Windows Analysis Report
https://thermal48828442111.dorik.io/

ID:	1426622
Product:	CloudBasic
Start time:	12:25:36
Start date:	16.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 09:26:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	5ACF7ECD1AD83799752A5353486F82F8	97A581A3138722054AD35152AF6EDB6826ED4E1A	8CD33654BFB2C1F75EEA82B3F5C6DD246E4DE73992E1C21558EAF9FDB8F613D5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 09:26:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	80C29FABFEDF7BCEF28B94D2C5FCC691	1DA77CB3A883F8D258868C71C56546781B90021E	D82F3B510919459ADDCF752106967883A0562262C4893FC2A131A28F87D32AA1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	ECAE4A2605192F89E318BA938F2757FC	98D86D53BA517ECF34D5745A7607E37F8FA57B0A	4D9172CD09D256B7B25F66FA3C0B3E532A5A172CE9D5231FC4D753927E80E6BB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 09:26:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A862F68419D108A8424C77DA79BC31DD	72D7BCA21D67A44D266D1AC3F4FC7CCEC46A0253	AF813F6726108F51818F84C2FF1B527133478FB756753DDE2B23259715A3E16A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 09:26:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	F29EAFD45D26FD9EF7555B4D95071265	25078AE8AB03DEBD027261CB62D1A0041A7209AD	2F72011A1C6ED058C6B65FC4034E800E197313862C96B5B1DDB1D8DECEAED7CB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 09:26:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0255DBA5272E047F46ED2EC06B7FEEB6	2BD7AEBA4288D184CEB866BC843B08D2F6D1484D	0937E0E386B58FBD6157495AA9F2495A914AE925CF4D6BDA75D729616E5EFC00
Chrome Cache Entry: 102	ASCII text, with very long lines (64616)	C6D3D10C4CB71219407698EEF8087BAB	3240590749D7276B00DCF485B72FA78F4F7F3D2E	F142A844212962C2D1A2CE2ED38B74D60063B52FBF92BAC48FA3C8979E2E6052
Chrome Cache Entry: 103	Web Open Font Format (Version 2), TrueType, length 75532, version 1.0	0BEF0D43A3921B965A2F986950F8112B	169E84402D3DE4640F8B77F9A80F226426CC36FC	FD8DE0D24780F0FEA766715F9BF54EE68D929DED62493DEFF71CF87C1A377F03
Chrome Cache Entry: 104	Web Open Font Format (Version 2), TrueType, length 23564, version 1.0	EC7AA7073A767F310A406F4B770915EC	697254718422A3040F31EB998BFEF0A91C0AC4F3	80303D7FBA1A41C684F1E6D5DCB015BF6E087DFBE45F8D9D8F38972E84ADC174
Chrome Cache Entry: 105	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
Chrome Cache Entry: 107	RIFF (little-endian) data, Web/P image	20DC17476D860F6BDEF713067C13A773	BD39BC6C879F88A684690AE5095A9179CDC83769	43565271496786AF88857D689237246A79ED7ECE0A1E94F7B730F122A42BD5CB
Chrome Cache Entry: 108	HTML document, ASCII text, with very long lines (762)	24A50AC64AA9CF47C48BE8F07C513E44	AA518031911D6121EF05247F3BF4278E534BA523	A5332C50ECC82457574290155AC9F2BF2A6912F02F69D665167D3C8479EE5DEA
Chrome Cache Entry: 109	ASCII text, with very long lines (61177)	D62B4EDEB512B07ABEF4688E27ECDDE3	981A7825DA5E29938AB6FE0CBFE2DB622F7B8333	4B01A0A34CE8ED4BC8A8713BE0442D49DA6A756236B7B4424622CA3DEE820F41
Chrome Cache Entry: 110	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 112	ASCII text, with very long lines (38708), with no line terminators	A537D3192825D559F5027A51F2E7EAEE	C0F340021CB05E12204A68A7BCBF1C1907078363	C99C45F5DF1E0D08388F368866DE25B23A3E33FE7C2D78356A0D3746C665EDE3
Chrome Cache Entry: 113	Web Open Font Format (Version 2), TrueType, length 39372, version 1.0	E4FFE70CF1F9923C96E83B3C3DFA2CE8	EF3BFE812369BD73E1B129C2FCE37AA91F879E15	E357B02137741B5640A01EB60531CC5B9F1AD6AF0797ABD26D34249073FB11B2
Chrome Cache Entry: 81	Web Open Font Format (Version 2), TrueType, length 36772, version 1.0	BCA21FE1983E7D9137EF6E68E05F3AEE	CD18280BFA37A4C44D5530899FE10A249310E6EB	8905A3719FF792D3B18A7C40AE820C9FCE92782BB7696ABC29D6987EBC93CD82
Chrome Cache Entry: 82	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 83	ASCII text, with very long lines (43896)	5252837FFA272234E1CBF2D3D83EF32C	CAA4E48A54A2B1CA09327E42F24F6031FDF21CDA	DF2E852C347ECF82F70A0C8A4B91713FBB0914D58F2CBAB01316BFE646ABEE7C
Chrome Cache Entry: 84	RIFF (little-endian) data, Web/P image	91D1CB756FDB7942FF69B36D74383B6E	DA2614DEA766C6566F30357F979059A7F190ED72	239ED1154C1C7677E0F63551EF78A343E4256FFC6CDF74E10491FD7E7081014A
Chrome Cache Entry: 86	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 87	Unicode text, UTF-8 text, with very long lines (32153)	3D725DCEB242C2D99BAFE9D3267FC5F1	CF1BD2E8790F3875DDC2316EF8B055BA15447C35	33CEA1C907E3D621EAFE2BD781DF9EEE3A2A96E7CE8375B01E103D0533DB8C09
Chrome Cache Entry: 88	HTML document, Unicode text, UTF-8 text, with very long lines (1740)	91169CD6304A0B5FC5A77C2F0D4DE2E9	52B42F088E5C850BDBC5179D52FD90D76DC0094E	12F3CFC1573CD5A96D1E001150967B20D7DFC9E24D235B8D9C03B42E9479108B
Chrome Cache Entry: 90	ASCII text, with very long lines (14735)	82B3E71D28044021BF3BBA30A8B1B613	508FD0047F49E7965707F0B58708A59D6A62C528	49BD3382F2D2C171947474FC65B701DED717BF69A6E88505B84DA1D69B3C2F1E
Chrome Cache Entry: 91	Web Open Font Format (Version 2), TrueType, length 21304, version 1.0	39EE576686AC0E893E06738504B87269	2213C1C0FD85490BED28E54764B6F4FA7DD0EEEC	FA57A0C44B9B57A2F736E923B0A400FBA8BA99035B691A71C1087B15F1EEDB9E
Chrome Cache Entry: 92	ASCII text	CE7B00B61890DFD5418A8A32D995BE38	1BBCF72BC62074A43D0A65D017412F53633558C5	A6EEBF4DA0808A367E78366CC7D99E0D0ABE27DA41E092353151EC1B235A94BF
Chrome Cache Entry: 93	ASCII text, with very long lines (64612)	5B0E3778C74235B06DA49808DD8DF90A	AD25897B0870B81568412F55B19898E406CC11B3	7530B843A86F3155CE07CDA787A40DA87052664B09C22F3D4DB5E9238664DBE0
Chrome Cache Entry: 94	ASCII text, with very long lines (65451)	DC5E7F18C8D36AC1D3D4753A87C98D0A	C8E1C8B386DC5B7A9184C763C88D19A346EB3342	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
Chrome Cache Entry: 95	ASCII text, with very long lines (45563)	0A1A5BA009FB1F25E3F3D036D8CF26CE	8E9E6A11CED0807252C34DCA1D8C7C2390D1A5CA	94153F2A6DAAE35DFCB61DC987E2D4310B7CA021E36375E87D8B8C641C0C6121
Chrome Cache Entry: 96	SVG Scalable Vector Graphics image	4E48046CE74F4B89D45037C90576BFAC	4A41B3B51ED787F7B33294202DA72220C7CD2C32	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
Chrome Cache Entry: 97	ASCII text, with no line terminators	9F9FA94F28FE0DE82BC8FD039A7BDB24	6FE91F82974BD5B101782941064BCB2AFDEB17D8	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
Chrome Cache Entry: 99	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21

Phishing

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	Matcher: Template: microsoft matched with high similarity
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	Matcher: Template: microsoft matched with high similarity
Source: https://mu6x8jsy4tg4hyzku692gd69.from-il.com	Matcher: Template: microsoft matched with high similarity

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

HTTP Parser: Iframe src: https://ywnjb.mu6x8jsy4tg4hyzku692gd69.from-il.com/Me.htm?v=3

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: Number of links: 0
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: Number of links: 0

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

HTTP Parser: <input type="password" .../> found

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

HTTP Parser: No favicon

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="author".. found

Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488599852540419.MGRhYTE2NTYtYzRjMy00NjkzLWJhNTAtMTAwMTk0ZTBhYTZhYTRlNGZiMjktODY5NS00ZWI5LWEzMTktNzVjNDAzOGZmYjZl&ui_locales=en-US&mkt=en-US&client-request-id=f37cea0f-fed3-449a-bf09-ca927d6acd9d&state=-SxyTnloAyBMEyu7N26oe5mRmODzyUEtA88amp-S-MEDem4T9DbGQvtVBA9X5q-3UjtAwdUYL53NVzO2SCghDXP08DKfM_z8pKy2IZEOXkkM0UXTeSHzxzYauCps-MAsP6jssylY7Bh2ErwpzdFwgFQUDXeVOwjVf-rguEsnWIziio9nlgzq0SA6z0abIUu2JAhFuiYxqZUxw69ms2Oz-6-yDsguFAZ6muVNDQW2fuoeVXw_fiW-tX0dqTyRFNFGyyTzeFai8a_51GskDgAnGQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.mu6x8jsy4tg4hyzku692gd69.from-il.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638488600056288867.ZGNjMTgyMzItMGM5MC00NTMwLThkMWItNzAzOWVlMGNjZGI4YmVkZWZmZjQtYzZiYi00OGMwLTk2Y2UtM2FhN2I0ODFhYTlm&ui_locales=en-US&mkt=en-US&client-request-id=dff6d2c0-6c10-4705-891e-129066e42201&state=1yZl_o9ImgqYQl5Pqic8hT6XDxwXipxarKJTfEsl0P1mZCiDZdtbbkjSYQk277kVVV_10ioqHXCBQ-1sRkD9OKizoRI--xm6SyQB2W612CUmrc3V-6wRJVSGVSg-P_MsHQIUkOApXP58EI-dzAEr0OBpClLUb1MNrk_Gz6IMk7WpXyzyV3e79Tvaox3B4Kf6XsaXqWuJVTJLJ0i9rWoKwuVbr75wtzp8nFxTb5vYXVBlNRgIlUk62c7M8ubHTimiAe4U6cgy1e8vZZZP05rYtA&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="copyright".. found

Compliance

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49778 version: TLS 1.2

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.68.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: unknown

DNS traffic detected: queries for: thermal48828442111.dorik.io

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.68.63:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49778 version: TLS 1.2

System Summary

Source: classification engine

Classification label: mal60.phis.win@17/32@24/70

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://thermal48828442111.dorik.io/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1916,i,2263491761048382112,76699249405168702,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1916,i,2263491761048382112,76699249405168702,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk