Analysis Report https://ch1.amorozon.fr/.zz?&78387439&user=jon.parr@syngenta.com

ID:	323890
Product:	CloudBasic
Start time:	18:43:43
Start date:	27.11.2020
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{32E83693-30D8-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	C50540A8CBDE2B3056E0640B4C7DBAB4	E3249891019C6327668F0971EA8ECADE12417EF8	4C96B35ED9C6C30A488D8B5E78FF5E125CA107B0A9F6158698359AE34C18E091
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	273B171863B63E56A3C1BB1506B584E9	1E96893BD9CC11E54D55AC9A3462FC7D37B95384	F7C81AB646F8C8C1408D30498AEAB104CE0AABC7EB81AFB7868BA94EFCEE712A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{39B7F450-30D8-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	BFA28C9CBF9B756E2829EAFA01F1B0C4	DA1AD7600D89AF0295BD6AA4EBC056FE21A9AD4D	C013D5069510090187489F7A065BCFD3E4D828EA4E99EEFC3C24D30CB97F336D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	AEDB27E50A569ECEF139C8EC426B9358	CB8E1E84871849B4F3D8CCA589C8137C64ACF032	346B0F01A5E46F20926CDCEFCB9004BD42D30BC55B86DD37B04949F1BF6D4D1C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\.zz[1].htm	HTML document, ASCII text	4BF08189C7D046F5A300A92AF1FE1FA1	5342287176AB7AE5A05505BAF317C8697845F78E	477ED2868A0933304922E8FC358EC2C5F15B8A146F7ADAE5F794998EA7E47412
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\0-small_138bcee624fa04ef9b75e86211a9fe0d[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x28, frames 3	138BCEE624FA04EF9B75E86211A9FE0D	23BBCDAAEBD6C9A6E57E96E44493B2212860FCAB	F89E908280791803BBF1F33B596FF4A2179B355A8E15AD02EBAA2B1DA11127EA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Mic_BG[1].jpg	JPEG image data, baseline, precision 8, 1920x1080, frames 3	A5DBD4393FF6A725C7E62B61DF7E72F0	55B292F885FFC92ABCE18750B07AA4ACFA4E903E	211A907DE2DA0FF4A0E90917AC8054E2F35C351180977550C26E51B4909F2BEB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2[1].js	ASCII text, with very long lines	87EFFB0BB533C1D79F5C94FD9E30C14D	4E4F5F3CDDDDBFDDB46A1626D7CE579A639DE389	617E32CA57507098771FD30AF6B9DCAB063448F6D7E0BC6D6557DD1895F80543
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-1.11.2.min[1].js	ASCII text, with very long lines	5790EAD7AD3BA27397AEDFA3D263B867	8130544C215FE5D1EC081D83461BF4A711E74882	2ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\override[1].css	ASCII text, with very long lines, with CRLF line terminators	A570448F8E33150F5737B9A57B6D889A	860949A95B7598B394AA255FE06F530C3DA24E4E	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\privacystatement[1].htm	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	509688B04A70E1C2F73F1B81571A0E2D	29A176F9F6B61B390028617CD49C1D4D066EBBA8	D76E5ACD2B006F77AEFEDFB28BD4314D5F38105189D023D38B2091879B684CA5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sc_login[1].js	ASCII text, with very long lines, with CRLF line terminators	068E08AE27B53324210F0C184C38EE92	5CF9CF9B9C8347ECB1301597BAB48B417ECB917C	E06121FCFC1AFC352CA8F0699BACDF5BF80753A26E8B6161C369C298F619104B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\script[1].js	ASCII text, with very long lines, with no line terminators	F620D4D38655075DF3268D640BF479BD	79BEBF5E6907D4CDD5764B9B9CF3A72932F9C343	7E1377CD02DAFE245ED719FCA972C5E8CFDE30CBF3910D2795A922BB466D08C2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\style[1].css	ASCII text, with very long lines, with no line terminators	2AC383F4677A1036C8EA4289F99A31E3	E65967B9273029CDDD5A5F8DF9E61DACF89CF11C	2206A95E6BAC7C185CC54638EBF0B0089CBC27FF729B45AC63C968CFE4991AA4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\2_vD0yppaJX3jBnfbHF1hqXQ2[2].svg	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\908da3c8f209ef75ffb734f6652bf849[1].htm	HTML document, ASCII text	23594ADFC6A359433487211E766F7093	322C24C180281FFE5DDE2D349CFFF12DFD15EBC7	67FA1FEFE87E627B77A356238C5BFDCC7C129FCEFC2DACC86AA3D85D0E503BA0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\RE1Mu3b[1].png	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced	9F14C20150A003D7CE4DE57C298F0FBA	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\css[1].css	assembler source, ASCII text, with very long lines, with CRLF line terminators	6852C58FB13F87B104D761AE120362FD	C06CB9518C54409C95BE46C5516FCF63F892F43F	78190EBFE2AD7E33798D786F714F41E02074B0E593A1AA53C0DED17657623227
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js	UTF-8 Unicode text, with very long lines	E55ECB02E7376CD010C764107EBD513F	FA6D184DF01EC535628DC8FAF38211591BAADFC8	5776881753B95A0ABE5D1F6EFE3ABE7B83A3265EACCD117DD948E523C044600C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[1].eot	Embedded OpenType (EOT), Segoe UI Semibold family	E812BA8B7E2A657F2B70CFACE93C7682	2F02CDDBB483F9B11BBBE74C3CA917A4C345FBAD	3330C1DEAC468874238DD0C6BF902179A8731EDA8A208C7D01DAC0AB1EAE1BC9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[2].eot	Embedded OpenType (EOT), Segoe UI family	CAD76E4816AF6890C9BFD02A6D1EA899	9EDC91541C31034FCE0D83AABBAAD4C314CD3D33	D5794223D1A062E5DBE6C34C1994C8CE3792B24AFD5218D0644CB1F53DA4BE58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[3].eot	Embedded OpenType (EOT), Segoe UI Light family	17DFE73CB9C64527F7248B0A24DB317D	345198B9239FCDAF038FB2D3A919E4724037DBAA	AD75FB92B2EBCE6C37640F03E1AB96A752F388BCE60C877ADE4780B13839E8C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\segring[1].htm	HTML document, UTF-8 Unicode text, with very long lines	C78E194A10BF6821B9EB076BA9C4625D	2BF7FEB5069F57C139A20ABC2839A4A2D05F9840	9A7D1BBF11CDFFBAC6F21292D56E6D8F4EC393B0B30989576A096E86A7DE6F68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\signup[1].htm	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators	EFA1D5454EEF7A6378FD30E788065E46	25997E94D28159047FB15B4CB283D7A41C9D5C65	D26EE3A000607295FD7527ADB598A9DB9E1B4D721097D8A328C37B2BD9DD1506
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\16-a6d48e[1].css	UTF-8 Unicode text, with very long lines	14118726CE8B08543CCC8AB2E04DC562	EFE07C71414808B69E2AE164B7F27318CDE1E7F1	61F8827DF1C97E9A83B029B0D82CA425892D4F42CFA750016A932D7E86EB0B29
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\50-f1e180[1].js	ASCII text, with very long lines	0405301724624162B6706F1AB465531F	1C034383716BCE493E28BFFF0DD2C27F049CC558	A5DD3C05EFED81BBF60B618C070A7746F030147590EE0EDD74459AC4E53955FD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\app[1].css	ASCII text, with very long lines, with CRLF, LF line terminators	7C593B06759DB6D01614729D206738D6	0D4F76D10944933B8DDECFFE9691081439A77A3C	F7D9FB0479DE843CF3FB0B78FC56BBB9E30BF0A238C6F79D9209FA8B22EFB574
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410[1].svg	SVG Scalable Vector Graphics image	A9CC2824EF3517B6C4160DCF8FF7D410	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\dropdown_caret_KXSZjGsyILZaoTf0sI9X-A2[1].svg	SVG Scalable Vector Graphics image	2974998C6B3220B65AA137F4B08F57F8	F4F08DA689179DE68EE40CD12ECDCC5AC54B3979	96D52BD03E244A44931A541A807067792D638DD29EC14A87A78F2BE85D12D19A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c[1].svg	SVG Scalable Vector Graphics image	2B5D393DB04A5E6E1F739CB266E65B4C	6A435DF5CAC3D58CCAD655FE022CCF3DD4B9B721	