVuKnoPAc8nDyVCkxOXN-2G9CX44R_zcg-9-bba3cvgzaiwq-NS9TBHTEx6LqMlN4NtBA6JfmbVyMa3LdmciCdd4G5t-jAa25sm2TkgIopXFE0V11_5d3k1Dx-amXLhIOPjjxiwB7JL-qxT9aWulxgsy_nnF7K_sp63Nf_l9QL5xCcA8aOyZfmM_5AjxaT2UwSzQQZle1V10F-_CdaDdWgnFtDRfk34dw1Vmzspf&response_mode=form_post&nonce=638814509353163196.MGQ4YTM2MDYtODRhYy00NzY2LWExNTctMjY4N2ZhODIyM2ViNTE0NTNlZmUtYjkwMy00YmQ0LWFjOTQtYTI0NjQ4YjY2YWZh&client-request-id=70d57b63-711c-4d3e-9966-7f92bd85aa49&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%2

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Foundcache-control: privateset-cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlystrict-transport-security: max-age=31536000; includeSubDomainsx-content-type-options: nosniffp3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: e0b0270e-baca-4d79-b26b-cd4163570b00x-ms-ests-server: 2.1.20540.5 - EUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-origincontent-security-policy-report-only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce--rI_Es5yzohs3nCF9aQbcw' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-Allx-xss-protection: 0date: Mon, 28 Apr 2025 15:28:56 GMTcontent-length: 0

Source: chromecache_59.2.dr	String found in binary or memory: http://feross.org
Source: chromecache_71.2.dr, chromecache_70.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_71.2.dr, chromecache_70.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_59.2.dr, chromecache_71.2.dr, chromecache_70.2.dr, chromecache_66.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.254:443 -> 192.168.2.5:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.5:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.8:443 -> 192.168.2.5:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.177:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.136:443 -> 192.168.2.5:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.177:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.167:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.7:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49711 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@24/35@12/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,5341923443139917202,3182975309698974738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2164 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,5341923443139917202,3182975309698974738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4936 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,5341923443139917202,3182975309698974738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2164 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,5341923443139917202,3182975309698974738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4936 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
e329293.dscd.akamaiedge.net	23.62.226.177	true	false	high
www.google.com	142.250.69.4	true	false	high
a1894.dscb.akamai.net	23.55.241.136	true	false	high
s-part-0043.t-0009.t-msedge.net	13.107.246.71	true	false	high
www.tm.a.prd.aadg.trafficmanager.net	20.190.151.8	true	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://c.pki.goog/r/r4.crl	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://knockoutjs.com/	chromecache_71.2.dr, chromecache_70.2.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_71.2.dr, chromecache_70.2.dr	false	high
https://github.com/douglascrockford/JSON-js	chromecache_59.2.dr, chromecache_71.2.dr, chromecache_70.2.dr, chromecache_66.2.dr	false	high
http://feross.org	chromecache_59.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
23.62.226.167	unknown	United States	20940	AKAMAI-ASN1EU	false
23.62.226.177	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
23.55.241.136	a1894.dscb.akamai.net	United States	20940	AKAMAI-ASN1EU	false
20.190.151.8	www.tm.a.prd.aadg.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.151.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.8
192.168.2.17
192.168.2.7
192.168.2.16
192.168.2.9
192.168.2.18
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676413
Start date and time:	2025-04-28 17:26:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@24/35@12/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.220.73.6, 142.250.68.238, 192.178.49.174, 142.250.101.84, 142.250.68.227, 192.178.49.206, 13.107.6.192, 20.190.151.69, 20.190.151.131, 20.190.151.70, 142.250.69.10, 192.178.49.170, 142.250.68.234, 192.178.49.202, 13.89.178.26, 20.189.173.11
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 17:28:48.950306892 CEST	53	60512	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:48.961142063 CEST	53	65154	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:49.712313890 CEST	53	65338	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:52.982093096 CEST	65228	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:28:52.982269049 CEST	49392	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:28:53.122495890 CEST	53	65228	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:53.122946024 CEST	53	49392	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:55.415014982 CEST	56015	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:28:55.415215015 CEST	49434	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:28:55.555401087 CEST	53	49434	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:55.555425882 CEST	53	56015	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:56.578627110 CEST	60280	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:28:56.578828096 CEST	57507	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:28:56.719108105 CEST	53	57507	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:56.735263109 CEST	53	60280	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:57.909056902 CEST	53157	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:28:57.909410000 CEST	61836	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:28:58.049782038 CEST	53	61836	1.1.1.1	192.168.2.5
Apr 28, 2025 17:28:58.049803019 CEST	53	53157	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:00.042187929 CEST	65164	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:29:00.068312883 CEST	64701	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:29:00.183969975 CEST	53	65164	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:00.209145069 CEST	53	64701	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:00.424905062 CEST	53	63462	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:05.326894045 CEST	138	138	192.168.2.5	192.168.2.255
Apr 28, 2025 17:29:06.890707016 CEST	53	50897	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:13.049700022 CEST	54824	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:29:13.049973965 CEST	52783	53	192.168.2.5	1.1.1.1
Apr 28, 2025 17:29:13.189970016 CEST	53	54824	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:13.190291882 CEST	53	52783	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:25.827500105 CEST	53	52227	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:48.484427929 CEST	53	51313	1.1.1.1	192.168.2.5
Apr 28, 2025 17:29:48.902380943 CEST	53	63306	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
Apr 28, 2025 17:28:49.272488117 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 28, 2025 17:28:49.421092033 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 28 Apr 2025 15:00:42 GMT Expires: Mon, 28 Apr 2025 15:50:42 GMT Cache-Control: public, max-age=3000 Age: 1687 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Timestamp	Bytes transferred	Direction	Data
2025-04-28 15:28:48 UTC	309	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xPfEWvKhnte2adR&MD=v1GnP2pR HTTP/1.1 host: slscr.update.microsoft.com accept: / user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 accept-encoding: identity
2025-04-28 15:28:48 UTC	541	IN	HTTP/1.1 200 OK cache-control: no-cache pragma: no-cache content-type: application/octet-stream expires: -1 last-modified: Mon, 01 Jan 0001 00:00:00 GMT etag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" ms-correlationid: d696af8a-7787-4b7f-abf8-5d43059996e9 ms-requestid: 1423d4c9-f347-4594-9d1a-9b8633051f2d ms-cv: qMYJEM5jYEqNVAVT.0 x-microsoft-slsclientcache: 2880 content-disposition: attachment; filename=environment.cab x-content-type-options: nosniff date: Mon, 28 Apr 2025 15:28:47 GMT content-length: 24490
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: c7 c3 8f 06 b6 24 05 3c f9 2c cb e0 99 86 1a f8 03 ca b3 04 d8 16 f0 f9 32 7f 28 14 e1 08 d8 03 b6 5f ca 00 2c ca e8 4f 1f 06 4e 31 f0 2f 3c 0e 0b 50 12 26 c4 00 85 7e 42 c0 00 c8 0f fa 0d c7 c3 a0 90 23 e5 21 63 33 1e a7 e6 2a f9 c3 ee 4b 69 ce 94 9b 68 c7 7b df ba c7 eb c3 55 b3 50 05 c8 b4 a7 ea a2 5e 5e cd 3a a2 aa 75 43 4b 97 f4 bd 25 ec 55 81 8f 48 6a d4 2b fb 61 52 86 d0 3b 01 14 b0 69 f4 31 7a b6 35 59 f1 51 9b 07 06 22 e9 3b 54 1f 1c 09 53 6c 08 99 9d 74 59 32 ad 33 42 5a f5 2c 05 bf b7 e9 cf 8f 5d 2c 89 c9 8a 5f 6c 65 4c 0c 6d 6a 3f 83 6c b8 bf a3 10 39 92 ad fd bc d8 94 f7 ca 6b ef 90 4b eb 87 76 34 1d 50 f6 0b 7d 4a 62 19 4b 92 ae d4 3f 79 3c 37 e1 2d 6c bc f7 fc 95 94 bd 9c f5 56 86 da 39 b9 b3 67 4c 1a 17 d4 27 59 97 fa bb 03 e7 1b 32 9c 5f Data Ascii: $<,2(_,ON1/<P&~B#!c3*Kih{UP^^:uCK%UHj+aR;i1z5YQ";TSltY23BZ,],_leLmj?l9kKv4P}JbK?y<7-lV9gL'Y2_
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: 99 5f f0 57 d3 49 7b b2 e4 e5 c0 9e f2 e2 b5 17 92 26 2b c1 a3 c2 60 60 5d 36 2c de 60 61 ea e8 98 df 55 7a a8 91 e4 a9 84 e0 3b 6e 95 89 91 fc a7 0f 95 af 35 36 d1 a7 99 9e 88 5e 1c 90 6f 76 55 35 c9 a6 7b 9c 57 31 1c 7d 98 8c a5 d0 5c 66 01 23 08 79 a0 ac fd 28 e3 66 c4 5d bc 06 ed c2 ac 2e 85 85 1d 2c f9 63 f9 ae 62 0a e0 dc fd 65 e4 07 da 27 83 27 db 54 2f 30 4f ab 57 35 d0 e3 25 bc 3a 8a 0f 18 ab 06 65 1d c3 c6 d7 dc 20 e5 92 42 df 59 3a dd 99 b4 1e 33 04 f5 9c 31 69 0f ec 13 9b b8 7c 93 51 3a 5b 90 33 78 d9 c2 f9 a0 e5 54 1d b7 41 12 7c ea 48 f9 8b 32 9d cb 22 59 19 02 65 dd 61 fc 1e b6 2d 6d 85 1b 49 c9 9e 9d a6 e3 15 82 bd e8 4e 07 0a 96 41 09 6c 7a 91 fe 23 c6 ec 81 c3 34 b3 bc bd 6d 1b a2 f9 9d 9a 55 ad 27 0b b3 da 0d 82 7c 98 8d 2d 3b d6 c6 13 Data Ascii: _WI{&+``]6,`aUz;n56^ovU5{W1}\f#y(f].,cbe''T/0OW5%:e BY:31i\|Q:[3xTA\|H2"Yea-mINAlz#4mU'\|-;
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: 2d 5f d0 00 d0 07 f4 72 f6 e6 e8 44 69 fd 25 5f 10 dc 3f 70 f7 40 41 25 f8 69 80 38 20 27 0e a0 36 fd 40 ab 6d 7e e0 7e 60 1f a0 bb cd 0f 54 fd d7 fc c0 df e9 fb c7 c8 07 c3 96 47 48 09 90 7f f5 08 49 7f e5 05 82 72 c3 a4 de 98 91 55 c3 ea 10 ce a3 13 c3 f7 12 97 f6 c4 ce d7 c2 d9 28 f3 83 ce ec 99 14 4b d4 be 03 9e 48 26 e8 06 e4 1c e3 a4 41 09 dd e2 d3 84 db 86 e8 d2 f6 fb 0d f2 bb 63 cb fd 6b 48 cc 83 a9 85 16 0a 62 17 34 a2 dc b2 5c 8e 5a 11 11 25 46 bc 99 aa 15 3b c9 46 0f 5f 5e b9 9a fd a8 03 36 50 d9 0b 10 d7 86 2a ed 8c d3 6e 1f ed e9 f0 96 84 f7 3b dc 1d 9e 09 6e c5 df da 17 74 23 13 af d2 ac 85 dd 4d 74 ea 15 fd 52 cf 64 7f b7 fa f3 19 03 d1 3c 1d f9 9e 49 c6 ae 97 08 66 b1 ba 94 91 c7 2a c7 ee c7 ef 55 45 e4 5e a7 ed 2e 5d 46 59 44 0d 4b 8d 93 Data Ascii: -_rDi%_?p@A%i8 '6@m~~`TGHIrU(KH&AckHb4\Z%F;F_^6Pn;nt#MtRd<IfUE^.]FYDK
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: f4 d2 5b 0d c4 46 f4 08 0d 64 b7 dd 0e 23 c4 4a be c6 2c 08 e4 15 96 43 0e 90 12 6e 83 93 e4 22 73 bf 9c 43 a3 72 7e 18 32 1c 87 83 10 55 1d 3d 13 70 78 a0 df ea 3e bc 8f 9c f3 c9 cd b2 63 9f 56 68 27 2f ce f2 f7 d1 be 1e 37 ef db 07 4d 38 19 d3 72 07 4b 21 bd e4 5a 22 2f df 9c d9 42 cd 28 ce 46 7d 02 5e c0 3a 7d 59 8f ba 2b d9 8a 6a ee ee 00 2f 1d b9 28 fd 40 78 e3 bc e0 27 36 dd fd 43 d9 6a 3e 0d 73 ca 91 ee 0f 3d a6 1a b5 25 8c d1 15 8a d7 f8 93 2e 54 ac df 56 e1 7f ed 19 54 17 27 34 90 14 e3 70 8c 6c 7f ff 7e 4f 51 14 1e 4e 05 72 47 b2 4d 89 4e f9 67 77 f4 77 a9 eb f6 50 12 1e aa 0b b0 6d 8f 25 51 7d 17 52 f8 55 b8 68 f5 90 ab 07 5f 36 1f f1 e4 1e e5 fb f3 73 97 9a e6 1d ab bb ee b9 59 5a f2 3c e8 6d 9f be 51 7b 02 c0 7d d8 d6 01 4c 12 85 7b 05 e0 5e Data Ascii: [Fd#J,Cn"sCr~2U=px>cVh'/7M8rK!Z"/B(F}^:}Y+j/(@x'6Cj>s=%.TVT'4pl~OQNrGMNgwwPm%Q}RUh_6sYZ<mQ{}L{^
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: 17 7a 50 e3 3d 37 50 78 c6 9b 00 9e b1 6c 93 1f 64 fc 47 28 e5 6f 7b 2c 3f 66 9c 1b c0 91 91 7f f1 eb 59 11 28 38 61 06 ff bf 92 d0 14 5f 4d 0f e8 d9 e9 00 5a 30 6e 48 2f 23 03 13 4d 57 f0 f8 e5 8d 51 9b 88 0d f9 1d 57 58 98 cf e8 0b 8c f6 eb 9c da ff e4 4a 13 15 29 0c 69 75 94 79 e3 95 50 e5 48 e0 90 99 54 fe c5 90 26 13 97 27 85 89 ed 99 b4 32 69 b3 23 07 e3 9e fb e7 e2 e9 27 ff d9 3c 6e 78 48 c3 3d 4c b0 78 83 47 97 43 99 4b fa 65 6a 2b a5 20 16 23 d3 dd e2 46 1d 6b 79 16 e2 7b e7 3e e7 71 eb 7f c8 e3 4a 49 a0 64 7e e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 7f e6 71 ff ab f3 b8 5d a3 0e 92 5e 1d d9 33 07 9d b4 5a 5b 1f 36 94 07 fb 31 44 46 72 24 1d af 77 ba 94 e6 6b df 96 Data Ascii: zP=7PxldG(o{,?fY(8a_MZ0nH/#MWQWXJ)iuyPHT&'2i#'<nxH=LxGCKej+ #Fky{>qJId~qqqqqqqqqqqqqqq]^3Z[61DFr$wk
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: 72 61 74 69 6f 6e 73 20 50 75 65 72 74 6f 20 52 69 63 6f 31 16 30 14 06 03 55 04 05 13 0d 32 33 30 38 32 39 2b 34 35 34 32 33 37 30 1f 06 03 55 1d 23 04 18 30 16 80 14 ad 94 76 8f 83 ad 0e 03 a3 e8 3b b0 d7 34 68 d4 79 3a 7d dc 30 60 06 03 55 1d 1f 04 59 30 57 30 55 a0 53 a0 51 86 4f 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 6f 70 73 2f 63 72 6c 2f 4d 69 63 72 6f 73 6f 66 74 25 32 30 55 70 64 61 74 65 25 32 30 53 69 67 6e 69 6e 67 25 32 30 43 41 25 32 30 32 2e 31 2e 63 72 6c 30 6d 06 08 2b 06 01 05 05 07 01 01 04 61 30 5f 30 5d 06 08 2b 06 01 05 05 07 30 02 86 51 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 6f 70 73 2f 63 65 72 74 73 2f 4d 69 63 72 6f 73 6f 66 74 25 32 30 55 Data Ascii: rations Puerto Rico10U230829+4542370U#0v;4hy:}0`UY0W0USQOhttp://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl0m+a0_0]+0Qhttp://www.microsoft.com/pkiops/certs/Microsoft%20U
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: 6c d5 21 c9 b8 50 68 05 c3 e4 09 c9 bd 51 c9 5f 6d 75 4f 8d 35 30 c5 8c c1 83 b2 1f 93 b5 72 6f d2 44 90 1d ed 7f 13 a9 7d 53 24 9c aa 46 c0 8f c5 c5 be bf c8 55 14 fe 87 35 fe cd d5 7e 02 d2 87 68 00 c9 b8 d7 44 cb 71 db a4 8b b3 e0 0e a6 0b ce 12 7d f6 68 dc c0 91 31 f8 59 2c 2c f5 d5 d1 2e 08 9d 2b 30 6a 6e aa ad 9e 16 4e 27 d0 ba 3b 1a 81 30 43 38 92 87 e1 6c 6f 43 3d 2d 4e 1f 0d 10 c1 f8 fa bc 84 c8 93 c3 9e 47 fc b6 fa d1 2f b6 af 39 3e 9c 3f 1c f1 4d a4 16 d3 0a e2 e7 4e f5 37 88 03 46 8e 1e cc 77 c1 47 d3 44 b7 e4 35 23 db eb 20 cb 2a f5 57 ae 2e 00 3b 6b e6 a3 6e 05 99 70 bb 76 3b d8 3c b4 76 f6 28 15 3a 25 d4 26 a4 08 9f d9 7e 7b 44 8a b7 15 8a c6 c5 78 2a 9d 32 c4 83 7b b9 6e 42 14 99 5d 49 7f 45 99 57 a7 33 77 44 1a ff 47 a3 71 b7 b0 b1 56 8a Data Ascii: l!PhQ_muO50roD}S$FU5~hDq}h1Y,,.+0jnN';0C8loC=-NG/9>?MN7FwGD5# W.;knpv;<v(:%&~{Dx2{nB]IEW3wDGqV
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: 42 06 0a 2b 06 01 04 01 82 37 02 01 0c 31 34 30 32 a0 14 80 12 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 a1 1a 80 18 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 04 82 01 00 3d cd 0e 0a 7b 43 82 69 14 76 9b c2 1b 25 6c 3f 01 d0 b8 bb 6f e9 4d 62 55 f3 7a 5b c4 05 04 2e 09 48 41 fd e9 13 24 1e f0 71 f0 79 9e 8e a7 ea d7 72 49 9f 71 e8 41 4c 0a 8e 69 71 3c 8f e9 56 c5 9d a0 e6 3c df 48 88 1c cf 7f eb a0 34 f3 ff 37 ca 6d 9f c7 86 eb 12 35 0a 45 a5 81 a8 f8 53 6d c6 11 4e ef 37 77 2a 73 bf 08 f9 ee ba 8d b8 48 1a 93 32 44 3a cd 7c 41 2d e3 20 7e 34 a2 7c 2b 93 92 2f 0a 5f 17 c8 65 98 79 74 bb e7 1c 1a e2 6c a4 15 db cf ae 5b 18 f9 9a 82 ab 98 f5 13 93 f3 0f 89 71 a4 2f c0 7e Data Ascii: B+71402Microsofthttp://www.microsoft.com0H={Civ%l?oMbUz[.HA$qyrIqALiq<V<H47m5ESmN7wsH2D:\|A- ~4\|+/_eytl[q/~
2025-04-28 15:28:48 UTC	1460	IN	Data Raw: a3 82 01 1b 30 82 01 17 30 1d 06 03 55 1d 0e 04 16 04 14 ec 97 76 68 29 fe 13 4f cd 74 c6 25 18 f2 00 7c da 7d d7 a7 30 1f 06 03 55 1d 23 04 18 30 16 80 14 d5 63 3a 5c 8a 31 90 f3 43 7b 7c 46 1b c5 33 68 5a 85 6d 55 30 56 06 03 55 1d 1f 04 4f 30 4d 30 4b a0 49 a0 47 86 45 68 74 74 70 3a 2f 2f 63 72 6c 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 72 6c 2f 70 72 6f 64 75 63 74 73 2f 4d 69 63 54 69 6d 53 74 61 50 43 41 5f 32 30 31 30 2d 30 37 2d 30 31 2e 63 72 6c 30 5a 06 08 2b 06 01 05 05 07 01 01 04 4e 30 4c 30 4a 06 08 2b 06 01 05 05 07 30 02 86 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 6b 69 2f 63 65 72 74 73 2f 4d 69 63 54 69 6d 53 74 61 50 43 41 5f 32 30 31 30 2d 30 37 2d 30 31 2e 63 72 74 30 0c 06 Data Ascii: 00Uvh)Ot%\|}0U#0c:\1C{\|F3hZmU0VUO0M0KIGEhttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z+N0L0J+0>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Timestamp	Bytes transferred	Direction	Data
2025-04-28 15:28:57 UTC	618	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_bazYuVH6rF7OQmuNhACwPg2.js HTTP/1.1 host: aadcdn.msftauth.net origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: cross-site sec-fetch-mode: cors sec-fetch-dest: script referer: https://login.microsoftonline.com/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1
2025-04-28 15:28:57 UTC	630	IN	HTTP/1.1 200 OK content-type: application/x-javascript content-md5: OE7vSVlIO0DM/xjIsmm3lA== last-modified: Wed, 26 Mar 2025 20:12:16 GMT etag: "0x8DD6CA28167B527" x-ms-request-id: cf1df4f3-501e-0013-78a6-9fa56b000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * vary: Accept-Encoding cache-control: public, max-age=28823548 date: Mon, 28 Apr 2025 15:28:57 GMT akamai-grn: 0.906d3e17.1745854137.9e89b502 content-length: 142656
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 72 72 6f 72 28 22 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 62 69 6e 64 20 2d 20 77 68 61 74 20 69 73 20 74 72 79 69 6e 67 20 74 6f 20 62 65 20 62 6f 75 6e 64 20 69 73 20 6e 6f 74 20 63 61 6c 6c 61 62 6c 65 22 29 3b 76 61 72 20 74 3d 6e 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 31 29 2c 72 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 74 68 69 73 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 6c 65 6e 67 74 68 3d 72 2c 74 2e 70 75 73 68 2e 61 70 70 6c 79 28 74 2c 61 72 67 75 6d 65 6e 74 73 29 2c 6f 2e 61 70 70 6c 79 28 69 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 68 69 73 29 3f 74 68 69 73 3a 65 2c 74 29 7d 3b 72 65 74 75 72 6e 20 74 68 69 73 Data Ascii: rror("Function.prototype.bind - what is trying to be bound is not callable");var t=n.call(arguments,1),r=t.length,o=this,i=function(){},a=function(){return t.length=r,t.push.apply(t,arguments),o.apply(i.prototype.isPrototypeOf(this)?this:e,t)};return this
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 6f 28 61 29 7d 29 2c 30 29 7d 29 29 3a 65 2e 72 65 73 6f 6c 76 65 28 5b 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 65 28 74 29 7d 7d 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 65 2c 21 30 29 7d 2c 65 2e 61 6c 6c 53 65 74 74 6c 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 28 65 2c 21 31 29 7d 2c 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 69 66 28 74 26 26 74 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 69 3d 30 2c 61 3d 74 2e 6c 65 6e 67 74 68 3b 69 3c 61 3b 2b 2b 69 29 7b 76 61 72 20 73 3d 74 5b 69 5d 3b 73 20 69 6e 73 74 61 6e Data Ascii: o(a)}),0)})):e.resolve([])}function r(e,t){return function(){e(t)}}e.all=function(e){return n(e,!0)},e.allSettled=function(e){return n(e,!1)},e.race=function(t){return new e((function(n,o){if(t&&t.length)for(var i=0,a=t.length;i<a;++i){var s=t[i];s instan
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 69 6e 67 20 63 68 75 6e 6b 20 22 2b 65 2b 22 20 66 61 69 6c 65 64 20 61 66 74 65 72 20 22 2b 28 75 2b 31 29 2b 22 20 74 72 69 65 73 2e 5c 6e 28 22 2b 6c 2b 22 3a 20 22 2b 70 2b 22 29 22 2c 63 2e 6e 61 6d 65 3d 22 43 68 75 6e 6b 4c 6f 61 64 45 72 72 6f 72 22 2c 63 2e 74 79 70 65 3d 6c 2c 63 2e 72 65 71 75 65 73 74 3d 70 2c 61 5b 31 5d 28 63 29 2c 6f 5b 65 5d 3d 75 6e 64 65 66 69 6e 65 64 2c 53 52 53 52 65 74 72 79 26 26 28 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 6e 6f 74 69 66 79 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 7b 74 79 70 65 3a 22 69 6e 76 6f 6b 65 22 2c 76 61 6c 75 65 3a 7b 6e 61 6d 65 3a 22 43 6c 6f 75 64 45 78 70 65 72 69 65 6e 63 65 48 6f 73 74 2e 54 65 6c 65 6d 65 74 72 79 2e 6c 6f 67 45 76 65 6e 74 22 2c 61 72 67 73 3a 5b 22 Data Ascii: ing chunk "+e+" failed after "+(u+1)+" tries.\n("+l+": "+p+")",c.name="ChunkLoadError",c.type=l,c.request=p,a[1](c),o[e]=undefined,SRSRetry&&(window.external.notify(JSON.stringify({type:"invoke",value:{name:"CloudExperienceHost.Telemetry.logEvent",args:["
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 20 65 29 69 2e 64 28 6e 2c 72 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 5b 74 5d 7d 2e 62 69 6e 64 28 6e 75 6c 6c 2c 72 29 29 3b 72 65 74 75 72 6e 20 6e 7d 2c 69 2e 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 5b 22 64 65 66 61 75 6c 74 22 5d 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 3b 72 65 74 75 72 6e 20 69 2e 64 28 74 2c 22 61 22 2c 74 29 2c 74 7d 2c 69 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 74 29 7d 2c 69 2e 70 3d 22 22 2c 69 2e 6f 65 3d 66 Data Ascii: e)i.d(n,r,function(t){return e[t]}.bind(null,r));return n},i.n=function(e){var t=e&&e.__esModule?function(){return e["default"]}:function(){return e};return i.d(t,"a",t),t},i.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},i.p="",i.oe=f
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 69 66 28 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6f 29 26 26 28 6f 3d 3d 3d 74 7c 7c 6e 26 26 6f 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 72 29 29 72 65 74 75 72 6e 20 6f 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 2c 65 78 74 65 6e 64 3a 6f 2e 75 74 69 6c 73 2e 65 78 74 65 6e 64 7d 2c 63 3d 74 2e 53 74 72 69 6e 67 3d 7b 74 72 69 6d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 73 2b 7c 5c 73 2b 24 2f 67 2c 22 22 29 7d 2c 66 69 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 65 3f 6e 3f 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 72 29 3a 65 2e 69 6e 64 65 78 4f 66 28 74 2c 72 Data Ascii: if(e.hasOwnProperty(o)&&(o===t\|\|n&&o.toLowerCase()===r))return o;return null},extend:o.utils.extend},c=t.String={trim:function(e){return e.replace(/^\s+\|\s+$/g,"")},find:function(e,t,n,r){return e?n?e.toLowerCase().indexOf(t.toLowerCase(),r):e.indexOf(t,r
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 29 7b 76 61 72 20 6e 3d 63 2e 65 78 74 72 61 63 74 4f 72 69 67 69 6e 46 72 6f 6d 55 72 6c 28 65 29 3b 72 65 74 75 72 6e 20 63 2e 65 78 74 72 61 63 74 4f 72 69 67 69 6e 46 72 6f 6d 55 72 6c 28 74 29 3d 3d 3d 6e 7d 2c 63 61 70 46 69 72 73 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 63 68 61 72 41 74 28 30 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 2b 65 2e 73 6c 69 63 65 28 31 29 7d 2c 63 6c 65 61 6e 73 65 55 73 65 72 6e 61 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 22 22 3b 69 66 28 65 3d 63 2e 74 72 69 6d 28 65 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 21 63 2e 69 73 45 6d 61 69 6c 41 64 64 72 65 73 73 28 65 29 26 26 21 63 2e 69 73 53 6b 79 70 65 4e 61 6d 65 28 65 29 26 26 63 2e Data Ascii: ){var n=c.extractOriginFromUrl(e);return c.extractOriginFromUrl(t)===n},capFirst:function(e){return e.charAt(0).toUpperCase()+e.slice(1)},cleanseUsername:function(e,t){if(!e)return"";if(e=c.trim(e).toLowerCase(),!c.isEmailAddress(e)&&!c.isSkypeName(e)&&c.
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 29 28 65 29 7d 76 61 72 20 6f 3d 6e 28 31 36 29 2c 69 3d 6e 28 30 29 2c 61 3d 6e 28 32 29 2c 73 3d 6e 28 38 29 2c 75 3d 69 2e 4f 62 6a 65 63 74 2c 63 3d 69 2e 53 74 72 69 6e 67 2c 6c 3d 69 2e 41 72 72 61 79 2c 64 3d 77 69 6e 64 6f 77 2c Data Ascii: &&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}var o=n(16),i=n(0),a=n(2),s=n(8),u=i.Object,c=i.String,l=i.Array,d=window,
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 69 73 45 64 67 65 43 6c 69 65 6e 74 42 72 6f 77 73 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 53 26 26 28 53 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 69 6e 64 65 78 4f 66 28 22 65 64 67 65 63 6c 69 65 6e 74 2f 22 29 3e 2d 31 29 2c 53 7d 2c 69 73 4f 6e 54 6f 75 63 68 53 74 61 72 74 45 76 65 6e 74 53 75 70 70 6f 72 74 65 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 6f 6e 74 6f 75 63 68 73 74 61 72 74 22 69 6e 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 7d 2c 67 65 74 49 45 56 65 72 73 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 64 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 Data Ascii: isEdgeClientBrowser:function(){return null===S&&(S=navigator.userAgent.toLowerCase().indexOf("edgeclient/")>-1),S},isOnTouchStartEventSupported:function(){return"ontouchstart"in document.documentElement},getIEVersion:function(){var e=d.navigator.userAgent
2025-04-28 15:28:57 UTC	1460	IN	Data Raw: 69 6d 61 74 69 6f 6e 65 6e 64 22 2c 4f 41 6e 69 6d 61 74 69 6f 6e 3a 22 6f 41 6e 69 6d 61 74 69 6f 6e 45 6e 64 22 2c 4d 6f 7a 41 6e 69 6d 61 74 69 6f 6e 3a 22 61 6e 69 6d 61 74 69 6f 6e 65 6e 64 22 2c 57 65 62 6b 69 74 41 6e 69 6d 61 74 69 6f 6e 3a 22 77 65 62 6b 69 74 41 6e 69 6d 61 74 69 6f 6e 45 6e 64 22 7d 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 74 29 69 66 28 65 2e 73 74 79 6c 65 5b 6e 5d 21 3d 3d 75 6e 64 65 66 69 6e 65 64 29 72 65 74 75 72 6e 20 74 5b 6e 5d 3b 72 65 74 75 72 6e 22 22 7d 2c 69 73 53 74 61 63 6b 53 69 7a 65 47 72 65 61 74 65 72 54 68 61 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 65 7c 7c 30 2c 5f 2e 67 65 74 53 74 61 63 6b 53 69 7a 65 28 65 29 3e 65 7d 2c 69 73 53 76 67 49 6d 67 53 75 70 70 6f 72 74 65 64 Data Ascii: imationend",OAnimation:"oAnimationEnd",MozAnimation:"animationend",WebkitAnimation:"webkitAnimationEnd"};for(var n in t)if(e.style[n]!==undefined)return t[n];return""},isStackSizeGreaterThan:function(e){return e=e\|\|0,_.getStackSize(e)>e},isSvgImgSupported
2025-04-28 15:28:58 UTC	639	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_cwzkvppibgumnhupu2wjoa2.js HTTP/1.1 host: aadcdn.msftauth.net origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: cross-site sec-fetch-mode: cors sec-fetch-dest: script referer: https://login.microsoftonline.com/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1
2025-04-28 15:28:58 UTC	629	IN	HTTP/1.1 200 OK content-type: application/x-javascript content-md5: sdfrFSBzF5uO29GmJ+OC9Q== last-modified: Mon, 24 Mar 2025 21:53:36 GMT etag: "0x8DD6B1E549AB5A2" x-ms-request-id: d20c75ff-601e-0003-4040-9d2b48000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * vary: Accept-Encoding cache-control: public, max-age=28559850 date: Mon, 28 Apr 2025 15:28:58 GMT akamai-grn: 0.906d3e17.1745854138.9e89d60e content-length: 58614
2025-04-28 15:28:58 UTC	643	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1 host: aadcdn.msftauth.net origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: text/css,/;q=0.1 sec-fetch-site: cross-site sec-fetch-mode: cors sec-fetch-dest: style referer: https://login.microsoftonline.com/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=0
2025-04-28 15:28:58 UTC	614	IN	HTTP/1.1 200 OK content-type: text/css content-md5: O6TXahet0KbDTuaW8oyFQQ== last-modified: Wed, 04 Dec 2024 23:52:00 GMT etag: "0x8DD14BEA5012AB1" x-ms-request-id: b2a2d114-d01e-004e-72a7-637a46000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * vary: Accept-Encoding cache-control: public, max-age=22226623 date: Mon, 28 Apr 2025 15:28:58 GMT akamai-grn: 0.906d3e17.1745854138.9e89d60b content-length: 113424
2025-04-28 15:28:58 UTC	620	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_JXiTFACSOROsZgtGRJo1aA2.js HTTP/1.1 host: aadcdn.msftauth.net origin: https://login.microsoftonline.com sec-ch-ua-platform: "Windows" user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 accept: / sec-fetch-site: cross-site sec-fetch-mode: cors sec-fetch-dest: script referer: https://login.microsoftonline.com/ accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1
2025-04-28 15:28:58 UTC	630	IN	HTTP/1.1 200 OK content-type: application/x-javascript content-md5: 8uYkWGfFrw+q7jcrXeI/0A== last-modified: Mon, 24 Mar 2025 19:21:54 GMT etag: "0x8DD6B09234EB219" x-ms-request-id: 7f8b14c3-601e-0061-4daa-9ee96f000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * vary: Accept-Encoding cache-control: public, max-age=28715276 date: Mon, 28 Apr 2025 15:28:58 GMT akamai-grn: 0.906d3e17.1745854138.9e89d60d content-length: 458162

Timestamp	Bytes transferred	Direction	Data
2025-04-28 15:28:58 UTC	420	OUT	OPTIONS /api/report?catId=GW+estsfd+est HTTP/1.1 host: identity.nel.measure.office.net origin: https://login.microsoftonline.com access-control-request-method: POST access-control-request-headers: content-type user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-04-28 15:28:58 UTC	300	IN	HTTP/1.1 200 OK content-type: text/html content-length: 7 date: Mon, 28 Apr 2025 15:28:58 GMT access-control-allow-headers: content-type access-control-allow-credentials: false access-control-allow-methods: * access-control-allow-methods: GET, OPTIONS, POST access-control-allow-origin: *
2025-04-28 15:28:58 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS
2025-04-28 15:28:59 UTC	396	OUT	POST /api/report?catId=GW+estsfd+est HTTP/1.1 host: identity.nel.measure.office.net content-length: 1246 content-type: application/reports+json origin: https://login.microsoftonline.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-04-28 15:28:59 UTC	1246	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 35 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 38 30 63 63 63 61 36 37 2d 35 34 62 64 2d 34 34 61 62 2d 38 36 32 35 2d 34 62 37 39 63 34 64 63 37 37 37 35 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 25 32 30 69 64 5f 74 6f 6b 65 6e 26 73 63 6f 70 65 3d 6f 70 65 6e 69 64 25 32 30 70 72 6f Data Ascii: [{"age":0,"body":{"elapsed_time":254,"method":"GET","phase":"application","protocol":"h2","referrer":"https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20pro
2025-04-28 15:28:59 UTC	380	IN	HTTP/1.1 429 Too Many Requests content-length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 request-context: appId=cid-v1:27277200-e19a-465d-951d-bb90a149c996 date: Mon, 28 Apr 2025 15:28:59 GMT access-control-allow-credentials: false access-control-allow-methods: * access-control-allow-methods: GET, OPTIONS, POST access-control-allow-origin: *
2025-04-28 15:29:58 UTC	420	OUT	OPTIONS /api/report?catId=GW+estsfd+est HTTP/1.1 host: identity.nel.measure.office.net origin: https://login.microsoftonline.com access-control-request-method: POST access-control-request-headers: content-type user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-04-28 15:29:58 UTC	300	IN	HTTP/1.1 200 OK content-type: text/html content-length: 7 date: Mon, 28 Apr 2025 15:29:57 GMT access-control-allow-headers: content-type access-control-allow-credentials: false access-control-allow-methods: * access-control-allow-methods: GET, OPTIONS, POST access-control-allow-origin: *
2025-04-28 15:29:58 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS
2025-04-28 15:29:58 UTC	396	OUT	POST /api/report?catId=GW+estsfd+est HTTP/1.1 host: identity.nel.measure.office.net content-length: 1250 content-type: application/reports+json origin: https://login.microsoftonline.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=4, i
2025-04-28 15:29:58 UTC	1250	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 36 30 30 30 39 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 35 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 38 30 63 63 63 61 36 37 2d 35 34 62 64 2d 34 34 61 62 2d 38 36 32 35 2d 34 62 37 39 63 34 64 63 37 37 37 35 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 25 32 30 69 64 5f 74 6f 6b 65 6e 26 73 63 6f 70 65 3d 6f 70 65 6e 69 64 25 32 Data Ascii: [{"age":60009,"body":{"elapsed_time":254,"method":"GET","phase":"application","protocol":"h2","referrer":"https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%2
2025-04-28 15:29:58 UTC	380	IN	HTTP/1.1 429 Too Many Requests content-length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 request-context: appId=cid-v1:c5439fe0-35f1-4a99-812a-3bd3cd696c31 date: Mon, 28 Apr 2025 15:29:58 GMT access-control-allow-credentials: false access-control-allow-methods: * access-control-allow-methods: GET, OPTIONS, POST access-control-allow-origin: *

