Analysis Report https://protection.office.com/campaigns

ID:	339453
Product:	CloudBasic
Start time:	04:26:04
Start date:	14.01.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{567D1A1A-5618-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	3936AFF65D34369B7290F7512981A844	46BFB03F39C413ECA699213B232E9D294BA79C13	37954BC180971B56B19CC9CF57B04540A7191F80402D3E7598ACE95872358F94
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{567D1A1C-5618-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	9D64BE0DCE95D92CEC45EC74B1A9CCCD	87C826887B12B00780CCECDC234B753476A97303	D7B8A7C38591C0EE6749B092CDEC5071CF6FC536EB14C174F5E45F603B722AC9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{567D1A1D-5618-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	A6377BE99E639130AEF14785146C1E77	D579DB4FCEF199C6C1A2EA8EC8F9900E90639C11	9EF8ADF1B7A9B673FC6879A493E062F09065DAADB92A59E688148F2BB267A79F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	2831458E3A3CFD909DAA46E907FB5D2D	34C7A4232301D8CB28251600ED9E168150CBA0E9	756E74113F78025BAF5E8CC7A0995C0E2897B93A3C5533F735789C8139BFC40F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\2_bc3d32a696895f78c19df6c717586a5d[1].svg	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ConvergedLogin_PCore_jwYGVbAxVLRxtzxSQp7jCQ2[1].js	ASCII text, with very long lines	8F060655B03154B471B73C52429EE309	03E3585E81FBC4996877F3AF5C25AB2DFF30AD56	8D4C8938578F6ADB95A07665C4C092625B34B273B10F960D343311552E958E2B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\arrow_px_up[1].gif	GIF image data, version 89a, 7 x 9	95B65C94F57061E15ECC8304D3E578D5	A7483D668A780949FDA842F39877A3C08D0FC51C	BDA2D6EB8E72B3DBCA5EEF086178033F8A2BB3481180B2C63295FCF23843D960
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\authorize[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	8AEC44FC117228C47FA14C6F0298707E	0E6AE678E174E3A67E71280ED0EC1C1542DE5EB8	10ED783181B49A61234E0851CCD23647E97E6EEFAA7EF00ED103C5E7F9913838
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cf-7c36ab[1].css	UTF-8 Unicode text, with very long lines	0DCFF2779D4542C11AD9C9C19DF8328D	D7EFAE8E66FA6B4C335826BFD8C56C6F142E4254	440D8292ABDF80DD6E8A9D9FAEA83367CE57BD1A1A8D153EDC358DB5F97EFF35
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\converged_ux_v2_RfnRCrmapm3W_OFn994CMA2[1].css	ASCII text, with very long lines	45F9D10AB99AA66DD6FCE167F7DE0230	D443993E7ADB3108167BCD94E5D3126A2E3EE7EE	D72952FC8950D26C08C6BAD73D389C35D0EAF164CB73503183A2966DEFAAD991
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-1.7.2.min[1].js	HTML document, UTF-8 Unicode text, with very long lines	B8D64D0BC142B3F670CC0611B0AEBCAE	ABCD2BA13348F178B17141B445BC99F1917D47AF	47B68DCE8CB6805AD5B3EA4D27AF92A241F4E29A5C12A274C852E4346A0500B4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js	UTF-8 Unicode text, with very long lines	E55ECB02E7376CD010C764107EBD513F	FA6D184DF01EC535628DC8FAF38211591BAADFC8	5776881753B95A0ABE5D1F6EFE3ABE7B83A3265EACCD117DD948E523C044600C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\lwsignupstringscountrybirthdate_en-us_pVtahKS9WUIZdNqg1DDhHg2[1].js	HTML document, UTF-8 Unicode text, with very long lines	A55B5A84A4BD59421974DAA0D430E11E	09926A2D8BBFA41C3085BCF8A546AEAD3FB8C0FC	FC6D389E166EBA3F121C4A92F446C1C36997D770862F4D6994192CE1AD4A1051
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\print-icon[1].png	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced	023F5AC6E0114AF1F781BE5D3C956385	C166284B8541F1DE32DC5C4DEC635C296BF85C98	75D637BF6B6DFF2525095D0BE7E0C90F012BB118C2EF19099AFDCBC630ADFC79
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\script[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	633B23CA8A850C508C146635DB4239F5	CF78DA53BD7561F3ACB33710016ECBF60E9F0204	DAA1677D2640BE8A77F6C69EEE3911D2F8CF81DAA7BB604800A2D63A8F130C95
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\script[2].js	ASCII text, with very long lines, with no line terminators	F620D4D38655075DF3268D640BF479BD	79BEBF5E6907D4CDD5764B9B9CF3A72932F9C343	7E1377CD02DAFE245ED719FCA972C5E8CFDE30CBF3910D2795A922BB466D08C2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\50-f1e180[1].js	ASCII text, with very long lines	0405301724624162B6706F1AB465531F	1C034383716BCE493E28BFFF0DD2C27F049CC558	A5DD3C05EFED81BBF60B618C070A7746F030147590EE0EDD74459AC4E53955FD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Print[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	B8E8859FCD4E43D51233559C17A3C7BD	F0CA023F26A84761995FA0BF6935DE6A3B8AE6F8	DC15A37B4015D0DECF639006E4F9002E742DDBFD7C669EC0AE469057F238B78D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2[1].js	ASCII text, with very long lines	87EFFB0BB533C1D79F5C94FD9E30C14D	4E4F5F3CDDDDBFDDB46A1626D7CE579A639DE389	617E32CA57507098771FD30AF6B9DCAB063448F6D7E0BC6D6557DD1895F80543
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-1.11.2.min[1].js	ASCII text, with very long lines	5790EAD7AD3BA27397AEDFA3D263B867	8130544C215FE5D1EC081D83461BF4A711E74882	2ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js	ASCII text, with very long lines, with CRLF, LF line terminators	5F50584B68D931B8BB85F523F15BAA14	FAF4BD348F40016BCE0ABF54F167C7923B303ABB	3C829DCF48768082A6177B77AE4E499337ED4C8BD056705CDB1E979F7B6EFCE5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[1].eot	Embedded OpenType (EOT), Segoe UI Semibold family	E812BA8B7E2A657F2B70CFACE93C7682	2F02CDDBB483F9B11BBBE74C3CA917A4C345FBAD	3330C1DEAC468874238DD0C6BF902179A8731EDA8A208C7D01DAC0AB1EAE1BC9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[2].eot	Embedded OpenType (EOT), Segoe UI Light family	17DFE73CB9C64527F7248B0A24DB317D	345198B9239FCDAF038FB2D3A919E4724037DBAA	AD75FB92B2EBCE6C37640F03E1AB96A752F388BCE60C877ADE4780B13839E8C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\latest[3].eot	Embedded OpenType (EOT), Segoe UI family	CAD76E4816AF6890C9BFD02A6D1EA899	9EDC91541C31034FCE0D83AABBAAD4C314CD3D33	D5794223D1A062E5DBE6C34C1994C8CE3792B24AFD5218D0644CB1F53DA4BE58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\lightweightsignuppackage_mStdClDku7grp_TX7Xaf-g2[1].js	UTF-8 Unicode text, with very long lines	992B5D0A50E4BBB82BA7F4D7ED769FFA	6E473485198E0BA116E6761B8B97BD5E751F4FDB	A1143F7455003238C2803B63B1322F84E4D9607ED246B10DE256FE764E3F2542
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\override[1].css	ASCII text, with very long lines, with CRLF line terminators	A570448F8E33150F5737B9A57B6D889A	860949A95B7598B394AA255FE06F530C3DA24E4E	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\privacystatement[1].htm	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	D38AA0851775CE2358B5B988DA6C3E02	8CE60348228521D9EFA1D6D03FF237925AF6F8EA	BA7D54436E3B8E3F0BC540E32015DC92F23CBD91A3D1782D415BE11B51A30815
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\script[1].js	ASCII text, with very long lines, with no line terminators	B110D87662D257F657ABCCEF7AF5CD09	FD7519D842B6344448E6F1D69DFFA5F896FAE4A6	65E82E7414D88BC864191400084C24DA27052E7A61F9F3C1F1EFDFEE433D558C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\signup[1].htm	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators	839629AD033C65999188F72D9D76F2CC	C721D666228AC3D162A18B34F79559B2AACFAA8A	6FE66D2AE47B86A887E1310EBAD3C97F8B08A5E74596D617DC9FCD65329DA958
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\app[1].css	ASCII text, with very long lines, with CRLF, LF line terminators	7C593B06759DB6D01614729D206738D6	0D4F76D10944933B8DDECFFE9691081439A77A3C	F7D9FB0479DE843CF3FB0B78FC56BBB9E30BF0A238C6F79D9209FA8B22EFB574
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\converged.v2.login.min_rayhgcterrtxpnvapp3erg2[1].css	ASCII text, with very long lines	440CA18024DE46B4D73E7540A4FDDE46	C4FF7AF4E1558E081DF52C1E61A5D63D0BE577C7	EA6449D448A48495C557755AF39701567925CEAFC30E06FBA05F65E723C91AA3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\favicon[2].