16C3F6531D0FA5B4D16E82ABF066233B2A9F284C068C663699313C09F5E8D6E6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73[1].svg	SVG Scalable Vector Graphics image	5AC590EE72BFE06A7CECFD75B588AD73	DDA2CB89A241BC424746D8CF2A22A35535094611	6075736EA9C281D69C4A3D78FF97BB61B9416A5809919BABE5A0C5596F99AAEA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\oneds_Xr2D7Nex80v7A-8bxF8jgQ2[1].js	ASCII text, with very long lines, with CRLF, LF line terminators	5EBD83ECD7B1F34BFB03EF1BC45F2381	CD1E0062A04B11EEB36586766BF5144955250E65	4C57821AA26F21DEEBC39E3C750BC4FE246C430E5E50F4ADD0CFF53943C8C608
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\shell.min[1].css	UTF-8 Unicode text, with very long lines, with no line terminators	1F9995AB937AC429A73364B4390FF6E8	81998DCC6407CEB5CEF236AD52B9F2A3A9528D3B	49E5166F40D8586714F86E08AB76A977199DF979357147A0E81980A804151C2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\908da3c8f209ef75ffb734f6652bf849[1].htm	HTML document, ASCII text	99B4ADACF4D2463DAF895CD8668EAA7E	CE4D8B7CDB51EACD424CE2D6C79B678923D9FD1E	46F6E409016BA347A476F4F46F9CA382C52E22ACA12A296111E1D5236DA633E9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\converged_ux_v2_RfnRCrmapm3W_OFn994CMA2[1].css	ASCII text, with very long lines	45F9D10AB99AA66DD6FCE167F7DE0230	D443993E7ADB3108167BCD94E5D3126A2E3EE7EE	D72952FC8950D26C08C6BAD73D389C35D0EAF164CB73503183A2966DEFAAD991
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\icons[1].eot	Embedded OpenType (EOT), icons family	77E1987DF3A0274C5A51E3C55CEE7C98	9B0FE96AF141AB09183F386F65BC627B8C396460	EF04649D4D068673CF0FA47EF4C45C8BE291E703F4EC5FC0E507F17839120AA2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\jquery.min[1].js	ASCII text, with very long lines	E40EC2161FE7993196F23C8A07346306	AFB90752E0A90C24B7F724FACA86C5F3D15D1178	874706B2B1311A0719B5267F7D1CF803057E367E94AE1FF7BF78C5450D30F5D4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js	ASCII text, with very long lines, with CRLF, LF line terminators	5F50584B68D931B8BB85F523F15BAA14	FAF4BD348F40016BCE0ABF54F167C7923B303ABB	3C829DCF48768082A6177B77AE4E499337ED4C8BD056705CDB1E979F7B6EFCE5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\lightweightsignuppackage_oZIcfFtGMdm_yHyDEji_8w2[1].js	UTF-8 Unicode text, with very long lines	A1921C7C5B4631D9BFC87C831238BFF3	EDC924AF3FB85C030002885B8477FAE5BA76480C	8BE695914CB1309017E5CBFEC706ABA98EFEA6E0EE9E65CC43F124CCABD5960A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\lwsignupstringscountrybirthdate_en-us_pVtahKS9WUIZdNqg1DDhHg2[1].js	HTML document, UTF-8 Unicode text, with very long lines	A55B5A84A4BD59421974DAA0D430E11E	09926A2D8BBFA41C3085BCF8A546AEAD3FB8C0FC	FC6D389E166EBA3F121C4A92F446C1C36997D770862F4D6994192CE1AD4A1051
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\print-icon[1].png	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced	023F5AC6E0114AF1F781BE5D3C956385	C166284B8541F1DE32DC5C4DEC635C296BF85C98	75D637BF6B6DFF2525095D0BE7E0C90F012BB118C2EF19099AFDCBC630ADFC79
C:\Users\user\AppData\Local\Temp\~DF4D88143B5EF30894.TMP	data	41C9DEE29EF2A6D5CB981EBAC569B9F8	FF966DCF44D8CAE99A5D48506C500201CA08AA5A	D493C6D9E38384455AB1BFB626BC07AF31DAB9B061751E6E04C7FFD8D05B7979
C:\Users\user\AppData\Local\Temp\~DF61A1327D3F69D777.TMP	data	11E4EE501E8BC6AAB721153235529266	5AC7C5B34FD339BC05CE99194DA5C0863CAC4A59	504F3EA7B7396BAF5E08004D4B5261DD89FF4E506F40E8076D6B89C3BEFB7EB8
C:\Users\user\AppData\Local\Temp\~DF7977F7404D051671.TMP	data	3F27201CFEF77CEEF91A705F7D37F886	887711FB7B34DD6825912CC6706D38773881D9DE	9D15191984C76C6FCE9443769EFAF64220AF9690A7BEFB814EA7160CC92FEC67

