Windows Analysis Report https://onedrive.live.com/view.aspx?resid=6D19EDE7FC50E305!4688&ithint=onenote%2c&wdo=2&authkey=!AmkKdVYlk0odzic

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://onedrive.live.com/view.aspx?resid=6D19EDE7FC50E305!4688&ithint=onenote%2c&wdo=2&authkey=!AmkKdVYlk0odzic

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://onedrive.live.com/redir?resid=6D19EDE7FC50E305%214688&authkey=%21AmkKdVYlk0odzic&page=View&wd=target%28New%20Section%201.one%7Cfeabb4b3-4657-406d-aa0c-de2c041b0b0a%2FAngela%20Smith%20%28C2S%5C%29%7C79bf45d1-e0d8-4892-b55d-e15e834a4de0%2F%29	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Phishing site detected (based on shot template match)

Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html

Matcher: Template: office matched

Yara detected HtmlPhish10

Source: Yara match

File source: 53636.pages.csv, type: HTML

Yara detected HtmlPhish7

Source: Yara match

File source: 53636.pages.csv, type: HTML

Found iframes

Source: https://www.carerstas.org/	HTTP Parser: Iframe src: https://chat-val1.sky.shoretel.com.au/chat?token=U2FsdGVkX19PXcGVTX05RkjuPd9gT2D5REWnxKSv9T%2BnyiFx66%2F6B6f7hosXyvHGNq9npqkqCwCPJ31ucKeLiQ%3D%3D
Source: https://www.carerstas.org/	HTTP Parser: Iframe src: https://chat-val1.sky.shoretel.com.au/chat?token=U2FsdGVkX19PXcGVTX05RkjuPd9gT2D5REWnxKSv9T%2BnyiFx66%2F6B6f7hosXyvHGNq9npqkqCwCPJ31ucKeLiQ%3D%3D

HTML body contains low number of good links

Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	HTTP Parser: Number of links: 0
Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	HTTP Parser: Title: Share Point Online does not match URL
Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	HTTP Parser: Title: Share Point Online does not match URL

Suspicious form URL found

Source: https://www.carerstas.org/	HTTP Parser: Form action: https://www.carerstas.org/wp-admin/admin-ajax.php
Source: https://www.carerstas.org/	HTTP Parser: Form action: https://www.carerstas.org/wp-admin/admin-ajax.php

META author tag missing

Source: https://www.carerstas.org/	HTTP Parser: No <meta name="author".. found
Source: https://www.carerstas.org/	HTTP Parser: No <meta name="author".. found
Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	HTTP Parser: No <meta name="author".. found
Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://www.carerstas.org/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.carerstas.org/	HTTP Parser: No <meta name="copyright".. found
Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	HTTP Parser: No <meta name="copyright".. found
Source: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html	HTTP Parser: No <meta name="copyright".. found

Compliance:

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 52.20.88.154:443 -> 192.168.2.3:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.20.88.154:443 -> 192.168.2.3:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.15.177.83:443 -> 192.168.2.3:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.15.177.83:443 -> 192.168.2.3:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.68:443 -> 192.168.2.3:49914 version: TLS 1.2

Networking:

Downloads files from webservers via HTTP

Source: global traffic

HTTP traffic detected: GET /user/CarersAustralia HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Found strings which match to known social media urls

