Analysis Report https://mobile1austin.com/Title-docs/RD-FITT

ID:	345209
Product:	CloudBasic
Start time:	20:36:12
Start date:	27.01.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{78D3FB73-6122-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	25E3A834103AD4B24A71B3BC418968E2	4CB0840006C0E1B1ABC9F30159BD384082ABBC53	6CF4FF71BB85BC430E6AE63168312EADCBDB6B6064953D6CE6227FC10199CA90
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{78D3FB75-6122-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	C26A7295D8F5669AEB351EEF52208F33	9D66097A9768552CFF5B55CE3F9546254E8F4FD5	D83B5F4848E8AA4934298FC5BCC6F8154F0C1CD8E37B288FFF30FC7EF99DFAD1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8025F276-6122-11EB-90E6-ECF4BB82F7E0}.dat	Microsoft Word Document	EE159EBC16727735C66B8C6E999B72F5	21D09B07E69F25014375AD57076AFC24E5711879	EAF90D7A93C227B797A70955EDF7B052CA141E9BF1564293E8E5EDCF9685CECE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\po60zt0\imagestore.dat	data	31A6CD4F76E8D060057817794F13A388	867DFB70F84B5BC7A615DEBD0BBCB957AD37AB59	74CE69C861074DC130863FC256BBE1AD8041F799D4CFD1639029FB9E026625B2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\50-f1e180[1].js	ASCII text, with very long lines	0405301724624162B6706F1AB465531F	1C034383716BCE493E28BFFF0DD2C27F049CC558	A5DD3C05EFED81BBF60B618C070A7746F030147590EE0EDD74459AC4E53955FD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\65-478888[1].css	UTF-8 Unicode (with BOM) text, with very long lines	57DF07F6176F5DF41FC8EC71B55BC776	1F2D17DE22D74A20A67B49A28AA8439686E9CD72	D43E94C786AEC9880B919691032B16F344B6A7C37454D0ABCEABCE973718F751
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RD-FITT[1].htm	HTML document, ASCII text, with CRLF line terminators	F0F1832A9321415DB1F2DC16DD4CB5D3	AF07C2383A936B50C100821D65C0516828A90CA9	51FF335FB2B4C323202F223114B189A527A728A040EE764D0532731BE6F9E02F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RE1Mu3b[1].png	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced	9F14C20150A003D7CE4DE57C298F0FBA	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RE4D5uF[1].png	PNG image data, 1259 x 472, 8-bit/color RGBA, non-interlaced	3C93A21A96A2A24783961F77BE4A63BF	F63ECF9A1E07915F4E9B0CFB29DF471638B0B8C3	CFA3D5552942FE80D5AD5A729ACACC313A083EEAF815E637661A445D145A1B49
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RE4DRie[1].png	PNG image data, 1259 x 472, 8-bit/color RGBA, non-interlaced	58135C6FDFD079ED2BE729D4BF943B86	A0678A36EB16EFC56AD03B2FF12464EEBC5B8CB0	F543C6CC2E453F353271F88323750E721C347AF3EEE77766C0929D3DFAF7F6C1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RE4E4rT[1].wdp	JPEG-XR	C187019502841D667C6C3A356D0AA091	366CDBF1257918F5CDF788B833E5C8E5823A4D8D	CF9CF4143831E71657CECA0C2866BA58B2612CA344E30E2C15158937F18AACDD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RE4pndL[1].png	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	207E963B5CC48A36CE47FD9AD2E8F702	EE6EE0FB1EA66B60E6C58DF10799C0066CC121EB	816CE5B6288F867E1ED48FD06CCF82E016392B1D3684CDD79924963BA44AF4D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RE4sQDc[1].png	PNG image data, 40 x 40, 2-bit colormap, non-interlaced	C231EEECF067EE5A3618D41231BD3325	603AF1376472F99F6FD825D44B1935B1F6A6F52F	D391C896A10E9D884A3C4F20E6ED82787A4B43236DEAD74D8CF323AD8BC4CB43
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\de-ch[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	6A89C73F3A1615721261CEF83A9C9AA6	D7673571C9F590AC610CC8B5CB1A85032B727365	64DA6F7D93850B3E18A95326FAAF44A228045C8D0EAEB59E479F0E8003515983
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\jquery-3.3.1.min[1].js	ASCII text, with very long lines, with CRLF line terminators	378087A64E1394FC51F300BB9C11878C	0C3192B500A4FD550E483CF77A49806A5872185B	4FE68FA216176E6D1F4580E924BAFECC9F519984ECC06B1A840A08B0D88C95DE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\latest[1].woff	Web Open Font Format, TrueType, length 35900, version 0.0	70C1D43A35B7A48D088D830EA07FCF77	025E0E281139C70C5538E09BFA7927141AF0CC0B	942E5DD201200674506B0DF50C1AFEF021FFF6D5BD7BB7F600DED8617DBCB386
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\meBoot.min[1].js	ASCII text, with very long lines, with CRLF, LF line terminators	C57C07C4674AE6F46031D21047D05989	A95BFD98F4698ED582A16395AC1FFD45961FD0E1	DE6214A5477F1EE5BB72E015094923CAD51ED057A379BCEB817D82A9A1B0498D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\print-icon[1].png	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced	023F5AC6E0114AF1F781BE5D3C956385	C166284B8541F1DE32DC5C4DEC635C296BF85C98	75D637BF6B6DFF2525095D0BE7E0C90F012BB118C2EF19099AFDCBC630ADFC79
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\social[1].css	UTF-8 Unicode text, with very long lines	12388E77823064F20C2AC22E7BD5A6CB	9E000D34F5140CB3B2B6AE471C7B7FA6CDD11520	78E235423A915B16AF695D8B0D6EF7F994779EC33DC4452C79DB7A48DCE45FAB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\youtube[1].png	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced	B9A1E843699FA17513F807BC78F774FB	599E12FCB9C0843C72832DB6CD2A441797C79568	A7A52942C5CCB21D55B9FDBB5BA8261544C8AA5E2AA0D71B4E20126728E29EF1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\MeControl_cfDm2fEwfL1YuSiw8j6tzA2[1].js	ASCII text, with very long lines, with no line terminators	71F0E6D9F1307CBD58B928B0F23EADCC	4F10CFAE22759568DA215A0F0F069874B017AC8B	3F025F8DD48DBF86B53A7E515E41BD04EFB86F33A21C516F4143A45889B238A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\RE3NYMe[1].wdp	JPEG-XR	713C25642CAFFFDBC30913C53C0F1D42	D25270CD23C890C43F769D77B6348386F5123EB5	DF8E91823AFE4A7374748ED3FB99E79EF2A164FBBFE1FBC12912594AB9219BB6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\RE4DfTp[1].wdp	JPEG-XR	899C8BDFD5B2D8D861B82C56832275C1	3C7E244BA799E6641E386D1E81945B5AAC8314D8	7C977F00B6ECB3902DB67F20F04DBA9D978A68160622EE00221D99844C8984FD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\RE4pkvE[1].png	PNG image data, 40 x 40, 8-bit gray+alpha, non-interlaced	F855792BD5B8D24E932D25F20D748485	EAAAA94DF42272C945C2330A2A205446F7F71740	19EA1ED1BC38169EFE6E32AED430D45A2FDACF49A2D6A7DCA1B5F5CD75F83CF1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\RE4pxBu[1].png	PNG image data, 40 x 40, 8-bit gray+alpha, non-interlaced	2DCF76D4D92B70117E41CC5BE6B686A0	C18F5F4CF898EA6394098EE5C7DFB501E6385DEA	148606900BB9E626F0C3EB03C5E258E219B5E32BACE51C574169A9A123D64189
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\clipart1110398[1].png	PNG image data, 460 x 390, 8-bit/color RGBA, non-interlaced	7BDED18A7544ED6B0FFF10EEB7B65C47	53815F0F2842E7D247BFD518DED180E2E72498D4	2F42B6FFDEA92C77B06F0FE70354BD692853554D47B29DC751DAD9E10A132D5E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\e3-082b89[1].js	ASCII text, with very long lines, with no line terminators	FAD5CCD0C635DDA1F1AACE4F40E82BDC	8571197DA53E3328BF54DBF2226CDF62CF16DB4F	950A8DC0EC6C07598BE52251F3C0FF655B61AC4003794A686BCBA5AFB0A1E09B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\icons[1].eot	Embedded OpenType (EOT), icons family	77E1987DF3A0274C5A51E3C55CEE7C98	9B0FE96AF141AB09183F386F65BC627B8C396460	EF04649D4D068673CF0FA47EF4C45C8BE291E703F4EC5FC0E507F17839120AA2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\instagram[1].png	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced	95FD424420005BCBF324E0219845C132	E5F797BC388729F32AFDD7F424487450984B2F25	97E35ACCD166FFA4D0B84862E2F8C2C36B5B8433D7A20AF382DEE3F104087E77
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\jquery-1.11.2.min[1].js	ASCII text, with very long lines	5790EAD7AD3BA27397AEDFA3D263B867	8130544C215FE5D1EC081D83461BF4A711E74882	2ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\jquery-3.2.1.slim.min[1].js	ASCII text, with very long lines	5F48FC77CAC90C4778FA24EC9C57F37D	9E89D1515BC4C371B86F4CB1002FD8E377C1829F	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\jsll-4[1].js	ASCII text, with very long lines, with no line terminators	AD8545B54A7D77B1EF0E02AFB615A107	3E1BE466B952F8A07E04D6187A90C4A7F9D15D28	196D3E71A396F75F52B94BF617E5F4474B85CA2F358F32CC81D3521731FDE20C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\linkedin[1].png	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced	082196E344000587C008B768820283B6	A0A3A982764456CF74F75B47F7B5C517A628E586	A91DC0F2545A1929E0C6A180C1728C433B23602A4C8AEC06552F5604525689CA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\me[1].htm	HTML document, ASCII text, with very long lines, with no line terminators	EDD9424822C4A052E2708F190C720D1C	A7F9585B05A019DD0C60AD78E564F1169501BC93	616CBECA1333AF735951AD0C94A8AC49D0DF75AB7C201F7C85410B553F1F9E56
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\meversion[1].js	ASCII text, with very long lines	8473CD8EFD3EF831513D1755A7B29302	B629AEF4375DFCE5F2A62ED37F274A2802230F55	517240E61113A84A935F5F3ACAC2C2FB998F04D4FC42379A0DA619F26A975967
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\okta-sign-in.min[1].css	ASCII text, with very long lines	3D0009813E53F22D22B61DBADD48CD26	DA1B7AA73EAA6A5656237AB55BB8DFCF53424811	1425B30F81D336782C0EE0330BE885B7E2FA8033D78B761E550BD865878ED89D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\RD-FITT[1].htm	HTML document, ASCII text	86FDB2841E06E6EE96FE46BA863CC0E8	A4E674BF4087B4D83829C3DC11635EF490D615DE	6A0B9DD90FCF2F330D7825FA92E60D54F40CFB6BE14FC9AEBF0C285A778BC6FC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\RE4CFyx[1].wdp	JPEG-XR	0242F12621C4D5B412090CD05F235129	058A3D403331106E57E92BCE67BB40712635F80F	29711D4EA2A8AE8F4F0931666107E06ADA6ABD6D87AA12788DCF34D69552E35B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\RE4H9G0[1].wdp	JPEG-XR	574D5D951372DAB93A22C51E97849E25	3E175EB9918F1D3F3193636319113FDED1F9091C	65F01E47E338ED535B1DDE3DBE52EA783726F6852E966F469957177C719ADE14
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\RE4Lp94[1].jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1600x600, frames 3	EE5AFA73E0FE39A32DD014E4B2FD22A2	C6C2045F3B2733FD9246744183B1051EC523454A	C9259A48684E02B23F02BEEE7B387FCF194060085F8082C1B67DD15B3DA19A4B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\RE4qZxW[1].wdp	JPEG-XR	15B38520FFCDE29D9CA14429F8F75C00	553E94DF0F843E573023E7337D4BBFE34908CF6E	48BD2AE0048CB2AA05A12D39A54982363DA5FE0DBCEB87A36D2922B793381226
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\app[1].css	ASCII text, with very long lines, with CRLF, LF line terminators	7C593B06759DB6D01614729D206738D6	0D4F76D10944933B8DDECFFE9691081439A77A3C	F7D9FB0479DE843CF3FB0B78FC56BBB9E30BF0A238C6F79D9209FA8B22EFB574
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\bootstrap.min[1].js	ASCII text, with very long lines	67176C242E1BDC20603C878DEE836DF3	27A71B00383D61EF3C489326B3564D698FC1227C	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\cartcount[1].htm	HTML document, ASCII text, with CRLF line terminators	1BF3F6D72753254D68A4A8C99DB850AD	E98B92CFF496817E3D5E6CD117F06BEEFAAD3E5F	68D929A10C3CD609B936B50A541533994B044B38558A33530FF45D1B420CC07E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\facebook[1].png	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced	352637E02A377A29073AA9F65B1FBA22	E5E2B07F777F47DCF158120B11D0B6BDEB0BC878	C77873C0C4A8499BA493832E950D41CBAEE43020D5C99D702A1E9DEBBAF0DB32
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\jquery.min[1].js	ASCII text, with very long lines	2F6B11A7E914718E0290410E85366FE9	69BB69E25CA7D5EF0935317584E6153F3FD9A88C	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\latest[1].woff2	Web Open Font Format (Version 2), TrueType, length 34052, version 0.0	36397A3BC139C6E9F81D383F060F080A	3F4F86C10920D4ED345F4858B6CDE9F93E1AEB81	4F7F4AFE26E71FA9CA1DAC4A43B557A554A46F53251D849F07ED08A04829D74B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\meCore.min[1].js	ASCII text, with very long lines, with CRLF, LF line terminators	3363B2464B87874E9A00DC495CD48F4A	998C3406DDB1076E076E5D1D137B101DA6962222	1CE215BA87D643ED5977E31E5AA1670952888504F2521A56668C7A0D9B15E8FB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\override[1].css	ASCII text, with very long lines, with CRLF line terminators	A570448F8E33150F5737B9A57B6D889A	860949A95B7598B394AA255FE06F530C3DA24E4E	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\popper.min[1].js	ASCII text, with very long lines	70D3FDA195602FE8B75E0097EED74DDE	C3B977AA4B8DFB69D651E07015031D385DED964B	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\script[1].js	ASCII text, with very long lines, with no line terminators	79493518F253F3F74970CF43C8A3FEEE	E0CC16264EA44A55C17766A5E0F0F4DB7DD8AAF2	BD041981B6512D6DA32A6AE752EFE67DD0BA22FACFA9A534B0F5B08651B7852A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\shell.min[1].css	UTF-8 Unicode text, with very long lines, with no line terminators	1F9995AB937AC429A73364B4390FF6E8	81998DCC6407CEB5CEF236AD52B9F2A3A9528D3B	49E5166F40D8586714F86E08AB76A977199DF979357147A0E81980A804151C2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\social[1].js	ASCII text, with very long lines	AE0935FF464917159FE28FB684DE6BC3	ADFF2BFEA6BC0129E2634639EB89BB1CDC43A05D	172BEB2DDE1857755325F5BA1E6F7A4212CA1439C9CA73FBC5FF81C35A5579BE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\twitter[1].png	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced	B30436EB503A7EA8E77925F435DF4671	3313C5FDE8EC85B94547168B867EFEC0188F5987	0AC4630B76827B89EBEA070A1BEB6E5175D280EADC76B67FA886CF6068368CA3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\1x1clear[1].gif	GIF image data, version 89a, 1 x 1	F8614595FBA50D96389708A4135776E4	D456164972B508172CEE9D1CC06D1EA35CA15C21	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\94-3cd1e0[1].js	ASCII text, with very long lines, with no line terminators	53475B50CF354A3E5CCBB0740A2AE553	9166969D9B0D89321B6BD0A754E3DEE54C2B7B11	EEA90E1F236FD6CED5D08C19B424BC7D36A1679C3B87B71C560365AED4888FF3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\RE4qP8j[1].wdp	JPEG-XR	A8B886059B45FDB344C3147F266FAD33	CBFE6C1AC4C5C30B20D8E4B6A82FE91267582467	6BAD3577C407852BFCEF0678F4C46D89851FA3D2DDAD9147BEE6FE8DC1DC1E70
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\RE4rriw[1].png	PNG image data, 40 x 40, 8-bit colormap, non-interlaced	303D29F63674D6C75DE78CCE52660968	37753DAA92E464CE71C6EBA767B77DA227600C2C	0850AA4CB7CF87C5059C0F503CFED9DABEDECF303C62B3827B70C63B82FA54AA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\RE4rzE2[1].wdp	JPEG-XR	2E99B40E743C03BB53058FAAE85C2C25	F5A47BF738EF8B55DB3D5785434A353F609CE227	BE8E025E8533CC93DC46DF63CA0A39A366922C9B3A35CDA9F24FD77DC7823D52
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\a4-539297[1].js	ASCII text, with very long lines, with no line terminators	DF1BDEC92A67C0C3554ADB2946ECF076	8BF9741EDAC3B1DB9816B6D6346DA8ED85C1FF99	B11A0898FF527D53E543AD37065CDE4315C5DBBEC3FF7FF3ED1BE31EA4828978
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\bootstrap.min[1].js	ASCII text, with very long lines	14D449EB8876FA55E1EF3C2CC52B0C17	A9545831803B1359CFEED47E3B4D6BAE68E40E99	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\fb-083993[1].css	UTF-8 Unicode text, with very long lines	0DCFF2779D4542C11AD9C9C19DF8328D	D7EFAE8E66FA6B4C335826BFD8C56C6F142E4254	440D8292ABDF80DD6E8A9D9FAEA83367CE57BD1A1A8D153EDC358DB5F97EFF35
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\iframe[1].htm	HTML document, ASCII text, with very long lines	39B646F2E3E3FE0EE0083188872C06A2	4B69648CA7FBF7B91FDEAC88685FC4CF61E78E97	77E058B387AF17B355C5CA28F106F297D2EB599FEA230822982B6858C4D77C5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\latest[1].eot	Embedded OpenType (EOT), Segoe UI family	CAD76E4816AF6890C9BFD02A6D1EA899	9EDC91541C31034FCE0D83AABBAAD4C314CD3D33	D5794223D1A062E5DBE6C34C1994C8CE3792B24AFD5218D0644CB1F53DA4BE58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\latest[2].eot	Embedded OpenType (EOT), Segoe UI Light family	17DFE73CB9C64527F7248B0A24DB317D	345198B9239FCDAF038FB2D3A919E4724037DBAA	AD75FB92B2EBCE6C37640F03E1AB96A752F388BCE60C877ADE4780B13839E8C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\latest[3].eot	Embedded OpenType (EOT), Segoe UI Semibold family	E812BA8B7E2A657F2B70CFACE93C7682	2F02CDDBB483F9B11BBBE74C3CA917A4C345FBAD	3330C1DEAC468874238DD0C6BF902179A8731EDA8A208C7D01DAC0AB1EAE1BC9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\mwfmdl2-v3.54[1].woff	Web Open Font Format, TrueType, length 26288, version 0.0	D0263DC03BE4C393A90BDA733C57D6DB	8A032B6DEAB53A33234C735133B48518F8643B92	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\privacystatement[1].htm	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	A930B53C03035A4B41DC0BAE8039B5D3	4FA5B375992D87D321B96B1461279815CCB9E186	A71F210275A8A0E3012EB327C5E5DA7D542590C07DB9277A3A77FDAB8E37CF1C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\style[1].css	ASCII text, with very long lines, with no line terminators	2AC383F4677A1036C8EA4289F99A31E3	E65967B9273029CDDD5A5F8DF9E61DACF89CF11C	2206A95E6BAC7C185CC54638EBF0B0089CBC27FF729B45AC63C968CFE4991AA4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\wcp-consent[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	38B769522DD0E4C2998C9034A54E174E	D95EF070878D50342B045DCF9ABD3FF4CCA0AAF3	208EDBED32B2ADAC9446DF83CAA4A093A261492BA6B8B3BCFE6A75EFB8B70294
C:\Users\user\AppData\Local\Temp\~DF17965F7F81DA087C.TMP	data	98B6E4EBFC9600CE98B38F83D716F2B8	07EC581AD462997BDF3DE983234A2251931AEED9	25580683FCF36F95D9FD24F5B44C50B869C1FE58BCF8FFF02968902105E25673
C:\Users\user\AppData\Local\Temp\~DF6BD5A81276D497A5.TMP	data	01654F6FA4009AEF96F0BEC231A4F462	5925C1F3F3FC7C93EB7C69178B399FD81549D79D	D2FEE92C064121DD1AA0FE57F37D21692E9A523502C07310376FC352C7D68B13
C:\Users\user\AppData\Local\Temp\~DFF7B174168F5A2A9B.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://mobile1austin.com/Title-docs/RD-FITT

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://mobile1austin.com/Title-docs/RD-FITT/

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish_10

Source: Yara match	File source: 302494.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RD-FITT[1].htm, type: DROPPED

Phishing site detected (based on logo template match)

Source: https://mobile1austin.com/Title-docs/RD-FITT/

Matcher: Template: office matched

HTML body contains low number of good links

Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: Number of links: 0
Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: Title: Office365 Portal does not match URL
Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: Title: Office365 Portal does not match URL

Invalid T&C link found

Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: Invalid link: Need help signing in?
Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: Invalid link: Need help signing in?

META author tag missing

Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: No <meta name="author".. found
Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: No <meta name="copyright".. found
Source: https://mobile1austin.com/Title-docs/RD-FITT/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.241.70.248:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.70.248:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.70.248:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.192:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.192:443 -> 192.168.2.7:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.7:49763 version: TLS 1.2

Networking:

Found strings which match to known social media urls

Source: de-ch[1].htm.2.dr	String found in binary or memory: <img src="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/85288795/coreui.statics/images/social/facebook.png" alt="Facebook"> equals www.facebook.com (Facebook)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <img src="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/93690392/coreui.statics/images/social/twitter.png" alt="Twitter"> equals www.twitter.com (Twitter)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <img src="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/b23f9ba2/coreui.statics/images/social/linkedin.png" alt="LinkedIn"> equals www.linkedin.com (Linkedin)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <img src="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/c79952ca/coreui.statics/images/social/youtube.png" alt="Youtube"> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <source type="image/svg+xml" srcset="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/2532198d/coreui.statics/images/social/facebook.svg"> equals www.facebook.com (Facebook)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <source type="image/svg+xml" srcset="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/2d505657/coreui.statics/images/social/youtube.svg"> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <source type="image/svg+xml" srcset="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/413bd4a8/coreui.statics/images/social/linkedin.svg"> equals www.linkedin.com (Linkedin)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <source type="image/svg+xml" srcset="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/6f40299c/coreui.statics/images/social/twitter.svg"> equals www.twitter.com (Twitter)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <a data-m='{"id":"n1m1r5a2","sN":1,"aN":"m1r5a2"}' itemprop="sameAs" href="https://www.facebook.com/microsoftschweiz" title="Microsoft auf Facebook folgen (&#246;ffnet in einem neuen Tab)." target=&quot;_blank&quot;> equals www.facebook.com (Facebook)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <a data-m='{"id":"n3m1r5a2","sN":3,"aN":"m1r5a2"}' itemprop="sameAs" href="https://www.linkedin.com/company/1035" title="Microsoft auf LinkedIn folgen (&#246;ffnet in einem neuen Tab)." target=&quot;_blank&quot;> equals www.linkedin.com (Linkedin)
Source: de-ch[1].htm.2.dr	String found in binary or memory: <a data-m='{"id":"n4m1r5a2","sN":4,"aN":"m1r5a2"}' itemprop="sameAs" href="https://www.youtube.com/user/MicrosoftCH" title="Microsoft auf YouTube folgen (&#246;ffnet in einem neuen Tab)." target=&quot;_blank&quot;> equals www.youtube.com (Youtube)
Source: privacystatement[1].htm.2.dr	String found in binary or memory: <ul><li>Sources of personal data: Interactions with users</li><li>Purposes of Processing (Collection and Sharing with Third Parties): Provide our products; product improvement; product development; customer support; and help, secure, and troubleshoot</li><li>Recipients: Service providers and user-directed entities</li></ul></li></ul><p>While the bulleted list above contains the primary sources and purposes of processing for each category of personal data, we also collect personal data from the sources listed in the <a target="_blank" class="mscom-link" href="#mainpersonaldatawecollect">Personal data we collect</a> section, such as developers who create experiences through or for Microsoft products. Similarly, we process all categories of personal data for the purposes described in the <a target="_blank" class="mscom-link" href="#mainhowweusepersonaldatamodule">How we use personal data</a> section, such as meeting our legal obligations, developing our workforce, and doing research.</p><p><strong>Disclosures of personal data for business or commercial purposes</strong>. As indicated in the <a target="_blank" class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section, we share personal data with third parties for various business and commercial purposes. The primary business and commercial purposes for which we share personal data are the purposes of processing listed in the table above. However, we share all categories of personal data for the business and commercial purposes in the <a class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section.</p></span></div><div class="divModuleDescription"><span id="Header13">Advertising</span><span id="navigationHeader13">Advertising</span><span id="moduleName13">mainadvertisingmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription13"><p>Advertising allows us to provide, support, and improve some of our products. Microsoft does not use what you say in email, chat, video calls or voice mail, or your documents, photos, or other personal files to target ads to you. We use other data, detailed below, for advertising in our products and on third-party properties. For example:</p><ul><li>Microsoft may use data we collect to select and deliver some of the ads you see on Microsoft web properties, such as <a target="_blank" class="mscom-link" href="https://www.microsoft.com">Microsoft.com</a>, MSN, and Bing.</li><li>When the advertising ID is enabled in Windows 10 as part of your privacy settings, third parties can access and use the advertising ID (much the same way that websites can access and use a unique identifier stored in a cookie) to select and deliver ads in such apps.</li><li>We may share data we collect with partners, such as Verizon Media, AppNexus, or Facebook (see below), so that the ads you see in our products and their products ar
Source: privacystatement[1].htm.2.dr	String found in binary or memory: s <a target="_blank" class="mscom-link" href="https://www.linkedin.com/legal/privacy-policy">Privacy Policy</a>.</p></span></div><div class="divModuleDescription"><span id="Header29">Search, Microsoft Edge, and artificial intelligence</span><span id="navigationHeader29">Search, Microsoft Edge, and artificial intelligence</span><span id="moduleName29">mainsearchaimodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription29" aria-expanded="false"><p>Search and artificial intelligence products connect you with information and intelligently sense, process, and act on information equals www.linkedin.com (Linkedin)
Source: privacystatement[1].htm.2.dr	String found in binary or memory: s health, oral health, osteoporosis, skin health, sleep, and vision / eye care. We will also personalize ads based on custom, non-sensitive health-related interest categories as requested by advertisers.</li><li><strong>Children and advertising</strong>. We do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 16 years of age.</li><li><strong>Data retention</strong>. For personalized advertising, we retain data for no more than 13 months, unless we obtain your consent to retain the data longer.</li><li><strong>Data sharing</strong>. In some cases, we share with advertisers reports about the data we have collected on their sites or ads.</li></ul><p><strong>Data collected by other advertising companies</strong>. Advertisers sometimes include their own web beacons (or those of their other advertising partners) within their advertisements that we display, enabling them to set and read their own cookie. Additionally, Microsoft partners with third-party ad companies to help provide some of our advertising services, and we also allow other third-party ad companies to display advertisements on our sites. These third parties may place cookies on your computer and collect data about your online activities across websites or online services. These companies currently include, but are not limited to: <a target="_blank" class="mscom-link" href="https://www.appnexus.com/">AppNexus</a>, <a target="_blank" class="mscom-link" href="https://www.facebook.com/help/568137493302217">Facebook</a>, <a target="_blank" class="mscom-link" href="https://www.media.net/adchoices">Media.net</a>, <a target="_blank" class="mscom-link" href="https://my.outbrain.com/recommendations-settings/home">Outbrain</a>, <a target="_blank" class="mscom-link" href="https://www.taboola.com/privacy-policy#user-choices-and-optout">Taboola</a> and <a target="_blank" class="mscom-link" href="https://www.verizonmedia.com/policies/us/en/verizonmedia/privacy/index.html">Verizon Media</a>. Select any of the preceding links to find more information on each company's practices, including the choices it offers. Many of these companies are also members of the <a target="_blank" class="mscom-link" href="https://www.networkadvertising.org/managing/opt_out.aspx">NAI</a> or <a target="_blank" class="mscom-link" href="https://www.aboutads.info/choices/">DAA</a>, which each provide a simple way to opt out of ad targeting from participating companies.</p></span></div><div class="divModuleDescription"><span id="Header14">Collection of data from children</span><span id="navigationHeader14">Collection of data from children</span><span id="moduleName14">maincollectionofdatafromchildrenmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription14"><p>When a Microsoft product collects age, and there is an age in your jurisdiction under which parental consent or authorization is required to u

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: mobile1austin.com

Urls found in memory or binary data

Source: icons[1].eot.2.dr	String found in binary or memory: http://fontello.com
Source: icons[1].eot.2.dr	String found in binary or memory: http://fontello.comiconsRegulariconsiconsVersion
Source: de-ch[1].htm.2.dr	String found in binary or memory: http://github.com/aFarkas/lazysizes
Source: 50-f1e180[1].js.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: de-ch[1].htm.2.dr	String found in binary or memory: http://github.com/requirejs/domReady
Source: de-ch[1].htm.2.dr	String found in binary or memory: http://github.com/requirejs/requirejs/LICENSE
Source: 65-478888[1].css.2.dr	String found in binary or memory: http://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1LLAb
Source: popper.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: de-ch[1].htm.2.dr	String found in binary or memory: http://schema.org/Organization
Source: social[1].js.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: privacystatement[1].htm.2.dr	String found in binary or memory: http://www.asp.net/ajaxlibrary/CDN.ashx.
Source: RD-FITT[1].htm0.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://aka.ms/DPA
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://aka.ms/kinectprivacy/
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://assets.onestore.ms
Source: iframe[1].htm.2.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: RD-FITT[1].htm0.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://channel9.msdn.com/
Source: RD-FITT[1].htm0.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://developer.yahoo.com/flurry/end-user-opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protectio
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: bootstrap.min[1].js0.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: app[1].css.2.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE3NYMe?ver=7b0e&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4CFyx?ver=25c5&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4D5uF?ver=204a&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DRie?ver=f61d&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DfTp?ver=8993&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4E4rT?ver=2072&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4H9G0?ver=5bb0&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Lp94?ver=b6a0&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pkvE?ver=d8fc&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pndL?ver=5217&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pxBu?ver=eae5&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4qP8j?ver=9637&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4qZxW?ver=11cf&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4rriw?ver=b2d5&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4rzE2?ver=aa0b&q=
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQDc?ver=30c2&q=
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://login.skype.com/login
Source: RD-FITT[1].htm0.2.dr	String found in binary or memory: https://logo.clearbit.com/
Source: iframe[1].htm.2.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net
Source: iframe[1].htm.2.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net/le_unified_window/9.12.0.19-release_4769/resources/loader_on_warmGray5_7
Source: RD-FITT[1].htm0.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://mem.gfx.ms
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://mem.gfx.ms/meversion?partner=MSHomePage&market=de-ch&uhf=1
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://microsoftwindows.112.2o7.net
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://mixpanel.com/optout
Source: {78D3FB75-6122-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://mobile1austin.com/Title-Root
Source: {78D3FB75-6122-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://mobile1austin.com/Title-docs/RD-FITT/
Source: {78D3FB75-6122-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://mobile1austin.com/Title-docs/RD-FITT/Root
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://ondemand.webtrends.com/support/optout.asp
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://onedrive.live.com/about/de-ch/
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://priv-policy.imrworldwide.com/priv/browser/us/en/optout.html
Source: {78D3FB75-6122-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://privacy.micros
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://products.office.com/de-ch/academic/compare-office-365-education-plans
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://publisher.liveperson.net
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://publisher.liveperson.net/iframe-le-tag/iframe.html?lpsite=60270350&lpsection=store-sales
Source: {78D3FB75-6122-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://publisher.liveperson.net/iframe-le-tag/iframe.html?lpsite=60270350&lpsection=store-sales-de-
Source: iframe[1].htm.2.dr	String found in binary or memory: https://release.moscnuat.com
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://schema.org/ItemList
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://signin.kissmetrics.com/privacy/#controls
Source: RD-FITT[1].htm0.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://support.xbox.com/help/family-online-safety/online-safety/manage-online-safety-and-privacy-se
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://support.xbox.com/help/friends-social-activity/community/use-safety-settings
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://tools.google.com/dlpage/gaoptout
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://twitter.com/microsoft_ch
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://ussearchprod.trafficmanager.net/services/api/v1.0/store/categories
Source: iframe[1].htm.2.dr	String found in binary or memory: https://va.idp.liveperson.net
Source: iframe[1].htm.2.dr	String found in binary or memory: https://va.msg.liveperson.net
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.aboutads.info/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.acuityads.com/opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.adjust.com/opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.appnexus.com/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.appsflyer.com/optout
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.clicktale.net/disable.html
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.here.com/)
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://www.instagram.com/microsoftch/
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://www.linkedin.com/company/1035
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.linkedin.com/legal/privacy-policy
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html
Source: {78D3FB75-6122-11EB-90E6-ECF4BB82F7E0}.dat.1.dr	String found in binary or memory: https://www.microsoft.
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/cart
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/checkout
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/hardware/accessories/surface
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/hardware/accessories/xbox
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/hardware/surface
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/hardware/xbox
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/microsoft-365/microsoft-365
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/software/microsoft-365
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/surface
Source: iframe[1].htm.2.dr	String found in binary or memory: https://www.microsoftstore.com.cn/xbox
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://www.onenote.com/?omkt=de-CH
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.optimizely.com/legal/opt-out/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.privacyshield.gov/welcome
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://www.skype.com/de/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/Legal/ThirdPartyDataSharing
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/legal/codeofconduct
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.xbox.com/managedatacollection
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youradchoices.ca
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youradchoices.ca/fr
Source: privacystatement[1].htm.2.dr	String found in binary or memory: https://www.youronlinechoices.com/
Source: de-ch[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/user/MicrosoftCH

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.241.70.248:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.70.248:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.70.248:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.192:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.192:443 -> 192.168.2.7:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.7:49763 version: TLS 1.2

System Summary:

Classification label

Source: classification engine

Classification label: mal68.phis.win@3/75@14/4

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{78D3FB73-6122-11EB-90E6-ECF4BB82F7E0}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF17965F7F81DA087C.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2324 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2324 CREDAT:17410 /prefetch:2			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior