IOC Report
https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cSN7PR19MB66126F57B7EFCF40B749C3FE847E2%40SN7PR19MB6612.namprd19.prod.outlook.com%3e

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 100
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
downloaded
Chrome Cache Entry: 101
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 102
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
downloaded
Chrome Cache Entry: 103
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
dropped
Chrome Cache Entry: 104
ASCII text, with very long lines (994), with no line terminators
downloaded
Chrome Cache Entry: 105
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
downloaded
Chrome Cache Entry: 106
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
dropped
Chrome Cache Entry: 107
Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
downloaded
Chrome Cache Entry: 108
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 109
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703
downloaded
Chrome Cache Entry: 110
PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 111
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 112
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 113
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
downloaded
Chrome Cache Entry: 114
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 115
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 116
JPEG image data, baseline, precision 8, 1920x1080, components 3
dropped
Chrome Cache Entry: 117
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 118
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 119
Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
downloaded
Chrome Cache Entry: 120
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 121
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 122
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 4730
downloaded
Chrome Cache Entry: 123
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
dropped
Chrome Cache Entry: 124
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 125
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 126
PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 75
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
downloaded
Chrome Cache Entry: 76
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
dropped
Chrome Cache Entry: 77
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 4730
dropped
Chrome Cache Entry: 78
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
dropped
Chrome Cache Entry: 79
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
downloaded
Chrome Cache Entry: 80
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
dropped
Chrome Cache Entry: 81
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449703
dropped
Chrome Cache Entry: 82
PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 83
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
downloaded
Chrome Cache Entry: 84
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 379
dropped
Chrome Cache Entry: 85
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
dropped
Chrome Cache Entry: 86
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401
downloaded
Chrome Cache Entry: 87
JPEG image data, baseline, precision 8, 1920x1080, components 3
downloaded
Chrome Cache Entry: 88
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
downloaded
Chrome Cache Entry: 89
JSON data
dropped
Chrome Cache Entry: 90
ASCII text, with very long lines (994), with no line terminators
downloaded
Chrome Cache Entry: 91
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 92
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 93
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
dropped
Chrome Cache Entry: 94
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
dropped
Chrome Cache Entry: 95
Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
downloaded
Chrome Cache Entry: 96
PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 97
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
downloaded
Chrome Cache Entry: 98
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
downloaded
Chrome Cache Entry: 99
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1378
downloaded
There are 43 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2508,i,14472495800388626087,17777241064131445827,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cSN7PR19MB66126F57B7EFCF40B749C3FE847E2%40SN7PR19MB6612.namprd19.prod.outlook.com%3e"

URLs

Name
IP
Malicious
https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cSN7PR19MB66126F57B7EFCF40B749C3FE847E2%40SN7PR19MB6612.namprd19.prod.outlook.com%3e
http://github.com/jquery/globalize
unknown
https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cSN7PR19MB66126F57B7EFCF40B749C3FE847E2%40SN7PR19MB6612.namprd19.prod.outlook.com%3e
52.97.135.98
https://login.microsoftonline.com
unknown
https://login.windows-ppe.net
unknown
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=bc3da322-4727-861b-5eb4-b16d3af9813b&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120984531044.ad8bde88-aa8b-46ae-826c-e1703c48a0ff&state=Dcs7FoAgDAXRoMflRALE8FxO-Nhaun0p7nQTiGhftiXIClUrMJWU5YZeJYnq6QNtTIDd0VjNJyNb55mqlK5weZ6w3iO-n8cf
https://outlook.office365.com/owa/prefetch.aspx
52.98.243.34
https://outlook.office365.com/owa/
52.97.135.98
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=ebcc48e2-30e8-194c-9fd2-d374bec8336e&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120717527706.4c3a699b-998b-4bd9-a2cc-7fd7ed5cae12&state=VYtLDoIwFEVB14IzSn_00QExASFxoDG6gtI-jREoAdQtuGyZOHBw7uDknjAIgvXCaiGkywSgRKYkZZwCg5QDUEWkFUZp3cRaZ00sG6djw62N4eoAXWoNMh4u7SdM_Nsk29cd35132OZnNO6A02RuuJ-x2-z7Gcce55_b5ZGwlyOczkwfCqUYV3UKBVR1WUtagNSlqKtMQsUjSf-OpDfdMDqmyTB6R_xzbr1_EOu7SOAX&sso_reload=true

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.210.172
s-part-0017.t-0009.t-msedge.net
13.107.246.45
sni1gl.wpc.omegacdn.net
152.199.21.175
www.google.com
142.250.181.228
HHN-efz.ms-acdc.office.com
52.97.135.98
FRA-efz.ms-acdc.office.com
52.98.253.146
fp2e7a.wpc.phicdn.net
192.229.221.95
identity.nel.measure.office.net
unknown
r4.res.office365.com
unknown
aadcdn.msftauth.net
unknown
login.microsoftonline.com
unknown
outlook.office365.com
unknown
There are 2 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
13.107.246.45
s-part-0017.t-0009.t-msedge.net
United States
192.168.2.4
unknown
unknown
192.168.2.6
unknown
unknown
239.255.255.250
unknown
Reserved
52.98.243.34
unknown
United States
142.250.181.228
www.google.com
United States
52.97.135.98
HHN-efz.ms-acdc.office.com
United States

DOM / HTML

URL
Malicious
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=ebcc48e2-30e8-194c-9fd2-d374bec8336e&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120717527706.4c3a699b-998b-4bd9-a2cc-7fd7ed5cae12&state=VYtLDoIwFEVB14IzSn_00QExASFxoDG6gtI-jREoAdQtuGyZOHBw7uDknjAIgvXCaiGkywSgRKYkZZwCg5QDUEWkFUZp3cRaZ00sG6djw62N4eoAXWoNMh4u7SdM_Nsk29cd35132OZnNO6A02RuuJ-x2-z7Gcce55_b5ZGwlyOczkwfCqUYV3UKBVR1WUtagNSlqKtMQsUjSf-OpDfdMDqmyTB6R_xzbr1_EOu7SOAX&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=ebcc48e2-30e8-194c-9fd2-d374bec8336e&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120717527706.4c3a699b-998b-4bd9-a2cc-7fd7ed5cae12&state=VYtLDoIwFEVB14IzSn_00QExASFxoDG6gtI-jREoAdQtuGyZOHBw7uDknjAIgvXCaiGkywSgRKYkZZwCg5QDUEWkFUZp3cRaZ00sG6djw62N4eoAXWoNMh4u7SdM_Nsk29cd35132OZnNO6A02RuuJ-x2-z7Gcce55_b5ZGwlyOczkwfCqUYV3UKBVR1WUtagNSlqKtMQsUjSf-OpDfdMDqmyTB6R_xzbr1_EOu7SOAX&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=ebcc48e2-30e8-194c-9fd2-d374bec8336e&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120717527706.4c3a699b-998b-4bd9-a2cc-7fd7ed5cae12&state=VYtLDoIwFEVB14IzSn_00QExASFxoDG6gtI-jREoAdQtuGyZOHBw7uDknjAIgvXCaiGkywSgRKYkZZwCg5QDUEWkFUZp3cRaZ00sG6djw62N4eoAXWoNMh4u7SdM_Nsk29cd35132OZnNO6A02RuuJ-x2-z7Gcce55_b5ZGwlyOczkwfCqUYV3UKBVR1WUtagNSlqKtMQsUjSf-OpDfdMDqmyTB6R_xzbr1_EOu7SOAX&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=ebcc48e2-30e8-194c-9fd2-d374bec8336e&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120717527706.4c3a699b-998b-4bd9-a2cc-7fd7ed5cae12&state=VYtLDoIwFEVB14IzSn_00QExASFxoDG6gtI-jREoAdQtuGyZOHBw7uDknjAIgvXCaiGkywSgRKYkZZwCg5QDUEWkFUZp3cRaZ00sG6djw62N4eoAXWoNMh4u7SdM_Nsk29cd35132OZnNO6A02RuuJ-x2-z7Gcce55_b5ZGwlyOczkwfCqUYV3UKBVR1WUtagNSlqKtMQsUjSf-OpDfdMDqmyTB6R_xzbr1_EOu7SOAX&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=ebcc48e2-30e8-194c-9fd2-d374bec8336e&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120717527706.4c3a699b-998b-4bd9-a2cc-7fd7ed5cae12&state=VYtLDoIwFEVB14IzSn_00QExASFxoDG6gtI-jREoAdQtuGyZOHBw7uDknjAIgvXCaiGkywSgRKYkZZwCg5QDUEWkFUZp3cRaZ00sG6djw62N4eoAXWoNMh4u7SdM_Nsk29cd35132OZnNO6A02RuuJ-x2-z7Gcce55_b5ZGwlyOczkwfCqUYV3UKBVR1WUtagNSlqKtMQsUjSf-OpDfdMDqmyTB6R_xzbr1_EOu7SOAX&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=bc3da322-4727-861b-5eb4-b16d3af9813b&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120984531044.ad8bde88-aa8b-46ae-826c-e1703c48a0ff&state=Dcs7FoAgDAXRoMflRALE8FxO-Nhaun0p7nQTiGhftiXIClUrMJWU5YZeJYnq6QNtTIDd0VjNJyNb55mqlK5weZ6w3iO-n8cf
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=bc3da322-4727-861b-5eb4-b16d3af9813b&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120984531044.ad8bde88-aa8b-46ae-826c-e1703c48a0ff&state=Dcs7FoAgDAXRoMflRALE8FxO-Nhaun0p7nQTiGhftiXIClUrMJWU5YZeJYnq6QNtTIDd0VjNJyNb55mqlK5weZ6w3iO-n8cf
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=bc3da322-4727-861b-5eb4-b16d3af9813b&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120984531044.ad8bde88-aa8b-46ae-826c-e1703c48a0ff&state=Dcs7FoAgDAXRoMflRALE8FxO-Nhaun0p7nQTiGhftiXIClUrMJWU5YZeJYnq6QNtTIDd0VjNJyNb55mqlK5weZ6w3iO-n8cf
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=ebcc48e2-30e8-194c-9fd2-d374bec8336e&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120717527706.4c3a699b-998b-4bd9-a2cc-7fd7ed5cae12&state=VYtLDoIwFEVB14IzSn_00QExASFxoDG6gtI-jREoAdQtuGyZOHBw7uDknjAIgvXCaiGkywSgRKYkZZwCg5QDUEWkFUZp3cRaZ00sG6djw62N4eoAXWoNMh4u7SdM_Nsk29cd35132OZnNO6A02RuuJ-x2-z7Gcce55_b5ZGwlyOczkwfCqUYV3UKBVR1WUtagNSlqKtMQsUjSf-OpDfdMDqmyTB6R_xzbr1_EOu7SOAX&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=ebcc48e2-30e8-194c-9fd2-d374bec8336e&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120717527706.4c3a699b-998b-4bd9-a2cc-7fd7ed5cae12&state=VYtLDoIwFEVB14IzSn_00QExASFxoDG6gtI-jREoAdQtuGyZOHBw7uDknjAIgvXCaiGkywSgRKYkZZwCg5QDUEWkFUZp3cRaZ00sG6djw62N4eoAXWoNMh4u7SdM_Nsk29cd35132OZnNO6A02RuuJ-x2-z7Gcce55_b5ZGwlyOczkwfCqUYV3UKBVR1WUtagNSlqKtMQsUjSf-OpDfdMDqmyTB6R_xzbr1_EOu7SOAX&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=bc3da322-4727-861b-5eb4-b16d3af9813b&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120984531044.ad8bde88-aa8b-46ae-826c-e1703c48a0ff&state=Dcs7FoAgDAXRoMflRALE8FxO-Nhaun0p7nQTiGhftiXIClUrMJWU5YZeJYnq6QNtTIDd0VjNJyNb55mqlK5weZ6w3iO-n8cf
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=bc3da322-4727-861b-5eb4-b16d3af9813b&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638640120984531044.ad8bde88-aa8b-46ae-826c-e1703c48a0ff&state=Dcs7FoAgDAXRoMflRALE8FxO-Nhaun0p7nQTiGhftiXIClUrMJWU5YZeJYnq6QNtTIDd0VjNJyNb55mqlK5weZ6w3iO-n8cf
There are 2 hidden doms, click here to show them.