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://ch1.amorozon.fr/.zz?&78387439&user=jon.parr@syngenta.com

UrlScan: detection malicious, Label: phishing brand: microsoft

Perma Link

Antivirus detection for URL or domain

Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Phishing site detected (based on favicon image match)

Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish_10

Source: Yara match	File source: 942247.0.links.csv, type: HTML
Source: Yara match	File source: 942247.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\segring[1].htm, type: DROPPED

Phishing site detected (based on image similarity)

Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/include/src/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	Matcher: Found strong image similarity, brand: Microsoft			Jump to dropped file
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/include/src/Mic_BG.jpg	Matcher: Found strong image similarity, brand: Microsoft			Jump to dropped file

HTML body contains low number of good links

Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: Number of links: 0
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: Number of links: 0
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: Number of links: 0
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: Number of links: 0
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: Number of links: 0
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: Title: Create account does not match URL
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: Title: Create account does not match URL
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: Title: Sign in to your account does not match URL

Invalid 'forgot password' link found

Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: Invalid link: Forgot my password
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: Invalid link: Forgot my password
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: Invalid link: Forgot my password
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: Invalid link: Forgot my password

Invalid T&C link found

Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: Invalid link: Terms of use
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: Invalid link: Terms of use
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: Invalid link: Terms of use
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: Invalid link: Terms of use

Submit button contains javascript call

Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();

URL contains potential PII (phishing indication)

Source: https://ch1.amorozon.fr/.zz?&78387439&user=jon.parr@syngenta.com

Sample URL: PII: jon.parr@syngenta.com

META author tag missing

Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: No <meta name="author".. found
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: No <meta name="author".. found
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: No <meta name="author".. found
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: No <meta name="author".. found
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAXVSPW_TUADMS9rQVAiqCgkWRAfEgOT42S-240gVavPROk3s5tNxlshxnMRx_OzYr7HsjY2xE0gZGGBA6sgELOydOvcXICbUCSSQSNlZbri74XR3z1NMlik8zaEcpwtDkRJ1HlE5kYGUnmN5CnGIRyxkRhxE_u72zpP56_nv9GP5Tevl5-DrnxcrkBnMraWZNVznAjycEuIFBZoOwzDrjseW8U-gPwFwBcA3AFbJTRNTndZFMuARL7ICQqKQzwl5huHZrKxWLKXUteV2mcglA8kRhFrctGrtCac5daLNunZ_1rS1uIzkkhT1VS2qtxuh7Kz97JqzIFSO6lytPbe1WZ3IR41YjitTWW3O-qUOvE7eVw7OyJS9Bde3YvMmmRm7vjPw3ICsUh-A4plYGhVdjE2DZG9tJiaWoRPLxae-65k-scxgv1sblnS1s_D5PF8kRWPYOun5Esc2Wlg-XjJzL6ZqC7w8VYxpjI6lw2V1MfHqZ4I9HWgN2zxWqlK8mGHKODNweOJo1ajnTxpmxPtlUlJqnZHl2-64q2oBqjUbJyE6jQ4HXfZAHBUVP6pQH1Ppda2Oiy9T99ahsDXa83x3bM3Nqw3wfeMuTBW2trZ3Eo8Se4mfG-Dd5nq5VP3X4Fm8W35v47c3sZC43KTbeUGhXaZChx5L94YLL2BYWirrejevdnhabQei5AiBaArlfbbAnKfBeTr9Iw1e3Ul8yfxv6-vtB-u_iBTkKMjvMbAA-QLi-n8B0%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d4345a7b9-9a63-4910-a426-35363201d503%26mkt%3den-US%26uaid%3d6c966c1f06fc4e1d975381b973bffd3f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=6c966c1f06fc4e1d975381b973bffd3f&suc=4345a7b9-9a63-4910-a426-35363201d503&lic=1	HTTP Parser: No <meta name="copyright".. found
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: No <meta name="copyright".. found
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#	HTTP Parser: No <meta name="copyright".. found
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: No <meta name="copyright".. found
Source: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain.com/owa/#path=/mail	HTTP Parser: No <meta name="copyright".. found

Networking:

Found strings which match to known social media urls

Source: privacystatement[1].htm.2.dr	String found in binary or memory: <ul><li>Sources of personal data: Interactions with users</li><li>Purposes of Processing (Collection and Sharing with Third Parties): Provide our products; product improvement; product development; customer support; and help, secure, and troubleshoot</li><li>Recipients: Service providers and user-directed entities</li></ul></li></ul><p>While the bulleted list above contains the primary sources and purposes of processing for each category of personal data, we also collect personal data from the sources listed in the <a target="_blank" class="mscom-link" href="#mainpersonaldatawecollect">Personal data we collect</a> section, such as developers who create experiences through or for Microsoft products. Similarly, we process all categories of personal data for the purposes described in the <a target="_blank" class="mscom-link" href="#mainhowweusepersonaldatamodule">How we use personal data</a> section, such as meeting our legal obligations, developing our workforce, and doing research.</p><p><strong>Disclosures of personal data for business or commercial purposes</strong>. As indicated in the <a target="_blank" class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section, we share personal data with third parties for various business and commercial purposes. The primary business and commercial purposes for which we share personal data are the purposes of processing listed in the table above. However, we share all categories of personal data for the business and commercial purposes in the <a class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section.</p></span></div><div class="divModuleDescription"><span id="Header">Advertising</span><span id="navigationHeader">Advertising</span><span id="moduleName">mainadvertisingmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription"><p>Advertising allows us to provide, support, and improve some of our products. Microsoft does not use what you say in email, chat, video calls or voice mail, or your documents, photos, or other personal files to target ads to you. We use other data, detailed below, for advertising in our products and on third-party properties. For example:</p><ul><li>Microsoft may use data we collect to select and deliver some of the ads you see on Microsoft web properties, such as <a target="_blank" class="mscom-link" href="https://www.microsoft.com">Microsoft.com</a>, MSN, and Bing.</li><li>When the advertising ID is enabled in Windows 10 as part of your privacy settings, third parties can access and use the advertising ID (much the same way that websites can access and use a unique identifier stored in a cookie) to select and deliver ads in such apps.</li><li>We may share data we collect with partners, such as Verizon Media, AppNexus, or Facebook (see below), so that the ads you see in our products and their products are more r
Source: privacystatement[1].htm.2.dr	String found in binary or memory: s <a target="_blank" class="mscom-link" href="https://www.linkedin.com/legal/privacy-policy">Privacy Policy</a>.</p></span></div><div class="divModuleDescription"><span id="Header">Search, Microsoft Edge, and artificial intelligence</span><span id="navigationHeader">Search, Microsoft Edge, and artificial intelligence</span><span id="moduleName">mainsearchaimodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription" aria-expanded="false"><p>Search and artificial intelligence products connect you with information and intelligently sense, process, and act on information equals www.linkedin.com (Linkedin)
Source: privacystatement[1].htm.2.dr	String found in binary or memory: s health, oral health, osteoporosis, skin health, sleep, and vision / eye care. We will also personalize ads based on custom, non-sensitive health-related interest categories as requested by advertisers.</li><li><strong>Children and advertising</strong>. We do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 16 years of age.</li><li><strong>Data retention</strong>. For personalized advertising, we retain data for no more than 13 months, unless we obtain your consent to retain the data longer.</li><li><strong>Data sharing</strong>. In some cases, we share with advertisers reports about the data we have collected on their sites or ads.</li></ul><p><strong>Data collected by other advertising companies</strong>. Advertisers sometimes include their own web beacons (or those of their other advertising partners) within their advertisements that we display, enabling them to set and read their own cookie. Additionally, Microsoft partners with third-party ad companies to help provide some of our advertising services, and we also allow other third-party ad companies to display advertisements on our sites. These third parties may place cookies on your computer and collect data about your online activities across websites or online services. These companies currently include, but are not limited to: <a target="_blank" class="mscom-link" href="https://www.appnexus.com/">AppNexus</a>, <a target="_blank" class="mscom-link" href="https://www.facebook.com/help/568137493302217">Facebook</a>, <a target="_blank" class="mscom-link" href="https://www.media.net/adchoices">Media.net</a>, <a target="_blank" class="mscom-link" href="https://my.outbrain.com/recommendations-settings/home">Outbrain</a>, <a target="_blank" class="mscom-link" href="https://www.taboola.com/privacy-policy#user-choices-and-optout">Taboola</a> and <a target="_blank" class="mscom-link" href="https://www.verizonmedia.com/policies/us/en/verizonmedia/privacy/index.html">Verizon Media</a>. Select any of the preceding links to find more information on each company's practices, including the choices it offers. Many of these companies are also members of the <a target="_blank" class="mscom-link" href="https://www.networkadvertising.org/managing/opt_out.aspx">NAI</a> or <a target="_blank" class="mscom-link" href="https://www.aboutads.info/choices/">DAA</a>, which each provide a simple way to opt out of ad targeting from participating companies.</p></span></div><div class="divModuleDescription"><span id="Header">Collection of data from children</span><span id="navigationHeader">Collection of data from children</span><span id="moduleName">maincollectionofdatafromchildrenmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription"><p>When a Microsoft product collects age, and there is an age in your jurisdiction under which parental consent or authorization is required to use the p

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: ch1.amorozon.fr

Urls found in memory or binary data

Source: icons[1].eot.2.dr	String found in binary or memory: http://fontello.com
Source: icons[1].eot.2.dr	String found in binary or memory: http://fontello.comiconsRegulariconsiconsVersion
Source: 50-f1e180[1].js.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.2.dr	String found in binary or memory: http://jquery.com/
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.2.dr	String found in binary or memory: http://jquery.org/license
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/mit-license.php)
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: http://www.asp.net/ajaxlibrary/CDN.ashx.
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: segring[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Source: segring[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_grey_5bc252567ef56db648207d9c36a9d004.png
Source: segring[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.pn
Source: segring[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.sv
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/converged_ux_v2_RfnRCrmapm3W_OFn994CMA2.css?v=1
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg)
Source: imagestore.dat.2.dr, signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2
Source: imagestore.dat.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2~
Source: imagestore.dat.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2~(
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/lightweightsignuppackage_oZIcfFtGMdm_yHyDEji_8w2.js?v=1
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/lwsignupstringscountrybirthdate_en-us_pVtahKS9WUIZdNqg1DDhHg2.js?v=1
Source: segring[1].htm.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://autodiscover.domain.com/owa/
Source: 908da3c8f209ef75ffb734f6652bf849[1].htm0.2.dr	String found in binary or memory: https://autodiscover.domain.com/owa/#path=/mail
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://autodiscover.domain.com/owa/#th=/maRoot
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://autodiscover.domain.com/owa/#th=/mail
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://autodiscover.domain.com/owa/#th=/maode%26client_id%3d51483342-085c-
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://autodiscover.domain.com/owa/$
Source: signup[1].htm.2.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/c/ms.analytics-web-2.min.js
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://ch1.amorozon.f
Source: 908da3c8f209ef75ffb734f6652bf849[1].htm.2.dr, ~DF7977F7404D051671.TMP.1.dr	String found in binary or memory: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/Root
Source: imagestore.dat.2.dr	String found in binary or memory: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/include/src/favicon_a_eupayfgghqiai7k9s
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/r/.zz/908da3c8f209ef75ffb734f6652bf849/
Source: ~DF7977F7404D051671.TMP.1.dr	String found in binary or memory: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://autodiscover.domain
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://ch1.amorozon.fr/.zz/908da3c8f209ef75ffb734f6652bf849/segring.php?https://m_post%26redirect_u
Source: .zz[1].htm.2.dr	String found in binary or memory: https://ch1.amorozon.fr/.zz/?&78387439&user=jon.parr
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://developer.yahoo.com/flurry/end-user-opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protectio
Source: signup[1].htm.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: app[1].css.2.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: sc_login[1].js.2.dr	String found in binary or memory: https://goips.net/background-redirect/index.php
Source: signup[1].htm.2.dr	String found in binary or memory: https://login.live.com
Source: segring[1].htm.2.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf8
Source: sc_login[1].js.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://login.skype.com/login
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://mixpanel.com/optout
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://ondemand.webtrends.com/support/optout.asp
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://priv-policy.imrworldwide.com/priv/browser/us/en/optout.html
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://privacy.micros
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://signin.kissmetrics.com/privacy/#controls
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://signup.live.co
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://signup.live.com/
Source: signup[1].htm.2.dr	String found in binary or memory: https://signup.live.com/error.aspx?errcode=1045&mkt=en-US
Source: {32E83695-30D8-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DF7977F7404D051671.TMP.1.dr	String found in binary or memory: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%2
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://support.xbox.com/help/friends-social-activity/community/use-safety-settings
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://tools.google.com/dlpage/gaoptout
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.aboutads.info/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.acuityads.com/opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.adjust.com/opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.appnexus.com/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.appsflyer.com/optout
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.clicktale.net/disable.html
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.here.com/)
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.linkedin.com/legal/privacy-policy
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.optimizely.com/legal/opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.privacyshield.gov/welcome
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/Legal/ThirdPartyDataSharing
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/managedatacollection
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youradchoices.ca
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youradchoices.ca/fr
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youronlinechoices.com/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

System Summary:

Classification label

Source: classification engine

Classification label: mal76.phis.win@3/52@8/3

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{32E83693-30D8-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF61A1327D3F69D777.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2044 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2044 CREDAT:17410 /prefetch:2			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior