Windows Analysis Report
https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2FsubscriΡtions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l

Overview

General Information

Sample URL:	https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2FsubscriΡtions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwM
Analysis ID:	1520812
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Found iframes

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Found iframes

Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI

HTML body contains low number of good links

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/oauth20_authorize.srf%3fusername%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26mkt%3den-US%26username%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26uaid%3d3d90045f99d5477f8d646f39ea9b8305%26contextid%3d78E186C1D25663E1%26opid%3d7ED6D70942355491%26bk%3d1727474130&id=293577&uiflavor=web&client_id=1E00004417ACAE&uaid=3d90045f99d5477f8d646f39ea9b8305&mkt=EN-US&lc=1033&bk=1727474130	HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML page contains hidden javascript code

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0

HTTP Parser: Base64 decoded: 4e9f3596-81a3-4f26-a701-1e7eef161b0e2e2197c5-6f39-4437-a6eb-b44725c2090e

HTML title does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: Title: Sign in to your Microsoft account does not match URL
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: Title: Sign in to your Microsoft account does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: <input type="password" .../> found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: No favicon
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: No <meta name="author".. found
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/oauth20_authorize.srf%3fusername%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26mkt%3den-US%26username%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26uaid%3d3d90045f99d5477f8d646f39ea9b8305%26contextid%3d78E186C1D25663E1%26opid%3d7ED6D70942355491%26bk%3d1727474130&id=293577&uiflavor=web&client_id=1E00004417ACAE&uaid=3d90045f99d5477f8d646f39ea9b8305&mkt=EN-US&lc=1033&bk=1727474130	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: No <meta name="copyright".. found
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/oauth20_authorize.srf%3fusername%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26mkt%3den-US%26username%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26uaid%3d3d90045f99d5477f8d646f39ea9b8305%26contextid%3d78E186C1D25663E1%26opid%3d7ED6D70942355491%26bk%3d1727474130&id=293577&uiflavor=web&client_id=1E00004417ACAE&uaid=3d90045f99d5477f8d646f39ea9b8305&mkt=EN-US&lc=1033&bk=1727474130	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49750 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.16:52689 -> 1.1.1.1:53

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: nam.safelink.emails.azure.net to https://admin.microsoft.com/adminportal/home?#/subscriptions

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l HTTP/1.1Host: nam.safelink.emails.azure.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=aUrdNzKYFXN+zUT&MD=2cpo+sxf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=aUrdNzKYFXN+zUT&MD=2cpo+sxf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_aPH1MdAMytMMq1WvwJPhJA2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_aPH1MdAMytMMq1WvwJPhJA2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30374.3/images/favicon.ico HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30374.3/images/favicon.ico HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/reset-password-signinname_en_iGkKHb6MchyJTpOn_ZeIdw2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://account.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/reset-password-signinname_en_iGkKHb6MchyJTpOn_ZeIdw2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://account.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: nam.safelink.emails.azure.net
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: acctcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: fpt.live.com
Source: global traffic	DNS traffic detected: DNS query: account.live.com

Source: chromecache_172.1.dr, chromecache_167.1.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_172.1.dr, chromecache_167.1.dr	String found in binary or memory: https://localcdn.centro-dev.com:5555/inline.bundle.js.map
Source: chromecache_159.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_159.1.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 52709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 52735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52703
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52700
Source: unknown	Network traffic detected: HTTP traffic on port 52713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52709
Source: unknown	Network traffic detected: HTTP traffic on port 52707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52713
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52723
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52720
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52735
Source: unknown	Network traffic detected: HTTP traffic on port 52697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52695
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52696
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52732
Source: unknown	Network traffic detected: HTTP traffic on port 52731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52731
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52741
Source: unknown	Network traffic detected: HTTP traffic on port 52734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 52720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 52745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: classification engine

Classification label: clean4.win@28/93@26/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1952,i,3575760107684391540,14792378179534548501,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1952,i,3575760107684391540,14792378179534548501,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.alphacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
sni1gl.wpc.alphacdn.net	152.199.21.175	true
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true
sni1gl.wpc.omegacdn.net	152.199.21.175	true
www.google.com	142.250.184.196	true
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true
nam.safelink.emails.azure.net	unknown	unknown
identity.nel.measure.office.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown
logincdn.msftauth.net	unknown	unknown
login.microsoftonline.com	unknown	unknown
fpt.live.com	unknown	unknown
account.live.com	unknown	unknown
acctcdn.msftauth.net	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js	false	unknown
https://logincdn.msftauth.net/shared/5/js/login_en_aPH1MdAMytMMq1WvwJPhJA2.js	false	unknown
https://logincdn.msftauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg	false	unknown
https://logincdn.msftauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg	false	unknown
https://logincdn.msftauth.net/16.000.30374.3/images/favicon.ico	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 20:53:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	341C6499D74712117A1992FEF468D7BA	77CBBC4655A42BFC4850342B17F22800665F908E	52162111F6CB99BF40A71E163DFD879CCA0F3ABD079C7D377ED7F931A1CC00C9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 20:53:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	786846789F9091659C0BEC5041AE2C20	80D48801D2C08FCBB41F4625B0B34668A36E2EA9	D16507ECF4538D8786310DF1DA8056FB2E5A96A7070749A3E118C6FCBBFA67EC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CC9B10BA02EF69938E14919309812340	8972AE4325547762883D3ECD120E281BFD51373B	1BC308A294257163F0E2F218A6B58E569800CC5EE66EB45798662452B172EFE9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 20:53:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7B09A55A7860869C58B37D1F5D66E34F	B1F17540BB8D0B0E0A83A9F314FE51CEE29A17EC	B62F6674275C9D65400633F0C828851A20208A8931D1B0FAA084A852390E4508
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 20:53:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E8BED521431E0F461E58FF4098E1ABAA	6494318D9D963BC4444C1B9A0C9F7BD73DCEBD52	988E8CCF70CC2A88E515C06D421104AA0B62043E323AF87184E164A80642400E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 20:53:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	89A12EA46E7772293DB33C29364C3725	65EAE10D71FAFA8C66370EB64D8478C25028B77F	E0A2E86982DBED67A0D64D4E9C1130537BB81D56F2AA646EBE2F4CDA6295B47C
Chrome Cache Entry: 154	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 155	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152	C1E82BF71ADD622AD0F3BF8572F634FC	6CA863D4CAB96669202548D301693B3F5F80B0D5	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
Chrome Cache Entry: 156	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986	2D3FBED6DDD719FCC1BFB500B612FCEC	CD91B795DDE806AC8A38E51CCB6E8BAD8E57DA1B	B2566B646F02DF4CE30B05D8223B78130A719D4EC9E4794A0106C371ADE33CC7
Chrome Cache Entry: 157	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866	6DE768A4DF1E0D0061CDB52EF06346C4	3829A667B97668008023DDA98F4C0772174C8EF6	58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
Chrome Cache Entry: 158	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 159	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators	CB06E9A552B197D5C0EA600B431A3407	04E167433F2F1038C78F387F8A166BB6542C2008	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
Chrome Cache Entry: 160	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152	C1E82BF71ADD622AD0F3BF8572F634FC	6CA863D4CAB96669202548D301693B3F5F80B0D5	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
Chrome Cache Entry: 161	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703	AF2A7A4929E13F15A045C8C8D80A4543	6A1EC81A5085D0846C77DD616AE686FF732C32D6	EB47C5509CEF44C582EF8ABB8C58766EA6118AD40B0FFC22A7652ED1DC6FEE8B
Chrome Cache Entry: 162	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 163	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 164	ASCII text, with very long lines (65439)	57FD0FB79B8289945CA246DE0908D270	7FC9AB444778E83D566F35102D604969ED50576D	EB327424AA27D47E4499187303774F8F22557359DB3C6BB583E033E07DD0B337
Chrome Cache Entry: 165	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 166	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401	48981D3CF57E7C58CA7E3E851EF9354E	73593DE7633B10F9FFD0EF0E46280FA40FF433FF	8A5E756923CC5C3F013862427B7622F58A52501C5A6017FFF2FDB2AFD94A10C2
Chrome Cache Entry: 167	ASCII text, with very long lines (12836)	BE429D47487D7F8DB28FBE37320E61AC	26AFF4FAD6831FB5CE28C22CF41DA9EAB9F900EA	70487DF2B7E5ED35FCDE2BD7E43ABE95F3F10589B2DBFF2968098E000E4511E8
Chrome Cache Entry: 168	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986	2D3FBED6DDD719FCC1BFB500B612FCEC	CD91B795DDE806AC8A38E51CCB6E8BAD8E57DA1B	B2566B646F02DF4CE30B05D8223B78130A719D4EC9E4794A0106C371ADE33CC7
Chrome Cache Entry: 169	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443	C217AE35B8592DC9F1E680487DAD094F	2E642562C2BFD8968629317FF212684C7EB59193	D41992E79D7BCFCC1F32597208DD99033D99C04882EAFCC8508F2FA0EE728C6B
Chrome Cache Entry: 170	ASCII text, with no line terminators	AAAB7A355103063D9EEB4824A3A6B374	E51555F02C32321F3E48F07A0FA5AF46DF835BFC	79BA862622D6FA84AC7E4F98EB95043A255FC2C81711E9400A8AA4D4B1608471
Chrome Cache Entry: 171	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769	D3B6AE9986DF244AB03412CC700335D0	BAAA1F9899178938F3881F09B18265E47DA806E3	CA50059111D30C2E212C90805792EB543548AEF0D4941E886A778E3DCE0B9066
Chrome Cache Entry: 172	ASCII text, with very long lines (12836)	BE429D47487D7F8DB28FBE37320E61AC	26AFF4FAD6831FB5CE28C22CF41DA9EAB9F900EA	70487DF2B7E5ED35FCDE2BD7E43ABE95F3F10589B2DBFF2968098E000E4511E8
Chrome Cache Entry: 173	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 90677	2E287EB418940084B921590C6E672C9E	1FC75A9DAA054EF88AAEA181F3A9B4CBA2B6B6E1	6C2C58DAAE76131A00D1BFEE20852F372CF594BE7F4A8848ACC42F8BF72C1BBD
Chrome Cache Entry: 174	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592	4761405717E938D7E7400BB15715DB1E	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
Chrome Cache Entry: 175	ASCII text, with very long lines (65470)	68F1F531D00CCAD30CAB55AFC093E124	92956CEA8F77453A460F33DF51E601653A5E0FD9	F709D9E0A2435C4E5D66CDF6EC744006D5A32AD329AB489181924CEDBD72D4AF
Chrome Cache Entry: 176	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769	D3B6AE9986DF244AB03412CC700335D0	BAAA1F9899178938F3881F09B18265E47DA806E3	CA50059111D30C2E212C90805792EB543548AEF0D4941E886A778E3DCE0B9066
Chrome Cache Entry: 177	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 178	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443	C217AE35B8592DC9F1E680487DAD094F	2E642562C2BFD8968629317FF212684C7EB59193	D41992E79D7BCFCC1F32597208DD99033D99C04882EAFCC8508F2FA0EE728C6B
Chrome Cache Entry: 179	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 644076	8F5BE56A993E851163F96471BD77E117	8D46AD4565CA492D520035CC7ABF069EF90A3C8C	D47483C76252B60913230242E59A917D9C2B6CA2EF7C438C6205E821BCFBD085
Chrome Cache Entry: 180	ASCII text, with very long lines (65470)	68F1F531D00CCAD30CAB55AFC093E124	92956CEA8F77453A460F33DF51E601653A5E0FD9	F709D9E0A2435C4E5D66CDF6EC744006D5A32AD329AB489181924CEDBD72D4AF
Chrome Cache Entry: 181	ASCII text, with very long lines (65439)	57FD0FB79B8289945CA246DE0908D270	7FC9AB444778E83D566F35102D604969ED50576D	EB327424AA27D47E4499187303774F8F22557359DB3C6BB583E033E07DD0B337
Chrome Cache Entry: 182	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
Chrome Cache Entry: 183	ASCII text, with no line terminators	88A9F7A8F7681BBFD0C42E3AED069D5E	2933C1BBE7AB6C2A20DA92400E50C69F837F5A8F	0E0C579E7D9FE8DA04A7E301963EFDCB3B102436234608EC6AEDBE225BFDFE5F
Chrome Cache Entry: 184	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866	6DE768A4DF1E0D0061CDB52EF06346C4	3829A667B97668008023DDA98F4C0772174C8EF6	58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
Chrome Cache Entry: 185	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 186	ASCII text, with no line terminators	06B313E93DD76909460FBFC0CD98CB6B	C4F9B2BBD840A4328F85F54873C434336A193888	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
Chrome Cache Entry: 187	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592	4761405717E938D7E7400BB15715DB1E	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
Chrome Cache Entry: 188	HTML document, ASCII text, with CRLF line terminators	B74499BDA902C84D1468A84DA5F443FB	0A3259A9852BE07405F10D39293466137C44BB4F	0BA26423ED3348AE5C95A103E7D7AF6EA3B202C4A4830EFF7D609558925A5382
Chrome Cache Entry: 189	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 190	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 644076	8F5BE56A993E851163F96471BD77E117	8D46AD4565CA492D520035CC7ABF069EF90A3C8C	D47483C76252B60913230242E59A917D9C2B6CA2EF7C438C6205E821BCFBD085
Chrome Cache Entry: 191	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703	AF2A7A4929E13F15A045C8C8D80A4543	6A1EC81A5085D0846C77DD616AE686FF732C32D6	EB47C5509CEF44C582EF8ABB8C58766EA6118AD40B0FFC22A7652ED1DC6FEE8B
Chrome Cache Entry: 192	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 193	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 194	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 195	JSON data	9E576E34B18E986347909C29AE6A82C6	532C767978DC2B55854B3CA2D2DF5B4DB221C934	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
Chrome Cache Entry: 196	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 197	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 198	HTML document, ASCII text, with very long lines (2625), with CRLF line terminators	AB6F9D373748FD9BC505E5D9E047A8FA	91091279F70AD460E8A0CF924619A78C34A705FC	0CA6C3C52DD015AF4BC581A38603D15101218EA8539F38D1B4CAC353EF0BD685
Chrome Cache Entry: 199	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 200	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
Chrome Cache Entry: 201	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 90677	2E287EB418940084B921590C6E672C9E	1FC75A9DAA054EF88AAEA181F3A9B4CBA2B6B6E1	6C2C58DAAE76131A00D1BFEE20852F372CF594BE7F4A8848ACC42F8BF72C1BBD
Chrome Cache Entry: 202	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 203	JSON data	9E576E34B18E986347909C29AE6A82C6	532C767978DC2B55854B3CA2D2DF5B4DB221C934	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
Chrome Cache Entry: 204	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 205	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 206	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 207	ASCII text, with no line terminators	AAAB7A355103063D9EEB4824A3A6B374	E51555F02C32321F3E48F07A0FA5AF46DF835BFC	79BA862622D6FA84AC7E4F98EB95043A255FC2C81711E9400A8AA4D4B1608471
Chrome Cache Entry: 208	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 209	ASCII text, with no line terminators	139A010C54200F8E63F5F8196DFC6B88	1F239A55AE74A6A1741A5070A428E48108088B29	071CB6EC5D3727D93DB3261F2CADA840A8511897A3BFA677A338E3C855CB7D18

Found iframes

Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: Iframe src: https://fpt.live.com?session_id=3d90045f99d5477f8d646f39ea9b8305&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SI

HTML body contains low number of good links

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/oauth20_authorize.srf%3fusername%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26mkt%3den-US%26username%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26uaid%3d3d90045f99d5477f8d646f39ea9b8305%26contextid%3d78E186C1D25663E1%26opid%3d7ED6D70942355491%26bk%3d1727474130&id=293577&uiflavor=web&client_id=1E00004417ACAE&uaid=3d90045f99d5477f8d646f39ea9b8305&mkt=EN-US&lc=1033&bk=1727474130	HTTP Parser: Number of links: 0

HTML body contains password input but no form action

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML page contains hidden javascript code

HTTP Parser: Base64 decoded: 4e9f3596-81a3-4f26-a701-1e7eef161b0e2e2197c5-6f39-4437-a6eb-b44725c2090e

HTML title does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: Title: Sign in to your Microsoft account does not match URL
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: Title: Sign in to your Microsoft account does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: <input type="password" .../> found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: <input type="password" .../> found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: No favicon
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: No <meta name="author".. found
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: No <meta name="author".. found
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/oauth20_authorize.srf%3fusername%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26mkt%3den-US%26username%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26uaid%3d3d90045f99d5477f8d646f39ea9b8305%26contextid%3d78E186C1D25663E1%26opid%3d7ED6D70942355491%26bk%3d1727474130&id=293577&uiflavor=web&client_id=1E00004417ACAE&uaid=3d90045f99d5477f8d646f39ea9b8305&mkt=EN-US&lc=1033&bk=1727474130	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DpWdY_La98SL5S3YBdzZjTyEiDBzCtTv9kp8Go3LkXk2orFc9lY5SKnCqDpzvW1lO-Mb8rvW_VyRZmDm2oiMRYKJ8R79xio1HHMxNJgSk4RJiYGSGozIYI6zWC7X4f0Tj6WGow_3XGKexCyWX5OLd6fQnd_gWsOwhEKJmiE0uhwirX267kB3EwtkqnZLzROCG&response_mode=form_post&nonce=638630708229418802.NGU5ZjM1OTYtODFhMy00ZjI2LWE3MDEtMWU3ZWVmMTYxYjBlMmUyMTk3YzUtNmYzOS00NDM3LWE2ZWItYjQ0NzI1YzIwOTBl&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=3d90045f-99d5-477f-8d64-6f39ea9b8305&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAAjZIxjNtUHMbt5C53F5U2ahHqeBIdEJDk2c45zkmHRGI358SOL7FTx5aQlcb2-cX2ez773SXxUkE7sCDdhjg2xi5UXUBMzDd1gKUTCyo6qQgxVWLhoi6MfMOnT_p_y1_fr7zVrPE1tgY-LDI1Zv8eeCu-uvYq8H2mOvPW6T9Kb5crzsb5wa_fPOp-5eLW1bePNy_oHSeCZ15thuOn9PsBIUm2X69P3RiiWgxnKc6wT9bXejRFLkTHP9L0C5r-g6YvCpseqo71p4WM5wSeA00gsGyrwQgCYGuD7njPnquMZlhEE-8H6goAey6ziilxqigR1RxztvkgVg1rac3bkRqPV6oRclY-JoPYyjUdgIGoctd91jZlYs2HYJDLjJXLC81oRy8Lt7RPT0nArg2nMPf-Luz4OI2dBGfkoviK1hIPyW4HI-TNSG1d8xCBsymBGB2lOPFSAr3sIDFdy1GmLUFX9nTOaru5PTdWEhTbeYcYZ60wEbqYU8JJyOL0_qwVWXt6H3VOxCQ_M5lIq6oPhfTMdB6sRnYsxiyG6sjq94RRs7WEmDk8VJeD3rEeNkY9aHX1Ls5lS-Zzs9OcNHxgzHmzixcON-n2vWVnZU72NMXl_SFynWMz0xaB1O_FUAKnwQKmE5Zvhm1OWpDwBNlKPtI63efF0vU6MUaXxZvXTyHo7iYp9mHkvdigrzbe296qlO4WdqkP3gXF_e3tcoW6S-1Sbzbo7zaveWCa_3z2-us70u...	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: No <meta name="copyright".. found
Source: https://login.live.com/ppsecure/post.srf?mkt=en-US&username=cheese1&client_id=51483342-085c-4d86-bf88-cf50c7252078&contextid=78E186C1D25663E1&opid=7ED6D70942355491&bk=1727474117&uaid=3d90045f99d5477f8d646f39ea9b8305&pid=15216	HTTP Parser: No <meta name="copyright".. found
Source: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/oauth20_authorize.srf%3fusername%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26mkt%3den-US%26username%3dcheese1%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26uaid%3d3d90045f99d5477f8d646f39ea9b8305%26contextid%3d78E186C1D25663E1%26opid%3d7ED6D70942355491%26bk%3d1727474130&id=293577&uiflavor=web&client_id=1E00004417ACAE&uaid=3d90045f99d5477f8d646f39ea9b8305&mkt=EN-US&lc=1033&bk=1727474130	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49750 version: TLS 1.2

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.16:52689 -> 1.1.1.1:53

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: nam.safelink.emails.azure.net to https://admin.microsoft.com/adminportal/home?#/subscriptions

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l HTTP/1.1Host: nam.safelink.emails.azure.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=aUrdNzKYFXN+zUT&MD=2cpo+sxf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=aUrdNzKYFXN+zUT&MD=2cpo+sxf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_aPH1MdAMytMMq1WvwJPhJA2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/login_en_aPH1MdAMytMMq1WvwJPhJA2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30374.3/images/favicon.ico HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /16.000.30374.3/images/favicon.ico HTTP/1.1Host: logincdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/reset-password-signinname_en_iGkKHb6MchyJTpOn_ZeIdw2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://account.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/js/reset-password-signinname_en_iGkKHb6MchyJTpOn_ZeIdw2.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://account.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/chunks/oneds-analytics-js_077217740c853b5d4fe8.js HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/2_bc3d32a696895f78c19d.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: nam.safelink.emails.azure.net
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: acctcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: fpt.live.com
Source: global traffic	DNS traffic detected: DNS query: account.live.com

Source: chromecache_172.1.dr, chromecache_167.1.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_172.1.dr, chromecache_167.1.dr	String found in binary or memory: https://localcdn.centro-dev.com:5555/inline.bundle.js.map
Source: chromecache_159.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_159.1.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 52709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 52735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52703
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52700
Source: unknown	Network traffic detected: HTTP traffic on port 52713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52709
Source: unknown	Network traffic detected: HTTP traffic on port 52707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52713
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52723
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52720
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52735
Source: unknown	Network traffic detected: HTTP traffic on port 52697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52695
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52696
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52732
Source: unknown	Network traffic detected: HTTP traffic on port 52731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52731
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52741
Source: unknown	Network traffic detected: HTTP traffic on port 52734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 52720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 52745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49750 version: TLS 1.2

Source: classification engine

Classification label: clean4.win@28/93@26/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1952,i,3575760107684391540,14792378179534548501,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1952,i,3575760107684391540,14792378179534548501,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1520812
Product:	CloudBasic
Start time:	23:53:10
Start date:	27.09.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2FsubscriΡtions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2FsubscriΡtions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2FsubscriΡtions&p=bT0yNzlhNjA0ZS05MTMyLTQyNDYtYjQwOC1kZTQzOWFlMmRmNTMmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l