Analysis Report https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cMN2PR13MB40691F4FD57DA29EB5F2F91EC73B9%40MN2PR13MB4069.namprd13.prod.outlook.com%3e

ID:	429808
Product:	CloudBasic
Start time:	19:11:41
Start date:	04.06.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{78C22AF1-C5A3-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	9EB44F99B28048C784AFA1E03D8380B8	06321C9FB99A6D9DA106E31CACC02FAA46144686	E593573F7011720B566E5FB66755C4523B6E712061F820B40C2A71B8969DEF3D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{78C22AF3-C5A3-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	6338AFC673F10A0EABDFF662C7C9A556	CC2C919A19089645639ABB561A45DFAFC6A35315	FCABC94E1AB8609D34B348B9DE9E40E417F12BD9C9EE287318B3BF4E4D176EB6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{78C22AF4-C5A3-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	1CBA1BF35E95CCD54D81340F2548CCCC	8C8A666D4EC33928DFB0678BC95E45DCC5A08BC1	59DCD5EF94BFD815403125832927161C4C9801B81AD4D9C0B1DD8C3FCFF4EDF6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	9CBC8F5CD62D2BD3E5CDCF6DB8822C19	02AC307DF304A5ACA05D0CF2DA9DB2DB00CD5C5E	49D78475E7B0222EB356D3B5D6274D858B5F568153699C251EFA00E72BF9FC8C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\49_7916a894ebde7d29c2cc29b267f1299f[1].jpg	JPEG image data, baseline, precision 8, 1920x1080, frames 3	7916A894EBDE7D29C2CC29B267F1299F	78345CA08F9E2C3C2CC9B318950791B349211296	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\53_8b36337037cff88c3df203bb73d58e41[1].png	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced	8B36337037CFF88C3DF203BB73D58E41	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ScriptResource[1].js	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	1D6864709DB6B20418228B3327F5E090	C3C02CD59138C0C468BAFD653D95276D619D0C5F	47E4EE744C576FE52FE74A169A738169A4505BC6EC35FADF26784FF68BD81A3E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Style[1].css	ASCII text, with very long lines, with CRLF line terminators	C8F45AA7423109D2A4CBF0A445ACEF4C	86F85792E3DCA2AF65BA66500DF89C52393FF597	C7153BA739453C3931CB00311E1A31F7258FFA01D9DF77822D616A7F32ECA041
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\WebResource[1].js	ASCII text, with CRLF line terminators	90EA7274F19755002360945D54C2A0D7	647B5D8BF7D119A2C97895363A07A0C6EB8CD284	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Webtrends[1].js	ASCII text, with CRLF line terminators	DBFAC7887A157C9B73DC42927FC15B74	435FD188BF66F0207EEB298DD13228D17D36E4D1	FC66E3943BC6EDC7B1F79D952D31DABCBA3BD576190DEEB9A7518CEE6B75C5A1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\app[1].css	ASCII text, with very long lines, with CRLF, LF line terminators	7C593B06759DB6D01614729D206738D6	0D4F76D10944933B8DDECFFE9691081439A77A3C	F7D9FB0479DE843CF3FB0B78FC56BBB9E30BF0A238C6F79D9209FA8B22EFB574
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicon[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\header_Microsoft[1].png	PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced	BC89C1FBFBC227DC5A7ED9B2797E240D	8A9390297FDD0963C466CF2FD35D5B1F88A46B6A	744A8CD0A4D15DFCF4A5D2E832FF556D950F8AF24D7B66104AB2EF4FE2605D9A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\hip_text[1].gif	GIF image data, version 89a, 22 x 22	309B41EE7A44BD51E5D1B52CCC620E5B	B162CE55DE01BF7C005F8CE4D4D7C32E7AEACA08	F213507641FD02EC43981535823474ECFDE973D1B33A6CD385F1F0827FD4B528
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\override[1].css	ASCII text, with very long lines, with CRLF line terminators	A570448F8E33150F5737B9A57B6D889A	860949A95B7598B394AA255FE06F530C3DA24E4E	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\script[1].js	ASCII text, with very long lines, with no line terminators	B110D87662D257F657ABCCEF7AF5CD09	FD7519D842B6344448E6F1D69DFFA5F896FAE4A6	65E82E7414D88BC864191400084C24DA27052E7A61F9F3C1F1EFDFEE433D558C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\shell.min[1].css	UTF-8 Unicode text, with very long lines, with no line terminators	1F9995AB937AC429A73364B4390FF6E8	81998DCC6407CEB5CEF236AD52B9F2A3A9528D3B	49E5166F40D8586714F86E08AB76A977199DF979357147A0E81980A804151C2A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\sprite1.mouse[1].css	ASCII text, with very long lines, with no line terminators	E2110B813F02736A4726197271108119	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\style[2].css	UTF-8 Unicode text, with very long lines, with no line terminators	D0519383C16A2B2D2879BFBF15845F0C	B2FBBC365B2CA853B1CBEAAA0F10BB05148ED9AA	046BA9FDD7992751785036A03AB6EDD3052465C23C2BAD1ADC80905DC6AA39A9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17-f90ef1[1].js	ASCII text, with very long lines	942DAE57D4E1D63BA153D2AD9F3D2FAC	0C6F2E447F1FBD839A71FBECEC05DA63D917AEF4	C136857D2449FB47E6C43792D4B296DFF96F4BA5AAB06F899BF525B17DD4D4BC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\49-small_e58aafc980614a9cd7796bea7b5ea8f0[1].jpg	[TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, frames 3	E58AAFC980614A9CD7796BEA7B5EA8F0	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Common[1].js	UTF-8 Unicode (with BOM) text, with CRLF line terminators	9F335C7257F05579B44BEB4448812961	444436C1E11E3F52E515E936DC85F018CDA609B7	DDFAA85201322B1F3285A2AF2EC1D8CEFFD2766140112C769C596E20CDC11B5B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\HHJ4JFEM.htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	EBF17E817F52B18DA22B9DD5682C4C82	2B27F62D63BF70CA61DF1EB254D994216E34E430	7CF63BEFC35F1E6A6070B4A61D23D165240607E2E068DC9D4D466537203A4571
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ScriptResource[1].js	UTF-8 Unicode (with BOM) text, with CRLF line terminators	3DBD97A205B8CE59D755AB94F8C42964	B0520226342BBA131160A510BA3B57A1E8B7B80C	36F7B9FE80A026A5D933855DE494AC6B7A4D01A93C26CE8A8737EED0C79367F4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\boot.worldwide.1.mouse[1].js	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	ADCFFBA6C2C732CAD6281BEB67FF5AED	2E75B585ED6B3F55800552FA60AD9AEFE817E00B	DB634CA50571852873DE98052D47A9B162AA8F23761E2CDBBE586EE7077DC88B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon[1].ico	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel	877784A5F5808CEFA2B61E73BFCF8EAE	6A0E7EDA2734D7BBBA3CE38D37B347DF001B1DBF	BE7F0632337BC381D4962125545A5CC3C1E84E2D03DBDB97AB3D79AD78B91B6D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon[2].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\header_microsoft[1].png	PNG image data, 89 x 18, 8-bit/color RGBA, non-interlaced	BC89C1FBFBC227DC5A7ED9B2797E240D	8A9390297FDD0963C466CF2FD35D5B1F88A46B6A	744A8CD0A4D15DFCF4A5D2E832FF556D950F8AF24D7B66104AB2EF4FE2605D9A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\latest[1].eot	Embedded OpenType (EOT), Segoe UI Light family	17DFE73CB9C64527F7248B0A24DB317D	345198B9239FCDAF038FB2D3A919E4724037DBAA	AD75FB92B2EBCE6C37640F03E1AB96A752F388BCE60C877ADE4780B13839E8C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\latest[2].eot	Embedded OpenType (EOT), Segoe UI Semibold family	E812BA8B7E2A657F2B70CFACE93C7682	2F02CDDBB483F9B11BBBE74C3CA917A4C345FBAD	3330C1DEAC468874238DD0C6BF902179A8731EDA8A208C7D01DAC0AB1EAE1BC9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\print[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	290AFB4165DD808A850D8920AEB5DBF4	0B4BF844AED3A740A99B7415F6BD803E84DDDA4D	882FDB8A4BF176D2A09427D6A5BDBA3051307F2605090DA848085B0D78B6FD99
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\script[1].js	ASCII text, with very long lines, with no line terminators	C05FC9430255DD778133F63AAA2874FD	23A6970E85C12ACCE64448EBFBB2A7987304E6B5	3659742C6031A157C576403757CD0BDC2173108554016ED3AFBEAC683BF13FC0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\sprite1.mouse[1].png	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced	3EDA15637AFEAC6078F56C9DCC9BBDB8	97B900884183CB8CF99BA069EEDC280C599C1B74	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\wait_animation[1].gif	GIF image data, version 89a, 24 x 24	93DE6FB07C1382459E473381DA5D0E7E	4E1208D482A7ABA8C86FDCF8E0E92C90BB8C8C8A	E97FA0CFE4B0A7BB22E9713A67D4667DA064E674A944D607E78F0D3BF48E57A5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\wcp-consent[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	38B769522DD0E4C2998C9034A54E174E	D95EF070878D50342B045DCF9ABD3FF4CCA0AAF3	208EDBED32B2ADAC9446DF83CAA4A093A261492BA6B8B3BCFE6A75EFB8B70294
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Button[1].js	UTF-8 Unicode (with BOM) text, with CRLF line terminators	8EDFCD3F7A179CFF6B123DFF50F29770	7A2D9BB4B9F6072AB3049E6421021A5BA0A3DADF	D0B747C7F7414A08B0D5107832B2F4BB44A9BB4A3AAD28390F58EDE8BBEA6AE1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Print[1].png	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	B8E8859FCD4E43D51233559C17A3C7BD	F0CA023F26A84761995FA0BF6935DE6A3B8AE6F8	DC15A37B4015D0DECF639006E4F9002E742DDBFD7C669EC0AE469057F238B78D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\RE1Mu3b[1].png	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced	9F14C20150A003D7CE4DE57C298F0FBA	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ScriptResource[1].js	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	AECA88483779AC14B47F14389139050F	B2D6ADDFD778216B8577A9788144F6313900B05E	38DEAF33D1C84196E4C4F3C76C67587090CF261D423B9BEF9BADF535BC146A2F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\WLSPHIP0[1].js	ASCII text, with very long lines, with no line terminators	0DAB95A479CBD93DCD76FC4CEFBDDF1E	F1B3459836342CCD3C0D428D7869EE6B560C90CF	CC205A1B227C80259A31CCC6DDD18C741A5181ED509CAD51CEC982938482FFD8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\WebResource[1].js	ASCII text, with CRLF line terminators	A870B45AC5D6B0D4E18C4829C7B660B4	2D3CA0E1F19EFDEB9B2DD3DCFFB17F8ABA118AA0	144524233F795D6A425B76F7AE5C0BB622B5F67E2E6AE73532AD526528CA07CF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\arrow_px_up[1].gif	GIF image data, version 89a, 7 x 9	95B65C94F57061E15ECC8304D3E578D5	A7483D668A780949FDA842F39877A3C08D0FC51C	BDA2D6EB8E72B3DBCA5EEF086178033F8A2BB3481180B2C63295FCF23843D960
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\boot.worldwide.0.mouse[1].js	data	28F6EC975640EB85D7DEB22869E678DF	2D0762DA50E6A1642B7963A32B6D18539400E654	B88D28CE1DD239D22B340EE75A22564D491D730E30163F6897760E021922145A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\boot.worldwide.2.mouse[1].js	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	9777C2756E99F1650DD5EAA7F1D752CE	82327E8C6D607D1F1DFD0B87D9DA3DABE3134747	6B7BDC7C341F44984916417B6D9CAC264CB7E6D2318E361169873F2B8598CB68
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\boot.worldwide.mouse[1].css	ASCII text, with very long lines, with no line terminators	AF8D946B64D139A380CF3A1C27BDBEB0	C76845B6FFEAF14450795C550260EB618ABD60AB	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\hip_reload[1].png	PNG image data, 17 x 25, 8-bit/color RGBA, non-interlaced	C651D60A08FF0F579E2EB9BE6043A3C6	E7BCBB896EEA20A4DC68EDD2EF5B336E92690A55	7B4B6ADAA1DDA648143A18A52B51DFAAB54775BDB6284DFF5C869235CD385230
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\icons[1].eot	Embedded OpenType (EOT), icons family	77E1987DF3A0274C5A51E3C55CEE7C98	9B0FE96AF141AB09183F386F65BC627B8C396460	EF04649D4D068673CF0FA47EF4C45C8BE291E703F4EC5FC0E507F17839120AA2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ltrStyle[1].css	ASCII text, with CRLF line terminators	11FE4E6509513DB245F1F97E37C5D3AB	05322C35B6BFAE84CE8C626BD7B1F8C4A6F15A6D	78D437B40A85299F96ED9D02E35F23FD3D3EF63D844D8D2523A15516F7E1D09C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\prefetch[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	EBB49739997B3A101202FFFB066BE274	C4F4123B37540FA1E5E618FE0C55897228038811	894F3D952917C82FFAEA6E57BC0AE0943D21486F83141DFEB1DE1AA888D03208
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\script[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	633B23CA8A850C508C146635DB4239F5	CF78DA53BD7561F3ACB33710016ECBF60E9F0204	DAA1677D2640BE8A77F6C69EEE3911D2F8CF81DAA7BB604800A2D63A8F130C95
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ux.converged.login.strings-en.min_lx3ffqwkjnm_dkzr2tvi6q2[1].js	UTF-8 Unicode text, with very long lines	957DDF7EA58A26733F764CD1DAD562E9	FC998E6D9BE4772E46CCFE69A0550AB2B0436031	0EDEF2F99395BE4398797ED6C766FC909ED2092C1E3CA19700ECBFA4F84D0602
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\2c-511e5e[1].css	UTF-8 Unicode text, with very long lines	FC80EE0EE4C1195A0A3573C1F22E53A8	82AEF853A84BE4A2C3684E67ED83F577DF61557A	1B61B75684F6AC70F426526277CC6730A26CA157B7632FF0EB6A2DC4D15D94C8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Captcha[1].js	ASCII text, with CRLF line terminators	AB4BD988E2CD7E4B87BF3CA0D8D3699A	B7F175941DE1A9E6E9C54DCCC3815275412C75F7	099D9AB7AB562660430A9E29DF9958DE22ADA5E6C0AEDA7E2BC538C06EA6E56C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2[1].js	ASCII text, with very long lines	C749CEEA6F1F1BB65E62E69CF00334B3	1D922B7324A4D418B49CA5B7D136136C5BC92540	4C485E4A0FC9354A59B3CD2AD5DC6A834E8BDDFBAD0E2F90C6CA1B05C0AB7379
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Me[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	E86EF8B6111E5FB1D1665BCDC90888C9	994BF7651CB967CD9053056AF2D69ACB74DB7F29	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\authorize[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators	450ED0BCD4C5E64113D42BD5A6A6CB26	9CE6422AA381D2572587D9BAC86F838BB1C18F3E	EA5C272226BBB70EC05205D0E5116890AB8CD282C17FFE05ED74EAE10D8B83E0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\boot.worldwide.3.mouse[1].js	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	F0FBF177666DB01F51C14B917F4870EE	6584F8DAA8C7169967FEA3EB9F0B4E4B6B4B24A5	EC220E224E4311E0F63CAF53F49C7820D7FF660495559E6E820CE03A65F00A79
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\converged.v2.login.min_ty_bk5wxx82kilmq7o6qlw2[1].css	ASCII text, with very long lines	B72FC12B9597C7CD8A8A5310ECEE902F	301AD20CCEF3B7247E716DA874E43B193AB3CBF2	2D7A11BA79B08B7C687E4A80E11E5004E2CE2786FA96666104BFE3A4289F658B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\footer_logo_grey_bg[1].png	PNG image data, 63 x 13, 8-bit/color RGBA, non-interlaced	61C8156DB6005270471F0D30028109D2	A7812D8A455EB610B76E0812612DD24723DD670B	03FC3A195518A32D83712F7BEC2275A95DCC71E6CC52D8D2648DFBBEC9F5AFEA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\hip_speaker[1].png	PNG image data, 16 x 25, 8-bit/color RGBA, non-interlaced	D4FFE61373F6AA32EEB8CA7CD41AB980	4925FAC4BC73EFB7C7BBC32B11C435ECF1D61674	D5C54FFC6B8BD44D932BE8F37B1CD5B666205C7574F9D56EF68E56F83E08FFAD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\jquery-1.11.2.min[1].js	ASCII text, with very long lines	5790EAD7AD3BA27397AEDFA3D263B867	8130544C215FE5D1EC081D83461BF4A711E74882	2ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\jquery-1.7.2.min[1].js	HTML document, UTF-8 Unicode text, with very long lines	B8D64D0BC142B3F670CC0611B0AEBCAE	ABCD2BA13348F178B17141B445BC99F1917D47AF	47B68DCE8CB6805AD5B3EA4D27AF92A241F4E29A5C12A274C852E4346A0500B4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\jquery-3.5.0.min[1].js	ASCII text, with very long lines	12108007906290015100837A6A61E9F4	1D6AE46F2FFA213DEDE37A521B011EC1CD8D1AD3	C4DCCDD9AE25B64078E0C73F273DE94F8894D5C99E4741645ECE29AEEFC9C5A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\latest[1].eot	Embedded OpenType (EOT), Segoe UI family	CAD76E4816AF6890C9BFD02A6D1EA899	9EDC91541C31034FCE0D83AABBAAD4C314CD3D33	D5794223D1A062E5DBE6C34C1994C8CE3792B24AFD5218D0644CB1F53DA4BE58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\marching_ants_b540a8e518037192e32c4fe58bf2dbab[1].gif	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\marching_ants_white_166de53471265253ab3a456defe6da23[1].gif	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\mwfmdl2-v3.54[1].woff	Web Open Font Format, TrueType, length 26288, version 0.0	D0263DC03BE4C393A90BDA733C57D6DB	8A032B6DEAB53A33234C735133B48518F8643B92	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\privacystatement[1].htm	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	1290AC44199311DF017E0F1FA015139B	947A640F3DD4A44BF9EAF1AA3D50464777772DE1	7ADDE3ABEE9CD0FB24C9059D868D8003D31B47CFB4AF269CC4E2C70AE6607DF5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\servicesagreement[1].htm	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	73FEAE91CD8EDFC1D6BFD691A7E9F1B5	AAF5B9D8F6BADBC495FCAFFF4065E5B1940342DF	909027BD5D13456438D702E7D06BE44CD77B101C8051FC3C027D8B00610EFD1E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\style[1].css	ASCII text, with very long lines, with no line terminators	B4477ABE2C9D12A8E10E11928E504297	19A176757F612216F0230DE4A3D3F95D68F175B1	3FCD581519B018D93D9DAE37D5970AC475B48502107BCB00EB59856563BF9FF0
C:\Users\user\AppData\Local\Temp\~DF2DFEAE3E0070E465.TMP	data	27956FF4701B942E0804EB1C1E960943	13C3D79E35851D080673A3A48074DB71CDE32170	6BD39F2599FF35AE8DDA09F34DB3F3FA63D4D75087EDFDEC70F1E37BADD0ED10
C:\Users\user\AppData\Local\Temp\~DF413D4DB43C013591.TMP	data	55C9BD47759A51E9CDB7F704A20008B7	42F98C286CDD8B82C4B248080449803588DA7414	7C4488CDF6E3CC630958ED043F5D42B1BFD9887B892EDC733636AC4402136B29
C:\Users\user\AppData\Local\Temp\~DFBD4713F5E6AB51CA.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA

Phishing:

Found iframes

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

HTML body contains low number of good links

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: Title: Sign in to Outlook does not match URL

META author tag missing

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: No <meta name="copyright".. found

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&msaredir=0&client-request-id=62eff2f5-5e8a-42e2-8c42-31d84b5e6a25&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=637584235492860407.d19e0b10-7d62-4ff8-a99e-6f8ae9033ca6&state=VYtBDoIwEEVBz4I7atspLbMwRkQSFxjDDSodjBEoQdQreGzZuHDx_uLlvzAIguXMYibk8wRGg0lSJSFRKFPNFTfMCSR-ETw2TstYNU0aW0SKdZNaQg5QWx3O7Sdc-7ddb183enfeUbupyLqSHg97peNE3erYTzT2NP1cvomgLk_yXAkoM8U1ikIVeWLyncRDlhSyQHHYG8gwUvzvyHrbDaMTwIbRO-afU-v9ndW-i4C-

HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Software Vulnerabilities:

Potential browser exploit detected (process start blacklist hit)

Source: C:\Program Files\internet explorer\iexplore.exe

Process created: C:\Windows\System32\TokenBrokerCookies.exe

Networking:

Found strings which match to known social media urls

Source: privacystatement[1].htm.3.dr	String found in binary or memory: <ul><li>Sources of personal data: Interactions with users</li><li>Purposes of Processing (Collection and Sharing with Third Parties): Provide our products; product improvement; product development; customer support; and help, secure, and troubleshoot</li><li>Recipients: Service providers and user-directed entities</li></ul></li></ul><p>While the bulleted list above contains the primary sources and purposes of processing for each category of personal data, we also collect personal data from the sources listed in the <a class="mscom-link" href="#mainpersonaldatawecollect">Personal data we collect</a> section, such as developers who create experiences through or for Microsoft products. Similarly, we process all categories of personal data for the purposes described in the <a class="mscom-link" href="#mainhowweusepersonaldatamodule">How we use personal data</a> section, such as meeting our legal obligations, developing our workforce, and doing research.</p><p><strong>Disclosures of personal data for business or commercial purposes</strong>. As indicated in the <a class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section, we share personal data with third parties for various business and commercial purposes. The primary business and commercial purposes for which we share personal data are the purposes of processing listed in the table above. However, we share all categories of personal data for the business and commercial purposes in the <a class="mscom-link" href="#mainreasonswesharepersonaldatamodule">Reasons we share personal data</a> section.</p><p>See our <a class="mscom-link" href="https://aka.ms/ccpa">CCPA Notice</a> for additional information.</p></span></div><div class="divModuleDescription"><span id="Header13">Advertising</span><span id="navigationHeader13">Advertising</span><span id="moduleName13">mainadvertisingmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription13"><p>Advertising allows us to provide, support, and improve some of our products. Microsoft does not use what you say in email, chat, video calls or voice mail, or your documents, photos, or other personal files to target ads to you. We use other data, detailed below, for advertising in our products and on third-party properties. For example:</p><ul><li>Microsoft may use data we collect to select and deliver some of the ads you see on Microsoft web properties, such as <a target="_blank" class="mscom-link" href="https://www.microsoft.com">Microsoft.com</a>, MSN, and Bing.</li><li>When the advertising ID is enabled in Windows 10 as part of your privacy settings, third parties can access and use the advertising ID (much the same way that websites can access and use a unique identifier stored in a cookie) to select and deliver ads in such apps.</li><li>We may share data we collect with partners, such as Verizon Media, AppNexus, or Facebook (see below), so tha
Source: privacystatement[1].htm.3.dr	String found in binary or memory: s <a target="_blank" class="mscom-link" href="https://www.linkedin.com/legal/privacy-policy">Privacy Policy</a>.</p></span></div><div class="divModuleDescription"><span id="Header29">Search, Microsoft Edge, and artificial intelligence</span><span id="navigationHeader29">Search, Microsoft Edge, and artificial intelligence</span><span id="moduleName29">mainsearchaimodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription29" aria-expanded="false"><p>Search and artificial intelligence products connect you with information and intelligently sense, process, and act on information equals www.linkedin.com (Linkedin)
Source: privacystatement[1].htm.3.dr	String found in binary or memory: s health, oral health, osteoporosis, skin health, sleep, and vision / eye care. We will also personalize ads based on custom, non-sensitive health-related interest categories as requested by advertisers.</li><li><strong>Children and advertising</strong>. We do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 16 years of age.</li><li><strong>Data retention</strong>. For personalized advertising, we retain data for no more than 13 months, unless we obtain your consent to retain the data longer.</li><li><strong>Data sharing</strong>. In some cases, we share with advertisers reports about the data we have collected on their sites or ads.</li></ul><p><strong>Data collected by other advertising companies</strong>. Advertisers sometimes include their own web beacons (or those of their other advertising partners) within their advertisements that we display, enabling them to set and read their own cookie. Additionally, Microsoft partners with third-party ad companies to help provide some of our advertising services, and we also allow other third-party ad companies to display advertisements on our sites. These third parties may place cookies on your computer and collect data about your online activities across websites or online services. These companies currently include, but are not limited to: <a target="_blank" class="mscom-link" href="https://www.appnexus.com/">AppNexus</a>, <a target="_blank" class="mscom-link" href="https://www.facebook.com/help/568137493302217">Facebook</a>, <a target="_blank" class="mscom-link" href="https://www.media.net/adchoices">Media.net</a>, <a target="_blank" class="mscom-link" href="https://my.outbrain.com/recommendations-settings/home">Outbrain</a>, <a target="_blank" class="mscom-link" href="https://www.taboola.com/privacy-policy#user-choices-and-optout">Taboola</a> and <a target="_blank" class="mscom-link" href="https://www.verizonmedia.com/policies/us/en/verizonmedia/privacy/index.html">Verizon Media</a>. Select any of the preceding links to find more information on each company's practices, including the choices it offers. Many of these companies are also members of the <a target="_blank" class="mscom-link" href="https://www.networkadvertising.org/managing/opt_out.aspx">NAI</a> or <a target="_blank" class="mscom-link" href="https://www.aboutads.info/choices/">DAA</a>, which each provide a simple way to opt out of ad targeting from participating companies.</p></span></div><div class="divModuleDescription"><span id="Header59">Speech recognition technologies</span><span id="navigationHeader59">Speech recognition technologies</span><span id="moduleName59">mainspeechrecognitionmodule</span><div class="printsummary" style="display: block;">Summary</div><span class="Description" id="ShortDescription59"><p>Speech equals www.facebook.com (Facebook)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: outlook.office365.com

URLs found in memory or binary data

Source: icons[1].eot.3.dr	String found in binary or memory: http://fontello.com
Source: icons[1].eot.3.dr	String found in binary or memory: http://fontello.comiconsRegulariconsiconsVersion
Source: boot.worldwide.0.mouse[1].js.3.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: 17-f90ef1[1].js.3.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2[1].js.3.dr	String found in binary or memory: http://knockoutjs.com/
Source: privacystatement[1].htm.3.dr	String found in binary or memory: http://www.asp.net/ajaxlibrary/CDN.ashx.
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: http://www.mpegla.com
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: http://www.mpegla.com).
Source: ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2[1].js.3.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: authorize[1].htm.3.dr	String found in binary or memory: https://aadcdn.msauth.net
Source: authorize[1].htm.3.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ty_bk5wxx82kilmq7o6qlw2
Source: authorize[1].htm.3.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_lx3ffqwkjnm_
Source: imagestore.dat.3.dr, authorize[1].htm.3.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: imagestore.dat.3.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
Source: imagestore.dat.3.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
Source: authorize[1].htm.3.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2.js
Source: HHJ4JFEM.htm.3.dr	String found in binary or memory: https://account.live.com/resetpassword.aspx
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://aka.ms/DPA
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://aka.ms/ccpa
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://aka.ms/kinectprivacy/
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://aka.ms/redeemrewards
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://aka.ms/redeemrewards).
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://aka.ms/taxservice
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://aka.ms/useterms
Source: HHJ4JFEM.htm.3.dr	String found in binary or memory: https://client.hip.live.com/GetHIP/GetWLSPHIP0/WLSPHIP0?fid=952b2fd09d2040beb48658260a032379&id=2825
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://developer.yahoo.com/flurry/end-user-opt-out/
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protectio
Source: ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2[1].js.3.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: app[1].css.3.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: authorize[1].htm.3.dr	String found in binary or memory: https://login.live.com/Me.htm?v=3
Source: authorize[1].htm.3.dr	String found in binary or memory: https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
Source: authorize[1].htm.3.dr	String found in binary or memory: https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
Source: authorize[1].htm.3.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?response_type=code
Source: {78C22AF3-C5A3-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://login.microsof
Source: Me[1].htm.3.dr	String found in binary or memory: https://login.microsoftonline.com
Source: TokenBrokerCookies.exe, 00000006.00000002.211304305.0000020224660000.00000004.00000020.sdmp, TokenBrokerCookies.exe, 00000006.00000002.211317672.000002022466C000.00000004.00000020.sdmp, ~DF2DFEAE3E0070E465.TMP.2.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: TokenBrokerCookies.exe, 00000006.00000002.211304305.0000020224660000.00000004.00000020.sdmp	String found in binary or memory: https://login.microsoftonline.com/0tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoft
Source: ~DF2DFEAE3E0070E465.TMP.2.dr, {78C22AF3-C5A3-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-00000000
Source: authorize[1].htm.3.dr	String found in binary or memory: https://login.microsoftonline.com/jsdisabled
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://login.skype.com/login
Source: Me[1].htm.3.dr	String found in binary or memory: https://login.windows-ppe.net
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://mixer.com/about/tos
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://mixer.com/contact
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://mixpanel.com/optout
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://ondemand.webtrends.com/support/optout.asp
Source: ~DF2DFEAE3E0070E465.TMP.2.dr	String found in binary or memory: https://outlook.office365.com/owa/prefetch.aspx
Source: ~DF2DFEAE3E0070E465.TMP.2.dr	String found in binary or memory: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2frep
Source: imagestore.dat.3.dr	String found in binary or memory: https://passwordreset.microsoftonline.com/favicon.ico?v=1342177280
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://playfab.com/terms/
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://priv-policy.imrworldwide.com/priv/browser/us/en/optout.html
Source: {78C22AF3-C5A3-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://privacy.micros
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/resources/images/0/sprite1.mouse.css
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/resources/images/0/sprite1.mouse.png
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/resources/styles/0/boot.worldwide.mouse.css
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/resources/styles/fonts/office365icons.eot?#iefix
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/resources/styles/fonts/office365icons.svg
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/resources/styles/fonts/office365icons.ttf
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/resources/styles/fonts/office365icons.woff
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/scripts/boot.worldwide.0.mouse.js
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/scripts/boot.worldwide.1.mouse.js
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/scripts/boot.worldwide.2.mouse.js
Source: prefetch[1].htm.3.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4195.24/scripts/boot.worldwide.3.mouse.js
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://signin.kissmetrics.com/privacy/#controls
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://skype.com/go/myaccount
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://support.xbox.com/help/family-online-safety/online-safety/manage-online-safety-and-privacy-se
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://support.xbox.com/help/friends-social-activity/community/use-safety-settings
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://tools.google.com/dlpage/gaoptout
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.aboutads.info/
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.acuityads.com/opt-out/
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.adjust.com/opt-out/
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.adr.org
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.appnexus.com/
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.appsflyer.com/optout
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.clicktale.net/disable.html
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.google.com/intl/en_ALL/help/terms_maps.html
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.here.com/)
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.linkedin.com/legal/privacy-policy
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html
Source: {78C22AF3-C5A3-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://www.microsoft.
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.optimizely.com/legal/opt-out/
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.privacyshield.gov/welcome
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com).
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/allrates
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/legal
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/legal.broadcast
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/store.reactivate.credit
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.skype.com/go/ustax
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/Legal/ThirdPartyDataSharing
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/en-US/Legal/CodeOfConduct
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/en-US/Legal/CodeOfConduct)
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/legal/codeofconduct
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/managedatacollection
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios
Source: servicesagreement[1].htm.3.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios)
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.youradchoices.ca
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.youradchoices.ca/fr
Source: privacystatement[1].htm.3.dr	String found in binary or memory: https://www.youronlinechoices.com/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726

System Summary:

Classification label

Source: classification engine

Classification label: clean2.win@5/75@10/1

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF413D4DB43C013591.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Windows\System32\TokenBrokerCookies.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5152 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0__ACVU0zUjvqM4Y6d24ALoxBETqssmguKqaDL2a8nL_B8Gsk-t06EewKx1iZIU_QZurVnBm38-ZJrNjP-hxQ73UgAA&rid=d017ee17-3f95-4a63-90d1-f573af302100 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 0 30893232 1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5152 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0__ACVU0zUjvqM4Y6d24ALoxBETqssmguKqaDL2a8nL_B8Gsk-t06EewKx1iZIU_QZurVnBm38-ZJrNjP-hxQ73UgAA&rid=d017ee17-3f95-4a63-90d1-f573af302100 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 0 30893232 1			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: TokenBrokerCookies.exe, 00000006.00000002.211317672.000002022466C000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$

HIPS / PFW / Operating System Protection Evasion:

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0__ACVU0zUjvqM4Y6d24ALoxBETqssmguKqaDL2a8nL_B8Gsk-t06EewKx1iZIU_QZurVnBm38-ZJrNjP-hxQ73UgAA&rid=d017ee17-3f95-4a63-90d1-f573af302100 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 0 30893232 1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0__ACVU0zUjvqM4Y6d24ALoxBETqssmguKqaDL2a8nL_B8Gsk-t06EewKx1iZIU_QZurVnBm38-ZJrNjP-hxQ73UgAA&rid=d017ee17-3f95-4a63-90d1-f573af302100 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 0 30893232 1			Jump to behavior