Timestamp	Bytes transferred	Direction	Data
2025-04-28 15:29:00 UTC	425	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 host: aadcdn.msftauth.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 15:29:00 UTC	599	IN	HTTP/1.1 200 OK content-type: image/x-icon content-md5: EuPayFgGHQiAI7K9SOL6lg== last-modified: Thu, 05 Dec 2024 00:02:51 GMT etag: "0x8DD14C0292CD581" x-ms-request-id: fceaabcd-201e-0026-469c-66c97f000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * vary: Accept-Encoding cache-control: public, max-age=22551850 date: Mon, 28 Apr 2025 15:29:00 GMT content-length: 17174 akamai-grn: 0.846d3e17.1745854140.99ed73d
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 Data Ascii: 33333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 Data Ascii: """" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 Data Ascii: UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUU
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 Data Ascii: UUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDU
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 Data Ascii: DDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDD
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 Data Ascii:
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 28 00 00 00 48 00 00 00 90 00 00 00 01 00 04 00 00 00 00 00 80 0d 00 00 00 00 00 00 00 Data Ascii: (H
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 Data Ascii: """33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333UUUUUUUUUUUUUUUUU
2025-04-28 15:29:00 UTC	1460	IN	Data Raw: 44 44 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 Data Ascii: DD<<<<<<<<<<<<<<<<<<<<<
2025-04-28 15:29:00 UTC	438	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 host: aadcdn.msftauth.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 15:29:00 UTC	616	IN	HTTP/1.1 200 OK content-type: image/svg+xml content-md5: DhdidjYrlCeaRJJRG/y9mA== last-modified: Thu, 05 Dec 2024 00:02:42 GMT etag: "0x8DD14C0239E1898" x-ms-request-id: 0be7cb05-001e-003a-80a7-63d054000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * vary: Accept-Encoding cache-control: public, max-age=22226684 date: Mon, 28 Apr 2025 15:29:00 GMT content-length: 1864 akamai-grn: 0.846d3e17.1745854140.99ed86e
2025-04-28 15:29:00 UTC	439	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 host: aadcdn.msftauth.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 15:29:00 UTC	616	IN	HTTP/1.1 200 OK content-type: image/svg+xml content-md5: nzaLxFgP7ZB3dfMcaybWzw== last-modified: Thu, 05 Dec 2024 00:02:53 GMT etag: "0x8DD14C02A8563EB" x-ms-request-id: f9be26cc-801e-0098-80a7-6374af000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * vary: Accept-Encoding cache-control: public, max-age=22226656 date: Mon, 28 Apr 2025 15:29:00 GMT content-length: 3651 akamai-grn: 0.846d3e17.1745854140.99ed86f
2025-04-28 15:29:02 UTC	439	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 host: aadcdn.msftauth.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 15:29:02 UTC	616	IN	HTTP/1.1 200 OK content-type: image/svg+xml content-md5: R2FAVxfpONfnQAuxVxXbHg== last-modified: Thu, 05 Dec 2024 00:03:00 GMT etag: "0x8DD14C02EE2769A" x-ms-request-id: 4824a4ab-601e-004e-239f-66e4a4000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * vary: Accept-Encoding cache-control: public, max-age=22553275 date: Mon, 28 Apr 2025 15:29:02 GMT content-length: 1592 akamai-grn: 0.846d3e17.1745854142.99efbfe
2025-04-28 15:29:13 UTC	444	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 host: aadcdn.msftauth.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 15:29:13 UTC	594	IN	HTTP/1.1 200 OK content-length: 2672 content-type: image/gif content-md5: Fm3lNHEmUlOrOkVt7+baIw== last-modified: Thu, 05 Dec 2024 00:02:52 GMT accept-ranges: bytes etag: "0x8DD14C029EBF349" x-ms-request-id: 79b1b473-d01e-003c-1aba-667d09000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * cache-control: public, max-age=22564999 date: Mon, 28 Apr 2025 15:29:13 GMT akamai-grn: 0.846d3e17.1745854153.9a0346c
2025-04-28 15:29:13 UTC	438	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 host: aadcdn.msftauth.net user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 priority: u=1, i
2025-04-28 15:29:13 UTC	594	IN	HTTP/1.1 200 OK content-length: 3620 content-type: image/gif content-md5: tUCo5RgDcZLjLE/li/Lbqw== last-modified: Thu, 05 Dec 2024 00:02:53 GMT accept-ranges: bytes etag: "0x8DD14C02A787A1B" x-ms-request-id: 731abef4-b01e-00c0-3b65-677959000000 x-ms-version: 2018-03-28 access-control-expose-headers: Accept-Ranges,Cache-Control,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version access-control-allow-origin: * cache-control: public, max-age=22638095 date: Mon, 28 Apr 2025 15:29:13 GMT akamai-grn: 0.846d3e17.1745854153.9a0349e

Timestamp	Bytes transferred	Direction	Data
2025-04-28 15:29:14 UTC	1460	OUT	GET /common/GetCredentialType?mkt=en-US HTTP/1.1 host: login.microsoftonline.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: / sec-fetch-site: none sec-fetch-mode: cors sec-fetch-dest: empty sec-fetch-storage-access: active accept-encoding: identity accept-language: en-US,en;q=0.9 cookie: esctx-EtTuzs0zE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEytvG2Rba_iZLIeIsVZmezIxFm8IPoA0Wg_aiLlfVbO5RGeAQzOA4Ua-hgTpOiy16G16l6gNY2AKeZjYgQz2caxKmmtIqk49wjVLr-bjgO9NZ2C0oVuQK5c7f2SX2tZreQAHBZ2hoS5Sjr2LQcMTVICAA cookie: x-ms-gateway-slice=estsfd cookie: stsservicecookie=estsfd cookie: AADSSO=NA\|NoExtension cookie: SSOCOOKIEPULLED=1 cookie: buid=1.ASYAMe_N-B6jSkuT5F9XHpElWmfKzIC9VKtEhiVLecTcd3UBAAAmAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEcz2UiitxKdAyFNEbPH6W-QCgMY2zMNhBw6lAeJOmLaHyyuhoCg1YR6Tb3StDfioVAetDA2reQP-mWO6tWhmsb-bt9AJHbvJgLCixH_ctjKogAA cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEzIdGJSbCoizotwObgpXq0ZNrnCatazQIBgf5aLuTWNcAxWT_vrl_-d2frfOUbTc9IqxFIorq_QkBhkvg8qZZoru9SKgLtJNclysp0IQI4NkRDDBQPb8xU3rrgQ2-kKnFHglklU7c3XGCNCwKXigVlh5RlwfDt4leqzoBaQpqvJ0gAA cookie: esctx-NWt4QO40b1w=AQABCQEAAABVrSpeuWamRam2jAF1XRQEt6VxrTBwGgF7P8wS3JpjmzhoC7ft5lWzB4C9Gb8lbijBBta6beUP0dv4TKOg8kPNRWlqIRIjcapwaEo6N4PG2GYxmBcb1O8u_pyyf9Z8p-Cw7mv-cXxW704dauSEk6qG4X6T4MoZnOka3LL-5td4QyAA cookie: fpc=Ah6nsSx-7zxJpyRRDaBOCAxc5p_pAQAAALmVod8OAAAA cookie: MicrosoftApplicationsTeleme
2025-04-28 15:29:14 UTC	87	OUT	Data Raw: 74 72 79 44 65 76 69 63 65 49 64 3d 33 62 64 61 61 62 63 36 2d 31 33 37 61 2d 34 32 34 32 2d 39 37 62 36 2d 62 31 31 64 66 39 39 36 36 34 35 36 0d 0a 63 6f 6f 6b 69 65 3a 20 62 72 63 61 70 3d 30 0d 0a 70 72 69 6f 72 69 74 79 3a 20 75 3d 31 2c 20 69 0d 0a 0d 0a Data Ascii: tryDeviceId=3bdaabc6-137a-4242-97b6-b11df9966456cookie: brcap=0priority: u=1, i
2025-04-28 15:29:14 UTC	1460	IN	HTTP/1.1 200 OK cache-control: no-store, no-cache pragma: no-cache content-type: application/json; charset=utf-8 expires: -1 strict-transport-security: max-age=31536000; includeSubDomains x-content-type-options: nosniff p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 345b947e-7a71-4c0e-8107-d4d256835600 x-ms-ests-server: 2.1.20540.5 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-security-policy-report-only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-XHSDk0FIWm8EW-E5zPyCxQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All x-xss-protection: 0 set-cookie: fpc=Ah6nsSx-7zxJpyRRDaBOCAxc5p_pAQAAALmVod8OAAAA; expires=Wed, 28-May-2025 15:29:14 GMT; path=/; secure; HttpOnly; SameSite=None set-cookie: x-ms-gateway-slice=estsfd; path=/; secure; sa
2025-04-28 15:29:14 UTC	83	IN	Data Raw: 6d 65 73 69 74 65 3d 6e 6f 6e 65 3b 20 68 74 74 70 6f 6e 6c 79 0d 0a 64 61 74 65 3a 20 4d 6f 6e 2c 20 32 38 20 41 70 72 20 32 30 32 35 20 31 35 3a 32 39 3a 31 33 20 47 4d 54 0d 0a 63 6f 6e 74 65 6e 74 2d 6c 65 6e 67 74 68 3a 20 31 36 34 0d 0a 0d 0a Data Ascii: mesite=none; httponlydate: Mon, 28 Apr 2025 15:29:13 GMTcontent-length: 164
2025-04-28 15:29:14 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 63 65 66 33 37 37 30 33 2d 30 37 32 30 2d 34 30 64 30 2d 39 62 31 31 2d 30 38 62 63 31 32 30 31 30 64 33 39 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 34 2d 32 38 20 31 35 3a 32 39 3a 31 34 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"cef37703-0720-40d0-9b11-08bc12010d39","timestamp":"2025-04-28 15:29:14Z","message":"AADSTS900561"}}

Timestamp	Bytes transferred	Direction	Data
2025-04-28 15:29:26 UTC	309	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xPfEWvKhnte2adR&MD=v1GnP2pR HTTP/1.1 host: slscr.update.microsoft.com accept: / user-agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 accept-encoding: identity
2025-04-28 15:29:26 UTC	541	IN	HTTP/1.1 200 OK cache-control: no-cache pragma: no-cache content-type: application/octet-stream expires: -1 last-modified: Mon, 01 Jan 0001 00:00:00 GMT etag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" ms-correlationid: e1d4fc77-b290-4ac0-84de-2ffa72185dcc ms-requestid: 7a010ac8-f863-496e-9709-b2c941fc2e70 ms-cv: Qtk8o2Ur+E6imwVt.0 x-microsoft-slsclientcache: 1440 content-disposition: attachment; filename=environment.cab x-content-type-options: nosniff date: Mon, 28 Apr 2025 15:29:26 GMT content-length: 30005
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: 25 dc 93 6a 9f d2 e0 c1 ea a0 79 31 c4 ab 34 9c e1 43 a8 b3 7e 55 3a 43 6e 5b 8c bc 1c ac b5 c5 db f6 d5 6b 9a 98 b7 61 91 ec 20 ed 8b 6b 6b 17 65 25 d4 6a aa b6 ca 84 bd 36 98 48 0e 5e cd 7c b0 80 4f 8a 29 1a bd 79 0a 95 15 94 2c 8d 46 d3 90 66 2a a1 20 71 50 9b 63 14 ba 66 53 25 93 57 c9 de 70 e3 0a f9 95 e5 f6 30 46 8b 99 e7 52 08 31 34 2a fb 7b 19 1f 7d d2 b0 1d 12 db 90 d7 13 2b 94 d3 2c 24 3c da 5c c7 eb 72 6a b9 b9 58 16 5c 90 d7 e5 cd 92 95 32 0d 6b cf 04 8d 4e 78 08 6b 05 10 2b 3f 35 f1 9b 05 cf 25 b3 f8 b8 80 45 47 a6 3f 98 fb 9d 6d bb 59 60 bf 35 2a 6a 71 da 05 32 46 9c 40 06 81 a2 d0 24 13 09 4e 44 ad c8 6d e0 34 6a 19 a9 18 60 e4 00 e9 b7 1d ae 08 07 c3 31 50 c7 68 68 e8 50 28 40 75 d8 01 17 46 0a 23 66 bd 70 60 ba 6d fe d2 9a c3 39 9c fb a0 Data Ascii: %jy14C~U:Cn[ka kke%j6H^\|O)y,Ff* qPcfS%Wp0FR14{}+,$<\rjX\2kNxk+?5%EG?mY`5jq2F@$NDm4j`1PhhP(@uF#fp`m9
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: 88 13 d2 ca b4 06 b4 39 d4 f9 dc 75 86 ec f8 71 28 61 7c 4c c7 63 c8 ea 15 e7 75 7d 6d 29 70 2a 71 c0 e4 ec e9 97 37 59 2c ef da 63 ae b1 f3 e5 0b 3b cf df 39 d7 39 fa 82 03 6e ce 5d df 9a 7e b1 21 8c f5 e5 b9 a1 86 fb 42 cd 8f 80 65 85 b7 9b da 6d 66 ca ea e3 34 46 3b 0d 3a b7 43 5e 3d 7a 57 67 f5 fc 5c 06 83 b4 c2 d8 63 75 21 29 ed dd c1 86 8d 5d 43 f3 49 fd 3d 76 02 f5 6a 5c 57 4b 0c 0f 16 4c dc ae 2c 6b d6 f7 77 f2 a8 5d 45 e3 67 7b 15 83 04 9a 73 32 62 e8 67 d8 7e c1 4c 27 14 66 da 01 f8 70 cc af 50 49 02 86 a1 cc 11 74 0c 24 7f 15 ad 28 be 9d 40 0c 81 9d a0 c6 02 69 80 3c 40 a6 20 29 90 04 80 7d 78 26 1e ec 70 98 20 80 f0 1b 08 60 00 70 d4 d7 e1 d0 c7 a1 d0 95 43 18 82 b8 25 55 45 8c a6 3c b1 98 db 86 78 7d 26 94 17 d0 3b 82 42 0d 40 0d 50 49 53 4a Data Ascii: 9uq(a\|Lcu}m)p*q7Y,c;99n]~!Bemf4F;:C^=zWg\cu!)]CI=vj\WKL,kw]Eg{s2bg~L'fpPIt$(@i<@ )}x&p `pC%UE<x}&;B@PISJ
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: 9e 4c 48 88 5f 1b 99 a2 79 07 02 1f 96 7e 0e 91 7d ff 94 85 f8 7a 67 50 22 aa 5f 9d b1 ea a1 e7 40 3d e0 af d4 09 80 e0 46 08 01 02 dc 7c 87 51 31 df 61 b4 fc b5 f8 5f f9 9c 7e 37 d4 2e 33 2b bb ab b5 2d 61 e9 d4 86 25 79 97 ff 9e 60 01 ae e6 85 4f 0d 70 27 cb 1c ca cd c6 bb 4c ee e3 f1 e7 bd 04 1a c4 ed 5f ae e6 74 15 34 ce df 79 d8 bc c2 5b 3a 92 70 aa 60 87 34 ac 37 4f 07 1b c3 55 5a 75 15 93 ac 8f 49 e2 e4 eb 89 76 36 16 f0 83 b7 d5 bb 9f 67 2f 58 2c 57 77 4a 51 b7 7d ea c5 74 6c 12 68 7c 96 77 f7 76 81 a8 ad 31 99 b2 9b a5 fe 82 2e a8 87 5d 00 c3 8c c5 2b de 55 90 4a db 4b 20 93 f0 89 59 6d 27 da 83 c9 06 97 5b cf e2 8c 3a da b1 f1 9f 15 df ae f8 48 9f 72 16 a2 76 86 7d ce 3a 98 57 9f df 1b d0 21 92 e5 7e 21 70 a6 89 08 f9 40 7b 4f 81 e4 ad 37 f1 88 Data Ascii: LH_y~}zgP"_@=F\|Q1a_~7.3+-a%y`Op'L_t4y[:p`47OUZuIv6g/X,WwJQ}tlh\|wv1.]+UJK Ym'[:Hrv}:W!~!p@{O7
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: ec 5b ba a1 ad f4 7e b4 36 22 6b 2a 3a ea b1 10 bb 5a d2 82 b3 0d ce 73 7e 0e e7 48 44 3b 1f 73 dd 54 69 30 7d cb f8 b3 28 bf 32 cd a8 91 6d 34 ad bb 0e d6 22 89 e7 eb 96 b3 8a bc 59 04 0a 5e bc 0b 94 99 3b ef f8 9c bb b7 31 08 30 50 61 9f 34 7d fc aa 6a 32 22 64 fa 76 01 58 be a6 de 25 8f 4c df ca 78 6c 2b 26 9a 9a 4a 74 8f a6 d3 ed aa 44 e2 79 8f 57 ad 97 78 47 09 43 fb f6 b2 69 ae fa ed 0e a6 c8 bc 2d 77 e5 1a be 7a c9 bf 7a 38 df 8f 7f 89 5f 71 93 cd f1 3e a1 da 7c 03 1a 34 f3 b5 5b 8e 92 80 7b dc 29 5e 24 de 2a fe 87 0a 59 f2 e5 dc f9 04 df 73 8a c3 c5 46 cd eb bd 03 6e a2 52 ca 4d 3c 42 8a 91 90 5a 49 6b 4e fc c5 eb 6a e7 27 5f d7 d9 92 eb 99 80 dd 9e 5b 65 18 f5 33 5f 86 4c f2 90 bb f6 e7 d2 ac 36 6f 13 62 f5 9b 39 9d 78 c6 6f 1e a6 9f 96 13 48 6b Data Ascii: [~6"k:Zs~HD;sTi0}(2m4"Y^;10Pa4}j2"dvX%Lxl+&JtDyWxGCi-wzz8_q>\|4[{)^$YsFnRM<BZIkNj'_[e3_L6ob9xoHk
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: e0 22 b7 3c 63 7a e6 a3 86 23 e7 30 2c a5 42 31 a2 ae 1d 00 01 77 ff 02 a6 f0 eb 0b 87 ba f9 f4 b0 9c 8b e6 cf 6e 16 c7 b8 4c f1 8c b4 47 9e 54 c6 be 45 47 91 4e 78 c0 25 c3 da 17 f4 70 5a ff 27 b0 83 21 21 a0 e4 ae fa e7 11 5b d1 a2 1b 58 46 ba 4f bb ee 07 59 6e f4 ab 0a 81 03 c1 db 6d e1 39 50 02 d9 13 3a ab 49 21 bc e7 4b f7 77 6a 95 6b 49 fb ce 2e 4c aa 8c 55 4e a9 ed f2 4b ba 33 65 99 89 da 5f 69 11 cd d0 da 26 9d ba bf 75 33 7c 68 ce 52 23 f7 6e bc 71 bd c0 f4 4c 0b 5d 99 f0 e8 ca 66 97 be 7a a9 35 72 a3 de 49 98 95 65 3a c9 e6 ee 0c cd 45 69 a7 49 e7 1e fb 4f 4f 15 f7 a3 06 9f 47 bd ab 57 ad de 78 c8 98 dc 16 dc f3 dc dc 55 83 32 68 7c fe e1 8e ea 62 90 73 ac a2 96 77 af 48 45 bf 78 17 b3 09 a7 a0 ca 83 66 1e 5a d1 e5 90 4f 7e a6 0b 01 21 3a 95 a5 Data Ascii: "<cz#0,B1wnLGTEGNx%pZ'!![XFOYnm9P:I!KwjkI.LUNK3e_i&u3\|hR#nqL]fz5rIe:EiIOOGWxU2h\|bswHExfZO~!:
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: 32 1b 0a 18 02 7a 78 07 ff b7 e4 2c d8 df 5c 0f 2a b6 bb 00 9c 87 d0 82 ba 63 31 84 2a c7 46 98 eb 69 7b ca ce 9c e6 4a 57 82 55 9d 16 93 e4 b5 57 d0 fa 9c 13 8a fb e0 26 aa cb 42 66 b1 8c b9 47 81 8f 78 e3 fb 48 3f d3 f1 e2 b2 3b da 37 b9 e7 72 09 2f 28 74 c5 3e 08 59 00 a5 23 c9 e2 00 24 d9 ad 9f 24 21 fe a8 3a df 1f 25 21 0e a8 2a 9b 7f 22 09 51 ff 59 12 22 01 43 82 45 51 0d 42 bf 2f 09 89 de 9f 4c c9 db 61 c0 ef 3e d3 70 fe f1 53 0b 5c 79 ac ed 1b 14 3c 55 e6 4d a6 39 95 45 ed 70 7c 08 dc 92 bb c1 42 6b e0 27 49 08 37 a7 00 02 f1 4d 12 f2 3a 2b a0 03 08 78 f1 a7 6c c7 af 6c 11 f6 71 b6 48 c2 c1 c2 15 65 9e c7 e2 24 04 13 c0 70 d4 8d da 51 c3 da c6 c2 de fc 1b fb 24 28 0d 00 1c 00 9f 0c c0 21 2d c4 2b f0 af 6b 41 16 01 24 3a 0d 80 44 c3 38 a6 05 59 7f Data Ascii: 2zx,\c1Fi{JWUW&BfGxH?;7r/(t>Y#$$!:%!*"QY"CEQB/La>pS\y<UM9Ep\|Bk'I7M:+xllqHe$pQ$(!-+kA$:D8Y
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: 7c 24 f8 a0 ce fd 7a 40 64 78 d4 ba d0 e2 f2 bf a4 fc f8 e2 50 c0 60 d0 a5 93 cd 3c de 94 69 0f 58 bd 36 18 c4 18 88 b1 82 8a 48 29 e9 2a 82 cf 65 09 86 26 8b dc 0b 7d bc be 1c f4 58 aa f5 29 c8 ea 5a 78 49 52 be 34 5b fd 1e 8f 4e 87 e0 ce 85 57 93 e2 f3 cf 81 d3 11 8f a5 b2 a4 79 d3 68 e4 07 e8 4e 36 bd 4c 8d 0d 77 9b 0b de f5 6b e4 6f e1 7f cd 83 97 50 96 71 e7 35 a7 8f 91 df 93 06 62 9c c9 b1 75 aa 1e 01 c3 a0 d1 c7 1f 72 06 82 e0 58 00 02 d7 0a cd a4 eb a5 3e 5d c7 86 55 ab e9 22 f1 63 09 2d 9d 13 3e 49 38 57 5c d8 83 67 c1 75 c5 48 f3 65 71 9a a2 b0 a6 47 e8 32 13 f5 41 d5 cc 6d 22 a3 c4 bb 85 55 d2 db 8a a2 79 30 ce 1e a7 f3 90 19 ec 12 95 c4 54 46 a6 8f 96 54 04 f3 6d 0c 27 c7 22 b3 1e f0 47 da b5 bb ec 28 a7 bb 79 3e 7f 40 cc 97 48 c3 94 f8 d8 df Data Ascii: \|$z@dxP`<iX6H)*e&}X)ZxIR4[NWyhN6LwkoPq5burX>]U"c->I8W\guHeqG2Am"Uy0TFTm'"G(y>@H
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 a9 9d 26 b6 7a 21 ff 73 7a 7d 44 18 6d a3 7f b8 a4 78 23 38 6f 6b cd 97 ef 3f 75 99 b5 f5 2a e7 7c f9 a2 de ed d8 f1 6e 7b d7 b0 43 9c ac ff 11 e2 94 7d 61 09 b5 51 4e 0f 1b 03 13 b4 e1 92 7e 9e 6b d5 a1 e0 c3 e3 f1 92 12 81 23 1d 9e 5b 8c 83 b9 a6 f2 ce fc 34 44 06 ee 97 6a 1a ad 7a 2a 89 47 bd 67 a2 d1 1b 21 b0 95 e8 29 23 38 98 10 56 c4 12 82 e9 48 03 14 04 7f bf 70 42 b6 d9 b6 04 1b 03 9c 67 15 67 02 d2 9d 6a ae 97 5b 7d 39 7e 4d a2 c1 ac 9f 7c 54 6e 51 8b bf 3d a5 80 c1 91 a9 64 bb 20 52 b5 85 97 b4 95 50 0a 41 6e 51 f1 ca cb 97 e4 bf 2a 74 93 cf a7 ba 48 88 0c 5f 19 af 70 7d 15 f1 9f 24 d6 9c 85 c7 06 de 82 3c 2b c3 8b fc 4e 4e e9 0e fa 79 68 26 98 fa e0 d5 Data Ascii: "0H0&z!sz}Dmx#8ok?u\|n{C}aQN~k#[4DjzGg!)#8VHpBggj[}9~M\|TnQ=d RPAnQtH_p}$<+NNyh&
2025-04-28 15:29:26 UTC	1460	IN	Data Raw: 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 55 70 64 61 74 65 20 53 69 67 6e 69 6e 67 20 43 41 20 32 2e 33 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ac 39 80 cb 34 50 ca 26 3f 5d 76 26 ca d3 8c c1 1d 5c eb 30 97 c6 66 86 26 a6 d5 5d 5f 4f cd 80 4c 0f 67 ec 25 0c bb 39 11 3b 6e 86 fd c7 21 27 60 fc 80 7c 01 89 ad e8 6e cd bd d0 47 5f 58 6d 00 3b 46 57 99 7d 16 b3 76 12 8b ca 9d 86 6c 1d 70 9a 69 d4 45 fe ce 72 ea ca ca 94 60 9d 7c 73 Data Ascii: 10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Update Signing CA 2.30"0*H094P&?]v&\0f&]_OLg%9;n!'`\|nG_Xm;FW}vlpiEr`\|s

Target ID:	1
Start time:	11:28:44
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7eb3f0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	11:28:47
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,5341923443139917202,3182975309698974738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2164 /prefetch:3
Imagebase:	0x7ff7eb3f0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113424
Entropy (8bit):	5.2850742719795925
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmQhSeC1Jzc6VU23:xkXhp6VUU
MD5:	F3588C5412D4119F95E47073A4A5DF72
SHA1:	3C4B1652E71C25E1CE7DE611FBD17EDBAAE411D9
SHA-256:	6CC79C59F00478CE5D8EAA982EFDD8FC3CC205A7EA023A564BB2688FA206A087
SHA-512:	62886F8BFB32D2BE842A23ECA157556C30EC1D616E2607D9DF1894F702BB7A982EEB3576C95F859B4B8E9183A84D70149A8802F31317F80D4845B02CCFA018F9
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45797)
Category:	downloaded
Size (bytes):	406986
Entropy (8bit):	5.3174053081832815
Encrypted:	false
SSDEEP:	3072:4esPtqdZBoxn7oW/LRRe3KudJcPYRTQR+X/RWm7mAd5hyuZUkdYiGrgnWlnnK:Igdkxp/n+9g18v0mfZ9UK
MD5:	1AF685AF559E1A6D6B39B01A28A87098
SHA1:	9DDF777FDAB881E38986E54658C3DA63484149FC
SHA-256:	58C7CB68BF73AE3605A6706D8D04B74D7EA90EB89D67FED4752C6A3497E093CC
SHA-512:	05B92ADAA2C316602A8DC0BC1000301A459A1A9CDC008F102DE560987869C8ECE03E424E2A1E070B2A6AEDD0B9FB7244B58725504BB12420BDB4BCBEDB0A5B58
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_41f36656d3c0bb04c90c.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],Array(542).concat([f

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Target ID:	3
Start time:	11:28:49
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2072,i,5341923443139917202,3182975309698974738,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4936 /prefetch:8
Imagebase:	0x7ff7eb3f0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	6
Start time:	11:28:53
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph"
Imagebase:	0x7ff7eb3f0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
https://security.microsoft.com/mtp-investigation/urn:UrlVerdictChangeInvestig:98ea7570b89677de9d1d8e2e20daeb48/graph