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\mwfmdl2-v3.54[1].woff	Web Open Font Format, TrueType, length 26288, version 0.0	D0263DC03BE4C393A90BDA733C57D6DB	8A032B6DEAB53A33234C735133B48518F8643B92	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\override[1].css	ASCII text, with very long lines, with CRLF line terminators	A570448F8E33150F5737B9A57B6D889A	860949A95B7598B394AA255FE06F530C3DA24E4E	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\shell.min[1].css	UTF-8 Unicode text, with very long lines, with no line terminators	1F9995AB937AC429A73364B4390FF6E8	81998DCC6407CEB5CEF236AD52B9F2A3A9528D3B	49E5166F40D8586714F86E08AB76A977199DF979357147A0E81980A804151C2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\style[1].css	ASCII text, with very long lines, with no line terminators	2AC383F4677A1036C8EA4289F99A31E3	E65967B9273029CDDD5A5F8DF9E61DACF89CF11C	2206A95E6BAC7C185CC54638EBF0B0089CBC27FF729B45AC63C968CFE4991AA4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ux.converged.login.strings-en.min_xw0hy9kamszck8doonyj8g2[1].js	UTF-8 Unicode text, with very long lines	5F0D07CBD90032C65C2BC0E8A27609F2	082E891C48B28D510ECD672A7573D01474B2B5B6	34BD1E67DD38AF6F495BC90D22733FF5A8308161FFE2548FAF93C1D39DDDF5D6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\wcp-consent[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	38B769522DD0E4C2998C9034A54E174E	D95EF070878D50342B045DCF9ABD3FF4CCA0AAF3	208EDBED32B2ADAC9446DF83CAA4A093A261492BA6B8B3BCFE6A75EFB8B70294
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\50-f1e180[1].js	ASCII text, with very long lines	0405301724624162B6706F1AB465531F	1C034383716BCE493E28BFFF0DD2C27F049CC558	A5DD3C05EFED81BBF60B618C070A7746F030147590EE0EDD74459AC4E53955FD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\Me[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	E86EF8B6111E5FB1D1665BCDC90888C9	994BF7651CB967CD9053056AF2D69ACB74DB7F29	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\RE1Mu3b[1].png	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced	9F14C20150A003D7CE4DE57C298F0FBA	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\cf-7c36ab[1].css	UTF-8 Unicode text, with very long lines	0DCFF2779D4542C11AD9C9C19DF8328D	D7EFAE8E66FA6B4C335826BFD8C56C6F142E4254	440D8292ABDF80DD6E8A9D9FAEA83367CE57BD1A1A8D153EDC358DB5F97EFF35
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\dropdown_caret_KXSZjGsyILZaoTf0sI9X-A2[1].svg	SVG Scalable Vector Graphics image	2974998C6B3220B65AA137F4B08F57F8	F4F08DA689179DE68EE40CD12ECDCC5AC54B3979	96D52BD03E244A44931A541A807067792D638DD29EC14A87A78F2BE85D12D19A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon[2].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\icons[1].eot	Embedded OpenType (EOT), icons family	77E1987DF3A0274C5A51E3C55CEE7C98	9B0FE96AF141AB09183F386F65BC627B8C396460	EF04649D4D068673CF0FA47EF4C45C8BE291E703F4EC5FC0E507F17839120AA2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\oneds_Xr2D7Nex80v7A-8bxF8jgQ2[1].js	ASCII text, with very long lines, with CRLF, LF line terminators	5EBD83ECD7B1F34BFB03EF1BC45F2381	CD1E0062A04B11EEB36586766BF5144955250E65	4C57821AA26F21DEEBC39E3C750BC4FE246C430E5E50F4ADD0CFF53943C8C608
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\servicesagreement[1].htm	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	F313A181CD449B9794333352C0EE20AB	869B133A92C3E1FE511CBFA5D06C00AF91C5CB78	C81A004DBE79E9FA73981A88FF253EAA2E0B153A493B3B2C9077DD7FDB06BC79
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\style[1].css	UTF-8 Unicode text, with very long lines, with no line terminators	D0519383C16A2B2D2879BFBF15845F0C	B2FBBC365B2CA853B1CBEAAA0F10BB05148ED9AA	046BA9FDD7992751785036A03AB6EDD3052465C23C2BAD1ADC80905DC6AA39A9
C:\Users\user\AppData\Local\Temp\~DF71AF7237989E274B.TMP	data	93B84DBA1BE1B581E505F18C0057B9BE	7EAD23C934FCDDB968735D9F22F3AC64093AD7A4	297B210605BE2D8FB66DCC4DA093703F7CEEF8ED3772A7E267B300F1D9881E0F
C:\Users\user\AppData\Local\Temp\~DFB66D0A2BAC6D7BF1.TMP	data	0EC6D19D83BB47D205E9F5872CD5CB70	BEEB9096259AC376E7571D42DC81A7F40C3AA462	352764C607E0BB421723471013719A91B5631CEE63B734151671087D08A76BD5
C:\Users\user\AppData\Local\Temp\~DFBBE7D503EFF5E58B.TMP	data	AB09ECD741D338488D74FC8BED94DE8E	746F395E3608053D069D613273FDCE2B4A19F969	95248013C555D945BFF310608EBDD8AA27DB3F200EB4D5BBAA4461BC386D9B1B

Phishing:

HTML body contains low number of good links

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns	HTTP Parser: Number of links: 1
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns	HTTP Parser: Number of links: 1
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: Title: Create account does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: Title: Create account does not match URL

Submit button contains javascript call

Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();

META author tag missing

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dRCxX7zvMbgWHQ4hQQjYDLsACHPdw0yPUh7ngOL7Hk3JPp31-2t6R1T1fqrzR8Ny3_NeRjSYengTKT4w7A0Dbye3ml6DtjwZfSs_SwfjQXQ-NW757XQkrsm6VSk6fhaKscaKO6pM8w1lpm5_ei4_ovg&nonce=637461916115176785.YzM1MjNkNzgtZDgwNy00MDFkLThlMzktMDFjMjZmODEwMzA1MTFhNWM1MTQtMzMyMi00NDJjLTllZWItZDQyYzc0ZTQ0NzBj&redirect_uri=https%3a%2f%2fprotection.office.com%2fcampaigns	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26response_type%3dcode%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26scope%3dopenid%2bprofile%2bemail%2boffline_access%26response_mode%3dform_post%26redirect_uri%3dhttps%253a%252f%252flogin.microsoftonline.com%252fcommon%252ffederation%252foauth2%26state%3drQIIAY1SPW_TUBS1mzZtI6AVYmDsgIQEcvJeYvslkTqkMVWaxE6cuCTxEjmOvz-xjd14YYQFUTF2hK0SA7AgJCQktk6dKzYGUCfKBBIDbn8By9WR7jlX99xz7-VgEdbvVIEsyxKNCIqczQmSlGZElS5TBDlDNZmcywghKrhZ2Lw4x87err7ffb2y8eT5S7F3hK9PbSNWirLnHON39Sjyw3qp5AdepMiR4blFT1UN-apfkiXHlwzNDT_g-CmO_8Dx46WQriCShjVIQ0hBRKMqVZykLGRNzuJSLRIZLeEWALDMrtUVdJtNrSjDJmuKTo95kLBpA7LCrs6NMo3AR2zKLlgDAI5pm13BtsXRXjaDX0xSGYgCD7h0xzxb2ug1Hkd6-bJ4gZEqv5bWVS9wpr4XRke5T3jPV9y9edNz3cxF8ZKmuJEhS5eO-oHnK0FkKOH2oHkwRmnMzrRRiyd1njcnTDdsNFv9eQIW_X0duVqvi1pWpd33K5AoR_QAClB9FKSDKreoTDllYA4niqsJHYFMUAMws4VScWyaicxEVIfhdJioJj_mCW6EKDTmrSB06IdDi1Z1qRPKUqdH-2w1gbbvUFPFIKderL3L5bNrO557kruRreoa860sD9WwldNl_Hz5GsjV19YKm9htbAv7vYy_Wsly_f41_lb7e9h8-uXFmz8XBexkpaTvDO6PawedThCjkjppW_tzEDMU3Y67Tq2rtdumVAVUi-17_DZdh4d5_DCf_5nHn61iH9f_9xPOCrfKoAwJAAlIboFKvUzXKSh-vo79Aw2%26estsfed%3d1%26lw%3d1%26fl%3deasi2%26fci%3d80ccca67-54bd-44ab-8625-4b79c4dc7775%26mkt%3dEN-US%26uaid%3dda00eaf107b146b3a3050f7f8d925a4f&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=da00eaf107b146b3a3050f7f8d925a4f&suc=80ccca67-54bd-44ab-8625-4b79c4dc7775&lic=1	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49762 version: TLS 1.2

Software Vulnerabilities:

Potential browser exploit detected (process start blacklist hit)

Source: C:\Program Files\internet explorer\iexplore.exe

Process created: C:\Windows\System32\TokenBrokerCookies.exe

Jump to behavior

Networking:

Found strings which match to known social media urls

Source: privacystatement[1].htm.2.dr	String found in binary or memory: <ul><li>Sources of personal data: Interactions with users</li><li>Purposes of Processing (Collection and Sharing with Third Parties): Provide our products; product improvement; product development; customer support; and help, secure, and troubleshoot</li><li>Recipients: Service providers and user-directed entities</li></ul></li></ul><p>While the bulleted list above contains the primary sources and purposes of processing for each category of personal data, we also collect personal data from the sources listed in the <a target="_blank" class="mscom-link" href="#mainpersonaldatawecollect">Personal data we collect</a> section, such as developers who create experiences through or for Microsoft products. Similarly, we process all categories of personal data for the purposes described in the <a target="_blank" class="mscom-link" href="#mainhowweusepersonaldatamodule">How we use personal data</a> section, such as meeting our legal obligations, developing our workforce, and doing research.</p><p><strong>Disclosures of personal data for business or commercial purposes</strong>. As indicated in the <a target="_blank" class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section, we share personal data with third parties for various business and commercial purposes. The primary business and commercial purposes for which we share personal data are the purposes of processing listed in the table above. However, we share all categories of personal data for the business and commercial purposes in the <a class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section.</p></span></div><div class="divModuleDescription"><span id="Header">Advertising</span><span id="navigationHeader">Advertising</span><span id="moduleName">mainadvertisingmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription"><p>Advertising allows us to provide, support, and improve some of our products. Microsoft does not use what you say in email, chat, video calls or voice mail, or your documents, photos, or other personal files to target ads to you. We use other data, detailed below, for advertising in our products and on third-party properties. For example:</p><ul><li>Microsoft may use data we collect to select and deliver some of the ads you see on Microsoft web properties, such as <a target="_blank" class="mscom-link" href="https://www.microsoft.com">Microsoft.com</a>, MSN, and Bing.</li><li>When the advertising ID is enabled in Windows 10 as part of your privacy settings, third parties can access and use the advertising ID (much the same way that websites can access and use a unique identifier stored in a cookie) to select and deliver ads in such apps.</li><li>We may share data we collect with partners, such as Verizon Media, AppNexus, or Facebook (see below), so that the ads you see in our products and their products are more r
Source: privacystatement[1].htm.2.dr	String found in binary or memory: s <a target="_blank" class="mscom-link" href="https://www.linkedin.com/legal/privacy-policy">Privacy Policy</a>.</p></span></div><div class="divModuleDescription"><span id="Header">Search, Microsoft Edge, and artificial intelligence</span><span id="navigationHeader">Search, Microsoft Edge, and artificial intelligence</span><span id="moduleName">mainsearchaimodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription" aria-expanded="false"><p>Search and artificial intelligence products connect you with information and intelligently sense, process, and act on information equals www.linkedin.com (Linkedin)
Source: privacystatement[1].htm.2.dr	String found in binary or memory: s health, oral health, osteoporosis, skin health, sleep, and vision / eye care. We will also personalize ads based on custom, non-sensitive health-related interest categories as requested by advertisers.</li><li><strong>Children and advertising</strong>. We do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 16 years of age.</li><li><strong>Data retention</strong>. For personalized advertising, we retain data for no more than 13 months, unless we obtain your consent to retain the data longer.</li><li><strong>Data sharing</strong>. In some cases, we share with advertisers reports about the data we have collected on their sites or ads.</li></ul><p><strong>Data collected by other advertising companies</strong>. Advertisers sometimes include their own web beacons (or those of their other advertising partners) within their advertisements that we display, enabling them to set and read their own cookie. Additionally, Microsoft partners with third-party ad companies to help provide some of our advertising services, and we also allow other third-party ad companies to display advertisements on our sites. These third parties may place cookies on your computer and collect data about your online activities across websites or online services. These companies currently include, but are not limited to: <a target="_blank" class="mscom-link" href="https://www.appnexus.com/">AppNexus</a>, <a target="_blank" class="mscom-link" href="https://www.facebook.com/help/568137493302217">Facebook</a>, <a target="_blank" class="mscom-link" href="https://www.media.net/adchoices">Media.net</a>, <a target="_blank" class="mscom-link" href="https://my.outbrain.com/recommendations-settings/home">Outbrain</a>, <a target="_blank" class="mscom-link" href="https://www.taboola.com/privacy-policy#user-choices-and-optout">Taboola</a> and <a target="_blank" class="mscom-link" href="https://www.verizonmedia.com/policies/us/en/verizonmedia/privacy/index.html">Verizon Media</a>. Select any of the preceding links to find more information on each company's practices, including the choices it offers. Many of these companies are also members of the <a target="_blank" class="mscom-link" href="https://www.networkadvertising.org/managing/opt_out.aspx">NAI</a> or <a target="_blank" class="mscom-link" href="https://www.aboutads.info/choices/">DAA</a>, which each provide a simple way to opt out of ad targeting from participating companies.</p></span></div><div class="divModuleDescription"><span id="Header">Collection of data from children</span><span id="navigationHeader">Collection of data from children</span><span id="moduleName">maincollectionofdatafromchildrenmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription"><p>When a Microsoft product collects age, and there is an age in your jurisdiction under which parental consent or authorization is required to use the p

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: protection.office.com

Urls found in memory or binary data

Source: icons[1].eot.2.dr	String found in binary or memory: http://fontello.com
Source: icons[1].eot.2.dr	String found in binary or memory: http://fontello.comiconsRegulariconsiconsVersion
Source: 50-f1e180[1].js.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.2.dr	String found in binary or memory: http://jquery.com/
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.2.dr	String found in binary or memory: http://jquery.org/license
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.2.dr, ConvergedLogin_PCore_jwYGVbAxVLRxtzxSQp7jCQ2[1].js.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/mit-license.php)
Source: jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2[1].js.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: http://www.asp.net/ajaxlibrary/CDN.ashx.
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: http://www.mpegla.com
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: http://www.mpegla.com).
Source: knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2[1].js.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net
Source: authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3er
Source: authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_xw0hy9kams
Source: imagestore.dat.2.dr, authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
Source: authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_jwYGVbAxVLRxtzxSQp7jCQ2.js
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/converged_ux_v2_RfnRCrmapm3W_OFn994CMA2.css?v=1
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg)
Source: imagestore.dat.2.dr, signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2
Source: imagestore.dat.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2~
Source: imagestore.dat.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2~(
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/lightweightsignuppackage_mStdClDku7grp_TX7Xaf-g2.js?v=1
Source: signup[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/lwsignupstringscountrybirthdate_en-us_pVtahKS9WUIZdNqg1DDhHg2.js?v=1
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://aka.ms/redeemrewards
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://aka.ms/redeemrewards).
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://aka.ms/taxservice
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://aka.ms/useterms
Source: signup[1].htm.2.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/c/ms.analytics-web-2.min.js
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://developer.yahoo.com/flurry/end-user-opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protectio
Source: ConvergedLogin_PCore_jwYGVbAxVLRxtzxSQp7jCQ2[1].js.2.dr, signup[1].htm.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: app[1].css.2.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: signup[1].htm.2.dr	String found in binary or memory: https://login.live.com
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.live.com/Me.htm?v=3
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?response_type=code
Source: Me[1].htm.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: TokenBrokerCookies.exe, 00000006.00000002.652436055.0000016596410000.00000004.00000020.sdmp, TokenBrokerCookies.exe, 00000006.00000002.652451647.000001659641E000.00000004.00000020.sdmp, {567D1A1C-5618-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: TokenBrokerCookies.exe, 00000006.00000002.652444483.0000016596418000.00000004.00000020.sdmp	String found in binary or memory: https://login.microsoftonline.com/0tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoft
Source: ~DFB66D0A2BAC6D7BF1.TMP.1.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.microsoftonline.com/jsdisabled
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://login.skype.com/login
Source: Me[1].htm.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://mixer.com/about/tos
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://mixer.com/contact
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://mixpanel.com/optout
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://ondemand.webtrends.com/support/optout.asp
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://priv-policy.imrworldwide.com/priv/browser/us/en/optout.html
Source: {567D1A1C-5618-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://privacy.micros
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://signin.kissmetrics.com/privacy/#controls
Source: {567D1A1C-5618-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://signup.live.co
Source: {567D1A1C-5618-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://signup.live.com/
Source: signup[1].htm.2.dr	String found in binary or memory: https://signup.live.com/error.aspx?errcode=1045&mkt=en-US
Source: ~DFB66D0A2BAC6D7BF1.TMP.1.dr	String found in binary or memory: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%2
Source: {567D1A1C-5618-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://signup.live.cotonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://skype.com/go/myaccount
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://support.xbox.com/help/friends-social-activity/community/use-safety-settings
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://tools.google.com/dlpage/gaoptout
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.aboutads.info/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.acuityads.com/opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.adjust.com/opt-out/
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.adr.org
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.appnexus.com/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.appsflyer.com/optout
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.clicktale.net/disable.html
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.google.com/intl/en_ALL/help/terms_maps.html
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.here.com/)
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.linkedin.com/legal/privacy-policy
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html
Source: {567D1A1C-5618-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.microsoft.
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.optimizely.com/legal/opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.privacyshield.gov/welcome
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.skype.com
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.skype.com).
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.skype.com/go/allrates
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.skype.com/go/legal
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.skype.com/go/legal.broadcast
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.skype.com/go/store.reactivate.credit
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.skype.com/go/ustax
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/Legal/ThirdPartyDataSharing
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/en-US/Legal/CodeOfConduct
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/en-US/Legal/CodeOfConduct)
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/managedatacollection
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios
Source: servicesagreement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios)
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youradchoices.ca
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youradchoices.ca/fr
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youronlinechoices.com/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.4:49762 version: TLS 1.2

System Summary:

Classification label

Source: classification engine

Classification label: clean2.win@5/59@8/2

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{567D1A1A-5618-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF71AF7237989E274B.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\TokenBrokerCookies.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6768 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAABAOz_AwD0_5mUgr2fSv4NxRRKhIfqZP9fUQosM2-hJX8votGQsH2PQuCecfPy-WPQWQ7eiFMW6_yA4NTsqZVOGf6tlSk0LBwgAA&rid=e376dce7-fc39-4390-87c3-8fadf9f10a00 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 1838406162 30864677 1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6768 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAABAOz_AwD0_5mUgr2fSv4NxRRKhIfqZP9fUQosM2-hJX8votGQsH2PQuCecfPy-WPQWQ7eiFMW6_yA4NTsqZVOGf6tlSk0LBwgAA&rid=e376dce7-fc39-4390-87c3-8fadf9f10a00 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 1838406162 30864677 1			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: TokenBrokerCookies.exe, 00000006.00000002.652451647.000001659641E000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9

HIPS / PFW / Operating System Protection Evasion:

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: unknown	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAABAOz_AwD0_5mUgr2fSv4NxRRKhIfqZP9fUQosM2-hJX8votGQsH2PQuCecfPy-WPQWQ7eiFMW6_yA4NTsqZVOGf6tlSk0LBwgAA&rid=e376dce7-fc39-4390-87c3-8fadf9f10a00 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 1838406162 30864677 1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAABAOz_AwD0_5mUgr2fSv4NxRRKhIfqZP9fUQosM2-hJX8votGQsH2PQuCecfPy-WPQWQ7eiFMW6_yA4NTsqZVOGf6tlSk0LBwgAA&rid=e376dce7-fc39-4390-87c3-8fadf9f10a00 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 1838406162 30864677 1			Jump to behavior