Source: Network Action Predictor-journal.0.dr	String found in binary or memory: +www.youtube.comSH3 equals www.youtube.com (Youtube)
Source: Network Action Predictor.0.dr	String found in binary or memory: +www.youtube.comSQLite format 3 equals www.youtube.com (Youtube)
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: +www.youtube.comd equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: +http://www.youtube.com/user/CarersAustralia) equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: http://www.youtube.com/user/CarersAustralia equals www.youtube.com (Youtube)
Source: History.0.dr	String found in binary or memory: http://www.youtube.com/user/CarersAustraliaBefore you continue to YouTube equals www.youtube.com (Youtube)
Source: History.0.dr	String found in binary or memory: http://www.youtube.com/user/CarersAustraliaBefore you continue to YouTube/&I8j equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Fuser%2FCarersAustralia&gl=DE&m=0&pc=yt&uxe=23983172&hl=en&src=1 equals www.youtube.com (Youtube)
Source: Current Session.0.dr	String found in binary or memory: https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Fuser%2FCarersAustralia&gl=DE&m=0&pc=yt&uxe=23983172&hl=en&src=1" equals www.youtube.com (Youtube)
Source: History.0.dr	String found in binary or memory: https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Fuser%2FCarersAustralia&gl=DE&m=0&pc=yt&uxe=23983172&hl=en&src=1Before you continue to YouTube equals www.youtube.com (Youtube)
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: Favicons.0.dr	String found in binary or memory: https://www.youtube.com/user/CarersAustralia equals www.youtube.com (Youtube)
Source: History.0.dr	String found in binary or memory: https://www.youtube.com/user/CarersAustraliaBefore you continue to YouTube equals www.youtube.com (Youtube)
Source: History.0.dr	String found in binary or memory: https://www.youtube.com/user/CarersAustraliaBefore you continue to YouTube/&I8j equals www.youtube.com (Youtube)
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: accounts.google.com

URLs found in memory or binary data

Source: 77EC63BDA74BD0D0E0426DC8F8008506.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619.2.dr	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1Jg
Source: Current Session.0.dr	String found in binary or memory: http://www.youtube.com/user/CarersAustralia
Source: Current Session.0.dr	String found in binary or memory: http://www.youtube.com/user/CarersAustralia)
Source: History.0.dr	String found in binary or memory: http://www.youtube.com/user/CarersAustraliaBefore
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=JetxxkTQXbBIbb6mnLAqJuw%2F2RoiASojhbGfbZnFfoAnYm1j6pxqgMSgD
Source: Reporting and NEL.2.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=gEq8dhPwY1UkytWQO40HUdym6BG6I8YcMgiYIFplcwSYePRh4YuC8Yb3vj0
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr, manifest.json0.0.dr, 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: 93a3fa42e61c139b_0.0.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js
Source: 7444ea2da1317cfb_0.0.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-2.1.3.min.js
Source: Network Action Predictor.0.dr	String found in binary or memory: https://ajax.googleapis.com/
Source: 8b46160d68ace9ef_0.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 3e2bbedaae05612c_0.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.jsa
Source: 3e2bbedaae05612c_0.0.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.jsaD
Source: f7dd50aa7b62010a_0.0.dr	String found in binary or memory: https://amcdn.msftauth.net/me?partner=OneNoteOnline&version=10.21153.1&market=EN-US&wrapperId=suites
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr, manifest.json0.0.dr, 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: 7e1336de5e636e21_0.0.dr	String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161422841006_App_Scripts/Feedback/latest/Intl/en/officeb
Source: f8364b4f714413be_0.0.dr	String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161422841006_App_Scripts/Feedback/latest/officebrowserfe
Source: f4b4670831b1a07e_0.0.dr	String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161422841006_App_Scripts/wacairspaceanimationlibrary.js
Source: 8c613fe45086f549_0.0.dr	String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/h3840EF99B4A2DB1D_App_Scripts/1033/CommonIntl.js
Source: fa1d01002fa990ce_0.0.dr	String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/h4DDC354F0F9CEFBE_App_Scripts/MicrosoftAjax.js
Source: Favicons.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/resources/1033/FavIcon_OneNote.ico
Source: Favicons-journal.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/resources/1033/FavIcon_OneNote.icoo
Source: 0c4f76bc9948f161_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/1033/OneNoteSimplified.Wac.TellMeM
Source: 16340eff19163927_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/1033/onenote-intl-mlr.min.js
Source: 01d56f85fcf36e57_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/1033/onenote-navpane-strings.min.j
Source: a53b4e3cadcbcff7_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/1033/onenote-ribbon-intl.min.js
Source: fa6ae69e6b1cda5f_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/1033/onenote-ribbon-sprite-lazy.mi
Source: 39597f7a2598659b_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/1033/osfruntime_strings.js
Source: 70c5f79a20d7c19a_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/OfficeExtension.WacRuntime.js
Source: 9b861f4f1e31fc0c_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/OneNote.box4.dll2.js
Source: fd614a77a23f29c9_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/OneNoteSimplified.Wac.TellMeSugges
Source: bf0db5b427e5ae53_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/OsfRuntimeOneNoteWAC.js
Source: 4182f1030b800523_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/appChrome.min.js
Source: 7a18e3b94e250828_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/appChromeLazy.min.js
Source: 85e8ac3d6be0bb1e_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/appIconsLazy.min.js
Source: 25fca449c6419db1_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/common.min.js
Source: 84adf25c53dc709b_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/common50.min.js
Source: 7024f4d721d757de_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/navigation.min.js
Source: b23d09ab620aa1ef_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/onenoteloadingspinner.min.js
Source: 5b5d233b0df36a30_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/oreolazy.min.js
Source: f48eb5b8f36e28d4_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/oreonavpane.min.js
Source: 3757caaac04124bb_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/oreonotebookpane.min.js
Source: f870cbbc02c2eb01_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/oreosearchpane.min.js
Source: fbebf9e59cbd7a69_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/otelFullNext.min.js
Source: ad9e944bd394efe3_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/suiteux-shell/js/suiteux.shell.con
Source: b65505ee42b55cbc_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/suiteux-shell/js/suiteux.shell.cor
Source: 7443c59885307838_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/suiteux-shell/js/suiteux.shell.plu
Source: befe9a9f3a9dfff9_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161422841006_App_Scripts/uiSlice20.min.js
Source: de272f24ef9bbe31_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/App_Scripts/onenote-boot.min.js
Source: 7cd4eb7d184ef6b5_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h06FE78141D1F3A43_App_Scripts/Compat.js
Source: 0d823774bcf8ab48_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h20EE243128380A7C_App_Scripts/OneNote.js
Source: 387591b72ede2a53_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h29DB8AD8C3F08967_App_Scripts/1033/WoncaIntl.js
Source: 6c15093a77a10c4f_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h46DC57A63CA47BFD_App_Scripts/wacBoot.min.js
Source: 60ed1c0ff7521094_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h59153778561F077B_App_Scripts/onenoteSync.min.js
Source: e108bab6bc784838_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h843B79E00F5EF700_App_Scripts/1033/Box4Intl.js
Source: 3d1de28c02c47e76_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h951908169C0A1023_App_Scripts/OneNote.box4.dll1.js
Source: 2a6d39a584067f73_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/hB744C66492427301_App_Scripts/common.min.js
Source: 089da834c75847e1_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/hCF8E38AF39F430EA_App_Scripts/jSanity.js
Source: 037cdee0c4df1781_0.0.dr	String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/hF22878783B5945D1_App_Scripts/1033/OneNoteIntl.js
Source: 3d15352b86760613_0.0.dr, f6f4050961481f4c_0.0.dr, 2e17586a34511a75_0.0.dr, 7a7cbbb061b7d3ad_0.0.dr	String found in binary or memory: https://carerstas.org/
Source: 4f63388fc455ad8b_0.0.dr	String found in binary or memory: https://carerstas.org/%:
Source: 93d0484bc8509016_0.0.dr	String found in binary or memory: https://carerstas.org/(
Source: 4e0df94fb5b151f1_0.0.dr	String found in binary or memory: https://carerstas.org/-
Source: 13c7a8f8e6d65b26_0.0.dr	String found in binary or memory: https://carerstas.org/:
Source: 8297c6eea7e17e54_0.0.dr	String found in binary or memory: https://carerstas.org/D
Source: 31ef63c343cc0cc0_0.0.dr	String found in binary or memory: https://carerstas.org/j
Source: fb7951fb4dc2d6f3_0.0.dr	String found in binary or memory: https://carerstas.org/k
Source: 342c0c4b64ca0aec_0.0.dr	String found in binary or memory: https://carerstas.org/l
Source: 73b3e40d69702015_0.0.dr	String found in binary or memory: https://carerstas.org/q
Source: 0b6b9e15d9cf31cc_0.0.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161431940452_Scripts/BrowserUls.js
Source: 2969aba05e5947da_0.0.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161431940452_Scripts/CommonDiagnostics.js
Source: 1094ae1f18b7c0dd_0.0.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161431940452_Scripts/ExternalResources/js-cookie.js
Source: 814f537aabf48ca4_0.0.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161431940452_Scripts/Instrumentation.js
Source: 0bbea07133399f2e_0.0.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161431940452_Scripts/LearningTools/LearningTools.js
Source: 280468630fb430bd_0.0.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161431940452_Scripts/aria-web-telemetry-2.9.0.min.js
Source: 6f03db395c193bb0_0.0.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161431940452_Scripts/pickadate.min.js
Source: 52fc0a871822482c_0.0.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: eec191c56f315a0c_0.0.dr	String found in binary or memory: https://chat-val1.sky.shoretel.com.au/assets/proxy-0.2.0.js
Source: Current Session.0.dr	String found in binary or memory: https://chat-val1.sky.shoretel.com.au/chat?token=U2FsdGVkX19PXcGVTX05RkjuPd9gT2D5REWnxKSv9T%2BnyiFx6
Source: 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://code.jquery.com/
Source: 0a75a9a55cba1243_0.0.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: Current Session.0.dr	String found in binary or memory: https://consent.youtube.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://consent.youtube.com/
Source: Current Session.0.dr, History.0.dr	String found in binary or memory: https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Fuser%2FCarersAustralia&gl=DE&
Source: manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: 000003.log4.0.dr	String found in binary or memory: https://content.growth.office.net/mirrored/resources/programmablesurfaces/prod/officewebsurfaces.cor
Source: Reporting and NEL.2.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr, 89b3f0e0-e9c4-47a5-b765-7e24951a679a.tmp.2.dr, 4cadf0d2-2ddc-44c4-8fed-0c6bac8e3233.tmp.2.dr, 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://dns.google
Source: manifest.json0.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://fonts.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: manifest.json0.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: Network Action Predictor.0.dr	String found in binary or memory: https://ka-f.fontawesome.com/
Source: Network Action Predictor.0.dr	String found in binary or memory: https://kit.fontawesome.com/
Source: c591876147cc49bb_0.0.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: 25fca449c6419db1_0.0.dr, fda72ad3a2acff94_0.0.dr, de272f24ef9bbe31_0.0.dr, b65505ee42b55cbc_0.0.dr, 2a6d39a584067f73_0.0.dr	String found in binary or memory: https://live.com/
Source: f4b4670831b1a07e_0.0.dr	String found in binary or memory: https://live.com/)
Source: 84adf25c53dc709b_0.0.dr	String found in binary or memory: https://live.com/0$
Source: 7cd4eb7d184ef6b5_0.0.dr	String found in binary or memory: https://live.com/:
Source: 70c5f79a20d7c19a_0.0.dr	String found in binary or memory: https://live.com/J8
Source: 0d823774bcf8ab48_0.0.dr	String found in binary or memory: https://live.com/Xt
Source: 85e8ac3d6be0bb1e_0.0.dr	String found in binary or memory: https://live.com/_
Source: b23d09ab620aa1ef_0.0.dr	String found in binary or memory: https://live.com/_n
Source: befe9a9f3a9dfff9_0.0.dr	String found in binary or memory: https://live.com/a
Source: ad9e944bd394efe3_0.0.dr	String found in binary or memory: https://live.com/b
Source: a5534787ec2d07e5_0.0.dr	String found in binary or memory: https://live.com/e
Source: 8c613fe45086f549_0.0.dr	String found in binary or memory: https://live.com/fF
Source: fa6ae69e6b1cda5f_0.0.dr	String found in binary or memory: https://live.com/i
Source: 7024f4d721d757de_0.0.dr	String found in binary or memory: https://live.com/k
Source: bf0db5b427e5ae53_0.0.dr	String found in binary or memory: https://live.com/m1
Source: a53b4e3cadcbcff7_0.0.dr	String found in binary or memory: https://live.com/q
Source: 387591b72ede2a53_0.0.dr	String found in binary or memory: https://live.com/rU
Source: fbebf9e59cbd7a69_0.0.dr	String found in binary or memory: https://live.com/t
Source: f48eb5b8f36e28d4_0.0.dr	String found in binary or memory: https://live.com/tZ
Source: 7a18e3b94e250828_0.0.dr	String found in binary or memory: https://live.com/v
Source: 39597f7a2598659b_0.0.dr	String found in binary or memory: https://live.com/x9
Source: 60ed1c0ff7521094_0.0.dr	String found in binary or memory: https://live.com/y
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://maps.googleapis.com/
Source: 632d11539fe1809f_0.0.dr	String found in binary or memory: https://maps.googleapis.com/maps-api-v3/api/js/45/7/common.js
Source: d68f1425663969d4_0.0.dr	String found in binary or memory: https://maps.googleapis.com/maps-api-v3/api/js/45/7/util.js
Source: 9a8f0cbc73d83a33_0.0.dr	String found in binary or memory: https://maps.googleapis.com/maps/api/js?key=AIzaSyBQJH-1kmDSnidUBqLexQId2Py2OPOpk6s&libraries=places
Source: Network Action Predictor.0.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/
Source: 63957e9a65d2b5ce_0.0.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr, 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: 000003.log4.0.dr	String found in binary or memory: https://onedrive.live.com
Source: Current Session.0.dr	String found in binary or memory: https://onedrive.live.com/
Source: fda72ad3a2acff94_0.0.dr	String found in binary or memory: https://onedrive.live.com/handlers/clientstring.mvc?mkt=en-US&group=GroupFolders&v=19.680.0514.2004&
Source: d63ef6cd3b3eaaf6_0.0.dr	String found in binary or memory: https://onedrive.live.com/handlers/clientstring.mvc?mkt=en-US&group=Office&v=19.680.0514.2004&useReq
Source: History-journal.0.dr, Favicons-journal.0.dr, Favicons.0.dr	String found in binary or memory: https://onedrive.live.com/redir?resid=6D19EDE7FC50E305%214688&authkey=%21AmkKdVYlk0odzic&page=View&w
Source: Favicons-journal.0.dr	String found in binary or memory: https://onedrive.live.com/view.aspx?resid=6D19EDE7FC50E305
Source: Current Session.0.dr	String found in binary or memory: https://onedrive.live.comh
Source: 511f06892f5a721b_0.0.dr	String found in binary or memory: https://onenote.com/
Source: 1094ae1f18b7c0dd_0.0.dr	String found in binary or memory: https://onenote.com/%
Source: 814f537aabf48ca4_0.0.dr	String found in binary or memory: https://onenote.com/EGY6I&/
Source: 2969aba05e5947da_0.0.dr	String found in binary or memory: https://onenote.com/I?Y6I&/
Source: 0bbea07133399f2e_0.0.dr	String found in binary or memory: https://onenote.com/o
Source: 280468630fb430bd_0.0.dr	String found in binary or memory: https://onenote.com/zLY6I&/
Source: 000003.log4.0.dr, 000003.log0.0.dr	String found in binary or memory: https://onenote.officeapps.live.com
Source: QuotaManager.0.dr, index.txt.tmp.0.dr, 000003.log0.0.dr	String found in binary or memory: https://onenote.officeapps.live.com/
Source: QuotaManager.0.dr	String found in binary or memory: https://onenote.officeapps.live.com//&I5
Source: Current Session.0.dr	String found in binary or memory: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=K%2B5aVlFvvUikv
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr	String found in binary or memory: https://p.sfx.ms
Source: a5534787ec2d07e5_0.0.dr	String found in binary or memory: https://p.sfx.ms//storage/aria-2.5.0.min.js
Source: manifest.json1.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr, 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://play.google.com
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr	String found in binary or memory: https://r2---sn-h0jeln7e.gvt1.com
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json1.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://secure.ewaypayments.com/
Source: 03a02edfbf4bf000_0.0.dr	String found in binary or memory: https://secure.ewaypayments.com/scripts/eCrypt.min.js?ver=1.0.7
Source: eec191c56f315a0c_0.0.dr	String found in binary or memory: https://shoretel.com.au//A
Source: Current Session.0.dr	String found in binary or memory: https://skyapi.onedrive.live.com/api/proxy?v=3
Source: d598c76bdc491128_0.0.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/jquery-1.7.2-
Source: 8ec4cb91ffcb0ae0_0.0.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac0-efa56458
Source: 161fd244fa689573_0.0.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac1-cdc297b4
Source: 9895df97930d526d_0.0.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac2-bf8b3319
Source: fbfdce35af9204d9_0.0.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac_s_office-
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr, 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: messages.json41.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: Network Action Predictor.0.dr, 8b46160d68ace9ef_0.0.dr	String found in binary or memory: https://vivacious-omniscient-crocodile.glitch.me/
Source: 0a75a9a55cba1243_0.0.dr	String found in binary or memory: https://vivacious-omniscient-crocodile.glitch.me/%
Source: Current Session.0.dr	String found in binary or memory: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html
Source: Current Session.0.dr	String found in binary or memory: https://vivacious-omniscient-crocodile.glitch.me/nikifi.html?
Source: History-journal.0.dr	String found in binary or memory: https://vivacious-omniscient-crocodile.glitch.me/nikifi.htmlShare
Source: 000003.log4.0.dr	String found in binary or memory: https://www.carerstas.org
Source: 000003.log4.0.dr	String found in binary or memory: https://www.carerstas.org%_https://www.carerstas.org
Source: Current Session.0.dr, 000003.log0.0.dr	String found in binary or memory: https://www.carerstas.org/
Source: History-journal.0.dr	String found in binary or memory: https://www.carerstas.org/Carers
Source: Current Session.0.dr	String found in binary or memory: https://www.carerstas.org/wp-admin/admin-ajax.php
Source: 15b2f0057e31afc8_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/plugins/PDFEmbedder-premium/js/all-pdfemb-premium-4.4.1.min.js?
Source: ecc432d88c5d127b_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/plugins/PDFEmbedder-premium/js/pdfjs/pdf-4.4.1.min.js?ver=4.4.1
Source: 2e17586a34511a75_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/plugins/eea-wait-lists/assets/wait_list.js?ver=1.0.2.p
Source: 31ef63c343cc0cc0_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/plugins/event-espresso-core-reg/assets/dist/eejs-core.46117e788
Source: 604d6931bff5fb68_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/plugins/event-espresso-core-reg/assets/dist/eventespresso-core-
Source: fab6fcac64671a56_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/plugins/event-espresso-core-reg/core/templates/global_assets/sc
Source: c30f431c4cd27366_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend-gt
Source: Favicons.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/themes/carers-tasmania-theme/assets/img/favicon/favicon-32x32.p
Source: 13c7a8f8e6d65b26_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/themes/carers-tasmania-theme/assets/js/min/libs.js?ver=1.0.7
Source: 40d5b677bd1c266a_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/themes/carers-tasmania-theme/assets/js/min/scripts.js?ver=1.0.7
Source: 73b3e40d69702015_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/themes/carers-tasmania-theme/assets/js/vendor/polyfills/moderni
Source: 7a7cbbb061b7d3ad_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/themes/carers-tasmania-theme/js/address-autocomplete.js?ver=1.0
Source: 4f63388fc455ad8b_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/themes/carers-tasmania-theme/js/main.js?ver=1.0.7
Source: fb7951fb4dc2d6f3_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-content/themes/carers-tasmania-theme/js/plugins.js?ver=1.0.7
Source: 705be2fd5daf9412_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/dist/hooks.min.js?ver=50e23bed88bcb9e6e14023e9961698c1
Source: 06f750bf83dfe00e_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/dist/i18n.min.js?ver=db9a9a37da262883343e941c3731bc67
Source: 1278a3537070fac5_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/dist/url.min.js?ver=0ac7e0472c46121366e7ce07244be1ac
Source: 4e0df94fb5b151f1_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19
Source: f6f4050961481f4c_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4
Source: a60edf43062c6277_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: 3d15352b86760613_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
Source: 0fe9f05ad10c0dd3_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/wp-embed.min.js?ver=5.7.2
Source: 2f746f38890cca77_0.0.dr	String found in binary or memory: https://www.carerstas.org/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
Source: 8297c6eea7e17e54_0.0.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr, manifest.json0.0.dr, 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: Network Action Predictor-journal.0.dr, manifest.json1.0.dr	String found in binary or memory: https://www.google.com/
Source: Favicons.0.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: Favicons.0.dr	String found in binary or memory: https://www.google.com/favicon.icok
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com;
Source: 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://www.googletagmanager.com/
Source: ebda34ff3ad70612_0.0.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-131753199-1
Source: 86430f50-c30e-4b70-a18a-1bdcecf49856.tmp.2.dr, 055bacbd-ab45-4019-a99c-50170e4527b9.tmp.2.dr	String found in binary or memory: https://www.gstatic.com
Source: d337806cab529f1d_0.0.dr, 9b976bc70410d415_0.0.dr, c062a2aceead67ca_0.0.dr, ed0f89c5707d795f_0.0.dr, c1dc4ffaa0c12fa2_0.0.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.ConsentUi.en.oVGyIvXwwNA.es5.O/ck=boq
Source: 93d0484bc8509016_0.0.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/vzAt61JclNZYHl6fEWIBqLbe/recaptcha__en.js
Source: manifest.json0.0.dr	String found in binary or memory: https://www.gstatic.com;
Source: 000003.log4.0.dr	String found in binary or memory: https://www.onenote.com
Source: 000003.log0.0.dr	String found in binary or memory: https://www.onenote.com/
Source: Current Session.0.dr	String found in binary or memory: https://www.onenote.com/officeaddins/learningtools/?et=
Source: Network Action Predictor-journal.0.dr	String found in binary or memory: https://www.youtube.com/
Source: Favicons.0.dr	String found in binary or memory: https://www.youtube.com/user/CarersAustralia
Source: History.0.dr	String found in binary or memory: https://www.youtube.com/user/CarersAustraliaBefore
Source: d337806cab529f1d_0.0.dr, ed0f89c5707d795f_0.0.dr	String found in binary or memory: https://youtube.com/

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 52.20.88.154:443 -> 192.168.2.3:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.20.88.154:443 -> 192.168.2.3:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.15.177.83:443 -> 192.168.2.3:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.15.177.83:443 -> 192.168.2.3:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.92.194.169:443 -> 192.168.2.3:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.68:443 -> 192.168.2.3:49914 version: TLS 1.2

System Summary:

Classification label

Source: classification engine

Classification label: mal80.phis.win@46/352@35/22

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60F93A7E-1550.pma

Jump to behavior

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\d906022d-cb63-4fe6-8a3d-739e3bfb49fc.tmp

Jump to behavior

SQL strings found in memory and binary data

Source: QuotaManager.0.dr

Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://onedrive.live.com/view.aspx?resid=6D19EDE7FC50E305!4688&ithint=onenote%2c&wdo=2&authkey=!AmkKdVYlk0odzic'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,16472128031194999999,11831640320228879507,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1700 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1576,16472128031194999999,11831640320228879507,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=5348 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1576,16472128031194999999,11831640320228879507,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=5524 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,16472128031194999999,11831640320228879507,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1700 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1576,16472128031194999999,11831640320228879507,131072 --lang=en-US --service-sandbox-type=audio --enable-audio-service-sandbox --mojo-platform-channel-handle=5348 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1576,16472128031194999999,11831640320228879507,131072 --lang=en-US --service-sandbox-type=video_capture --enable-audio-service-sandbox --mojo-platform-channel-handle=5524 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior