Analysis Report https://www.canva.com/design/DAEOEcu9Gnc/C6LvqPRfMOYoF6OWlu9bVg/view?utm_content=DAEOEcu9Gnc&utm_campaign=designshare&utm_medium=link&utm_source=sharebutton

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://www.canva.com/design/DAEOEcu9Gnc/C6LvqPRfMOYoF6OWlu9bVg/view?utm_content=DAEOEcu9Gnc&utm_campaign=designshare&utm_medium=link&utm_source=sharebutton

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Phishing site detected (based on favicon image match)

Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish_20

Source: Yara match	File source: 473627.pages.csv, type: HTML
Source: Yara match	File source: 473627.1.links.csv, type: HTML

Yara detected HtmlPhish_35

Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ois[1].htm, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ois[1].htm, type: DROPPED

Phishing site detected (based on image similarity)

Source: https://vapdelbnbapp.firebaseapp.com/fguysvcxcd/themes/imgs/microsoft_logo.svg

Matcher: Found strong image similarity, brand: Microsoft

Jump to dropped file

Phishing site detected (based on logo template match)

Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq

Matcher: Template: microsoft matched

Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p

Matcher: Template: microsoft matched

HTML body contains low number of good links

Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	HTTP Parser: Number of links: 0
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	HTTP Parser: Number of links: 0
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	HTTP Parser: Number of links: 0
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	HTTP Parser: Number of links: 0
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: Number of links: 0
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	HTTP Parser: Title: Sign in with Office 365 does not match URL
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	HTTP Parser: Title: Sign in with Office 365 does not match URL
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	HTTP Parser: Title: Sign in with Office 365 does not match URL
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	HTTP Parser: Title: Sign in with Office 365 does not match URL
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: Title: Create account does not match URL
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: Title: Create account does not match URL

Submit button contains javascript call

Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();

META author tag missing

Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	HTTP Parser: No <meta name="author".. found
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	HTTP Parser: No <meta name="author".. found
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	HTTP Parser: No <meta name="author".. found
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	HTTP Parser: No <meta name="copyright".. found
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/Umolh1n7Zre4LrFlHAzNANn4EAJkIjpIAJQJ2a9-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-PenYufW5GJ10TL4CWplkVPjQPYhRRPu3UpBfORylr9rgqo1afqTdA8dbrthM595yI030V7c0y7J45Qhsl7jmrmZB008iRII-8tEiLm1CEIozXYyPvoAMQUjyEoOBKIybdzgJF6a2YehPPRNl9jogm8OQcHXhcmC6lqkTIdwTnA/D1710RZrrztcKgkEZ4JFqIWIPWV5jXvcqcQGJBtbA7iNk0YKz7LRuiS5wa888sf8gq	HTTP Parser: No <meta name="copyright".. found
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	HTTP Parser: No <meta name="copyright".. found
Source: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca13d25ae102#/riY01eQv887WU97FVLJpUH3nwahsbJVSKWGfN1S-@&!nMo7W9B6y82fXLE3mVQIAZOb5sgkq@!&4Z1UuNv62qmRrls3xtfOVy5pbFc&@!-ALxhpotzQX4Kno3EABjId9bKhZXdr81TPrNibSp5cetprWbvSr2wotx6wTV7UbQxXWoy8oxtr8Y75ffZCVcXCY5SHEkNm5u-5CSfWsT50XMXwKBmzDTgjftO5FWYMCKrYujcOUMofd7ZpHVGMlp5vUkBW2pkno7bpIMMZCmgbw/1LczHYZ0J6EiKvr07cnkHnbiTXBH4kslNTBLXfkemVwqzryLlzmwn1Swku1zFAFj9p	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3dbcb5f3f6-b97d-ed7b-9df9-8861d8e6ea95&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=982B2F78FD1575EA&bk=1526624084&uiflavor=web&uaid=71693e68d6ab4064b6ac1c2f53d534bb&mkt=EN-US&lc=1033&lic=1	HTTP Parser: No <meta name="copyright".. found

Networking:

Found strings which match to known social media urls

Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: <ul><li>Sources of personal data: Interactions with users</li><li>Purposes of Processing (Collection and Sharing with Third Parties): Provide our products; product improvement; product development; customer support; and help, secure, and troubleshoot</li><li>Recipients: Service providers and user-directed entities</li></ul></li></ul><p>While the bulleted list above contains the primary sources and purposes of processing for each category of personal data, we also collect personal data from the sources listed in the <a target="_blank" class="mscom-link" href="#mainpersonaldatawecollect">Personal data we collect</a> section, such as developers who create experiences through or for Microsoft products. Similarly, we process all categories of personal data for the purposes described in the <a target="_blank" class="mscom-link" href="#mainhowweusepersonaldatamodule">How we use personal data</a> section, such as meeting our legal obligations, developing our workforce, and doing research.</p><p><strong>Disclosures of personal data for business or commercial purposes</strong>. As indicated in the <a target="_blank" class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section, we share personal data with third parties for various business and commercial purposes. The primary business and commercial purposes for which we share personal data are the purposes of processing listed in the table above. However, we share all categories of personal data for the business and commercial purposes in the <a class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section.</p></span></div><div class="divModuleDescription"><span id="Header">Advertising</span><span id="navigationHeader">Advertising</span><span id="moduleName">mainadvertisingmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription"><p>Advertising allows us to provide, support, and improve some of our products. Microsoft does not use what you say in email, chat, video calls or voice mail, or your documents, photos, or other personal files to target ads to you. We use other data, detailed below, for advertising in our products and on third-party properties. For example:</p><ul><li>Microsoft may use data we collect to select and deliver some of the ads you see on Microsoft web properties, such as <a target="_blank" class="mscom-link" href="https://www.microsoft.com">Microsoft.com</a>, MSN, and Bing.</li><li>When the advertising ID is enabled in Windows 10 as part of your privacy settings, third parties can access and use the advertising ID (much the same way that websites can access and use a unique identifier stored in a cookie) to select and deliver ads in such apps.</li><li>We may share data we collect with partners, such as Verizon Media, AppNexus, or Facebook (see below), so that the ads you see in our products and their products are more r
Source: Cookies.1.dr	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: Cookies.1.dr	String found in binary or memory: c.www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: Cookies.1.dr	String found in binary or memory: c.www.linkedin.combscookie//L equals www.linkedin.com (Linkedin)
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: s <a target="_blank" class="mscom-link" href="https://www.linkedin.com/legal/privacy-policy">Privacy Policy</a>.</p></span></div><div class="divModuleDescription"><span id="Header">Search, Microsoft Edge, and artificial intelligence</span><span id="navigationHeader">Search, Microsoft Edge, and artificial intelligence</span><span id="moduleName">mainsearchaimodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription" aria-expanded="false"><p>Search and artificial intelligence products connect you with information and intelligently sense, process, and act on information equals www.linkedin.com (Linkedin)
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: s health, oral health, osteoporosis, skin health, sleep, and vision / eye care. We will also personalize ads based on custom, non-sensitive health-related interest categories as requested by advertisers.</li><li><strong>Children and advertising</strong>. We do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 16 years of age.</li><li><strong>Data retention</strong>. For personalized advertising, we retain data for no more than 13 months, unless we obtain your consent to retain the data longer.</li><li><strong>Data sharing</strong>. In some cases, we share with advertisers reports about the data we have collected on their sites or ads.</li></ul><p><strong>Data collected by other advertising companies</strong>. Advertisers sometimes include their own web beacons (or those of their other advertising partners) within their advertisements that we display, enabling them to set and read their own cookie. Additionally, Microsoft partners with third-party ad companies to help provide some of our advertising services, and we also allow other third-party ad companies to display advertisements on our sites. These third parties may place cookies on your computer and collect data about your online activities across websites or online services. These companies currently include, but are not limited to: <a target="_blank" class="mscom-link" href="https://www.appnexus.com/">AppNexus</a>, <a target="_blank" class="mscom-link" href="https://www.facebook.com/help/568137493302217">Facebook</a>, <a target="_blank" class="mscom-link" href="https://www.media.net/adchoices">Media.net</a>, <a target="_blank" class="mscom-link" href="https://my.outbrain.com/recommendations-settings/home">Outbrain</a>, <a target="_blank" class="mscom-link" href="https://www.taboola.com/privacy-policy#user-choices-and-optout">Taboola</a> and <a target="_blank" class="mscom-link" href="https://www.verizonmedia.com/policies/us/en/verizonmedia/privacy/index.html">Verizon Media</a>. Select any of the preceding links to find more information on each company's practices, including the choices it offers. Many of these companies are also members of the <a target="_blank" class="mscom-link" href="https://www.networkadvertising.org/managing/opt_out.aspx">NAI</a> or <a target="_blank" class="mscom-link" href="https://www.aboutads.info/choices/">DAA</a>, which each provide a simple way to opt out of ad targeting from participating companies.</p></span></div><div class="divModuleDescription"><span id="Header">Collection of data from children</span><span id="navigationHeader">Collection of data from children</span><span id="moduleName">maincollectionofdatafromchildrenmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription"><p>When a Microsoft product collects age, and there is an age in your jurisdiction under which parental consent or authorization is required to use the p

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.canva.com

Urls found in memory or binary data

Source: axios.min[1].js.9.dr	String found in binary or memory: http://feross.org
Source: icons[1].eot.9.dr	String found in binary or memory: http://fontello.com
Source: icons[1].eot.9.dr	String found in binary or memory: http://fontello.comiconsRegulariconsiconsVersion
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 50-f1e180[1].js.9.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.9.dr	String found in binary or memory: http://jquery.com/
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.9.dr	String found in binary or memory: http://jquery.org/license
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.9.dr	String found in binary or memory: http://knockoutjs.com/
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.9.dr	String found in binary or memory: http://opensource.org/licenses/mit-license.php)
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.9.dr	String found in binary or memory: http://sizzlejs.com/
Source: explorer.exe, 00000003.00000000.653903529.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: http://www.asp.net/ajaxlibrary/CDN.ashx.
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.9.dr	String found in binary or memory: http://www.json.org/json2.js
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: http://www.mpegla.com
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: http://www.mpegla.com).
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.9.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.669306015.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Current Session.0.dr	String found in binary or memory: https://9812343.fls.doubleclick.net
Source: Current Session.0.dr	String found in binary or memory: https://9812343.fls.doubleclick.net/activityi;dc_pre=CPXhifynlO0CFQbhuwgdo-gHww;src=9812343;type=ret
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report?s=RrI6%2F6uhRf8Bamd0EHaUo7aah9x8n8AF%2BnzkNA10dqLmwzpodG9QtLqKsz
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report?s=aW2xMiZ3RDaz89WO4lC7JHnHmA8KwPbvn2lgToL2UL%2BuOFrik%2FuuuxVGKh
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report?s=j58cTkLrSxTm%2BifGB25qLfcJ949J3J7RS44PQ%2Ft0qiSIgYwA30jMx5yas%
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report?s=v4prBolerkKeiP8s3KyQOMPHSF%2FOV8X4ERoqkDtraXTfrNWH0AcLl114zcoG
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report?s=yKTF3Tw3WsroBgCs9Rxj4V5KpFLD3NThcAIBlXbYHHfXWpC34FRp1AxKnv18dg
Source: manifest.json0.0.dr, 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: signup[1].htm.9.dr	String found in binary or memory: https://acctcdn.msauth.net
Source: signup[1].htm.9.dr	String found in binary or memory: https://acctcdn.msauth.net/converged_ux_v2_RfnRCrmapm3W_OFn994CMA2.css?v=1
Source: signup[1].htm.9.dr	String found in binary or memory: https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg)
Source: imagestore.dat.9.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2
Source: imagestore.dat.9.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2~
Source: imagestore.dat.9.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2~(
Source: signup[1].htm.9.dr	String found in binary or memory: https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Source: signup[1].htm.9.dr	String found in binary or memory: https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1
Source: signup[1].htm.9.dr	String found in binary or memory: https://acctcdn.msauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1
Source: signup[1].htm.9.dr	String found in binary or memory: https://acctcdn.msauth.net/lightweightsignuppackage_oZIcfFtGMdm_yHyDEji_8w2.js?v=1
Source: signup[1].htm.9.dr	String found in binary or memory: https://acctcdn.msauth.net/lwsignupstringscountrybirthdate_en-us_pVtahKS9WUIZdNqg1DDhHg2.js?v=1
Source: Current Session.0.dr	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/dc_pre=CPXhifynlO0CFQbhuwgdo-gHww;src=9812343;type=retar0;c
Source: Current Session.0.dr	String found in binary or memory: https://adservice.google.com
Source: Current Session.0.dr	String found in binary or memory: https://adservice.google.com/ddm/fls/i/dc_pre=CPXhifynlO0CFQbhuwgdo-gHww;src=9812343;type=retar0;cat
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://aka.ms/redeemrewards
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://aka.ms/redeemrewards).
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://aka.ms/taxservice
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://aka.ms/useterms
Source: manifest.json0.0.dr, 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: signup[1].htm.9.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/c/ms.analytics-web-2.min.js
Source: {18055A4C-2C2B-11EB-90EB-ECF4BBEA1588}.dat.8.dr	String found in binary or memory: https://candanappGHUr/lgy3xO/bsites.net/RG3aVe6
Source: {18055A4C-2C2B-11EB-90EB-ECF4BBEA1588}.dat.8.dr	String found in binary or memory: https://candanappGHUr/lgy3xO/bsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0ca1
Source: {18055A4C-2C2B-11EB-90EB-ECF4BBEA1588}.dat.8.dr	String found in binary or memory: https://candanappdevmoe.azurewebsites.ne
Source: ~DF9D51126FF4AB1D0F.TMP.8.dr	String found in binary or memory: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/
Source: ~DF9D51126FF4AB1D0F.TMP.8.dr	String found in binary or memory: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/$HTTP
Source: ~DF9D51126FF4AB1D0F.TMP.8.dr	String found in binary or memory: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/SPS
Source: {18055A4C-2C2B-11EB-90EB-ECF4BBEA1588}.dat.8.dr	String found in binary or memory: https://candanappdevmoe.azurewebsites.net/RG3aVe6N/VwsGHUr/lgy3xO/ois.php?bbre=e2925b097549ccda96f0c
Source: c4950d0815c21f68_0.0.dr, dda81cf9b0b047b1_0.0.dr, c2189956b60b2ce5_0.0.dr	String found in binary or memory: https://canva.com/
Source: 4cbfe86bb692371e_0.0.dr	String found in binary or memory: https://canva.com/$2
Source: 6726d42dc28e6fb9_0.0.dr	String found in binary or memory: https://canva.com/1
Source: 270ae0528ce28f93_0.0.dr	String found in binary or memory: https://canva.com/M
Source: bb69cd55fcfa7140_0.0.dr	String found in binary or memory: https://canva.com/U_
Source: e4115b2c93fca474_0.0.dr	String found in binary or memory: https://canva.com/h
Source: c3d256598d5af694_0.0.dr	String found in binary or memory: https://canva.com/p
Source: 56a246e5228caa4a_0.0.dr	String found in binary or memory: https://canva.com/q3
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://developer.yahoo.com/flurry/end-user-opt-out/
Source: 2a4dce63-53c8-42f1-bd1f-a68a480ec17f.tmp.1.dr, 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr, e8d153f1-2252-49dc-be36-ebde0e5a28b9.tmp.1.dr	String found in binary or memory: https://dns.google
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protectio
Source: manifest.json0.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: signup[1].htm.9.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: app[1].css.9.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: mobile-detect.min[1].js.9.dr	String found in binary or memory: https://github.com/hgoebl/mobile-detect.js
Source: manifest.json0.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: e4115b2c93fca474_0.0.dr	String found in binary or memory: https://js.appboycdn.com/web-sdk/3.0/appboy.core.min.js
Source: signup[1].htm.9.dr	String found in binary or memory: https://login.live.com
Source: 2Jmn3lA[1].htm.9.dr	String found in binary or memory: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&vv=1600
Source: 39oebGZ[1].htm.9.dr	String found in binary or memory: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&vv=1600
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://login.skype.com/login
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://mixer.com/about/tos
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://mixer.com/contact
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://mixpanel.com/optout
Source: lodash.min[1].js.9.dr	String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://ondemand.webtrends.com/support/optout.asp
Source: manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://priv-policy.imrworldwide.com/priv/browser/us/en/optout.html
Source: {18055A4C-2C2B-11EB-90EB-ECF4BBEA1588}.dat.8.dr	String found in binary or memory: https://privacy.micros
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 000003.log2.0.dr	String found in binary or memory: https://sdk.iad-01.braze.com/api/v3
Source: imagestore.dat.9.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6669.4/content/images/favicon_a.ico
Source: imagestore.dat.9.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6669.4/content/images/favicon_a.ico~
Source: imagestore.dat.9.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6669.4/content/images/favicon_a.ico~(
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://signin.kissmetrics.com/privacy/#controls
Source: {18055A4C-2C2B-11EB-90EB-ECF4BBEA1588}.dat.8.dr	String found in binary or memory: https://signup.live.co
Source: ~DF9D51126FF4AB1D0F.TMP.8.dr	String found in binary or memory: https://signup.live.com/
Source: signup[1].htm.9.dr	String found in binary or memory: https://signup.live.com/error.aspx?errcode=1045&mkt=en-US
Source: ~DF9D51126FF4AB1D0F.TMP.8.dr	String found in binary or memory: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1526624083&rver=6.7.6640.0&wp=MBI_SSL&wrepl
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://skype.com/go/myaccount
Source: 5e83b9cfa3f81ad1_0.0.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: Favicons.0.dr	String found in binary or memory: https://static.canva.com/static/images/favicon.ico
Source: d0b48746d2734b6a_0.0.dr	String found in binary or memory: https://static.canva.com/static/lib/cl/cl-0.4.1.min.js
Source: c4950d0815c21f68_0.0.dr	String found in binary or memory: https://static.canva.com/static/lib/sentry/5.15.4.min.js
Source: 56a246e5228caa4a_0.0.dr	String found in binary or memory: https://static.canva.com/web/169aab431c6d134d2e5b.2.js
Source: e3511df7a5a5c326_0.0.dr	String found in binary or memory: https://static.canva.com/web/292bbecde0fce6ffe18847a12c9a6dc6.2.runtime.js
Source: b21148925dccb19e_0.0.dr	String found in binary or memory: https://static.canva.com/web/36db7dd680be1e933b01f9539cc51480.2.js
Source: bb69cd55fcfa7140_0.0.dr	String found in binary or memory: https://static.canva.com/web/3ad8884d65b676ef0625a45577e2cc20.2.js
Source: be13fec43ec95b31_0.0.dr	String found in binary or memory: https://static.canva.com/web/a8284a82e57c7d67d5e3.2.js
Source: 4cbfe86bb692371e_0.0.dr	String found in binary or memory: https://static.canva.com/web/b144f4025476bd90a66e5378b1d15df650125aed.strings.js
Source: dda81cf9b0b047b1_0.0.dr	String found in binary or memory: https://static.canva.com/web/cb08f5718bdf9fb49247.2.js
Source: messages.json41.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://support.xbox.com/help/friends-social-activity/community/use-safety-settings
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://tools.google.com/dlpage/gaoptout
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.aboutads.info/
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.acuityads.com/opt-out/
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.adjust.com/opt-out/
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.adr.org
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.appnexus.com/
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.appsflyer.com/optout
Source: 000003.log3.0.dr, Current Session.0.dr	String found in binary or memory: https://www.canva.com
Source: QuotaManager.0.dr	String found in binary or memory: https://www.canva.com/
Source: History.0.dr	String found in binary or memory: https://www.canva.com/design/DAEOEcu9Gnc/C6LvqPRfMOYoF6OWlu9bVg/view?utm_content=DAEOEcu9Gnc&utm_cam
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.clicktale.net/disable.html
Source: c3d256598d5af694_0.0.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 6726d42dc28e6fb9_0.0.dr	String found in binary or memory: https://www.google-analytics.com/plugins/ua/ec.js
Source: manifest.json0.0.dr, 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.google.com/intl/en_ALL/help/terms_maps.html
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com;
Source: 7f6bd7aed19fc99b_0.0.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/804757079/?random=1605984900626&cv=9&fst=16059849
Source: 270ae0528ce28f93_0.0.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion_async.js
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: eba1480a166263c9_0.0.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-TZPTKRR&l=dataLayer
Source: 13f18794-7164-4700-be87-b9da15fd8ee6.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.gstatic.com;
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.here.com/)
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.linkedin.com/legal/privacy-policy
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html
Source: {18055A4C-2C2B-11EB-90EB-ECF4BBEA1588}.dat.8.dr	String found in binary or memory: https://www.microsoft.
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.optimizely.com/legal/opt-out/
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.privacyshield.gov/welcome
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.skype.com
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.skype.com).
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.skype.com/go/allrates
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.skype.com/go/legal
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.skype.com/go/legal.broadcast
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.skype.com/go/store.reactivate.credit
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.skype.com/go/ustax
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.xbox.com
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.xbox.com/
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.xbox.com/Legal/ThirdPartyDataSharing
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.xbox.com/en-US/Legal/CodeOfConduct
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.xbox.com/en-US/Legal/CodeOfConduct)
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.xbox.com/managedatacollection
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios
Source: servicesagreement[1].htm.9.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios)
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.youradchoices.ca
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.youradchoices.ca/fr
Source: PrivacyStatement[1].htm.9.dr	String found in binary or memory: https://www.youronlinechoices.com/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

System Summary:

Classification label

Source: classification engine

Classification label: mal88.phis.win@36/273@32/22

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FB96280-1A4C.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\e8910868-be4c-442d-82c3-5e812f5359eb.tmp

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

SQL strings found in memory and binary data

Source: QuotaManager.0.dr

Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --force-renderer-accessibility 'https://www.canva.com/design/DAEOEcu9Gnc/C6LvqPRfMOYoF6OWlu9bVg/view?utm_content=DAEOEcu9Gnc&utm_campaign=designshare&utm_medium=link&utm_source=sharebutton'
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,11732546741858598205,15005368519812649130,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1752 /prefetch:8
Source: unknown	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{49F171DD-B51A-40D3-9A6C-52D674CC729D}
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:8120 CREDAT:17410 /prefetch:2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,11732546741858598205,15005368519812649130,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1752 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:8120 CREDAT:17410 /prefetch:2			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.663965188.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.663965188.0000000005A00000.00000002.00000001.sdmp

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000003.00000000.668976027.000000000A897000.00000004.00000001.sdmp	Binary or memory string: 700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA~
Source: explorer.exe, 00000003.00000000.668114684.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.663320325.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.664618097.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.668114684.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.660981778.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000003.00000000.668782858.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000003.00000000.663320325.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.663320325.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.668832231.000000000A782000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000003.00000000.663320325.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000003.00000000.653036555.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000003.00000000.653268091.0000000001080000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000000.664605514.0000000005E50000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.653268091.0000000001080000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.653268091.0000000001080000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000003.00000000.668782858.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D