Windows Analysis Report https://linkprotect.cudasvc.com/url?a=https%3a%2f%2f1drv.ms%3a443%2fo%2fs%21BKZQjSsteGBggQGWxWGDijKXGIKI%3fe%3dYSYU1OrRbk-OgIBVwfjzEw%26at%3d9&c=E,1,kIuIGEH799izsJ8ZzgEzo4vQsPME7QtXgthIwQx0qxxoPwhTl2ujgDMlbeQxn4ZdZQB-OFmNbdIvk9f4X00Afp0hXBwXDa-unMy-xntb&typo=1

Overview

General Information

Sample URL: https://linkprotect.cudasvc.com/url?a=https%3a%2f%2f1drv.ms%3a443%2fo%2fs%21BKZQjSsteGBggQGWxWGDijKXGIKI%3fe%3dYSYU1OrRbk-OgIBVwfjzEw%26at%3d9&c=E,1,kIuIGEH799izsJ8ZzgEzo4vQsPME7QtXgthIwQx0qxxoPwhTl2ujgDMlbeQxn4ZdZQB-OFmNbdIvk9f4X00Afp0hXBwXDa-unMy-xntb&typo=1
Analysis ID: 458823
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish10
Yara detected HtmlPhish7
HTML body contains low number of good links
No HTML title found

Classification

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: 81341.3.pages.csv, type: HTML
Yara detected HtmlPhish7
Source: Yara match File source: 81341.3.pages.csv, type: HTML
HTML body contains low number of good links
Source: https://gabby-gratis-tarascosaurus.glitch.me/wein.html HTTP Parser: Number of links: 0
No HTML title found
Source: https://gabby-gratis-tarascosaurus.glitch.me/wein.html HTTP Parser: HTML title missing
Source: https://gabby-gratis-tarascosaurus.glitch.me/wein.html HTTP Parser: No <meta name="author".. found
Source: https://gabby-gratis-tarascosaurus.glitch.me/wein.html HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 18.196.58.60:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 18.196.58.60:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.5.55.81:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.5.55.81:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown TCP traffic detected without corresponding DNS query: 104.16.94.65
Source: unknown TCP traffic detected without corresponding DNS query: 104.16.94.65
Source: unknown TCP traffic detected without corresponding DNS query: 104.16.94.65
Source: unknown TCP traffic detected without corresponding DNS query: 104.16.168.35
Source: unknown TCP traffic detected without corresponding DNS query: 104.16.168.35
Source: unknown TCP traffic detected without corresponding DNS query: 104.16.168.35
Source: unknown TCP traffic detected without corresponding DNS query: 104.18.29.93
Source: unknown TCP traffic detected without corresponding DNS query: 104.18.29.93
Source: unknown TCP traffic detected without corresponding DNS query: 104.18.29.93
Source: unknown TCP traffic detected without corresponding DNS query: 104.18.28.93
Source: unknown TCP traffic detected without corresponding DNS query: 104.18.28.93
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown TCP traffic detected without corresponding DNS query: 23.211.5.146
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: 77EC63BDA74BD0D0E0426DC8F8008506.3.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://1drv.ms
Source: Favicons-journal.1.dr String found in binary or memory: https://1drv.ms/o/s
Source: Reporting and NEL.3.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=Yqv6eHo7wCDvHDyG%2FIE%2BWWCelrfwfbvN3lN0xql%2FOOrgfI2sRg80w
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, manifest.json0.1.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://accounts.google.com
Source: 93a3fa42e61c139b_0.1.dr String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js
Source: 7444ea2da1317cfb_0.1.dr String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-2.1.3.min.js
Source: Network Action Predictor.1.dr String found in binary or memory: https://ajax.googleapis.com/
Source: 7531fee981b72877_0.1.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 37c3c5f79988b064_0.1.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.jsa
Source: 37c3c5f79988b064_0.1.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.jsaD
Source: bf789c709f3fbb5b_0.1.dr String found in binary or memory: https://amcdn.msftauth.net/me?partner=OneNoteOnline&version=10.21153.1&market=EN-GB&wrapperId=suites
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, manifest.json0.1.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://apis.google.com
Source: 7972073d97ac6a72_0.1.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161432541018_App_Scripts/Feedback/latest/Intl/en-gb/offi
Source: 617f78aaa544a720_0.1.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161432541018_App_Scripts/Feedback/latest/officebrowserfe
Source: b2b369b661608142_0.1.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161432541018_App_Scripts/wacairspaceanimationlibrary.js
Source: b63c1cd7c7087090_0.1.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/h1E2EA8A7D7D7DBF1_App_Scripts/2057/CommonIntl.js
Source: fa1d01002fa990ce_0.1.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/h4DDC354F0F9CEFBE_App_Scripts/MicrosoftAjax.js
Source: Favicons.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/resources/1033/FavIcon_OneNote.ico
Source: 936ea5f25b0204ed_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/OneNoteSimplified.Wac.TellMeM
Source: 1b3e5202d92bd1be_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/onenote-intl-mlr.min.js
Source: 45de7baa1e70f6fd_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/onenote-navpane-strings.min.j
Source: 69d491139461ce46_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/onenote-ribbon-intl.min.js
Source: 6fe11d08e6f3391d_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/onenote-ribbon-sprite-lazy.mi
Source: 509916821a0fc2da_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/osfruntime_strings.js
Source: 30df1dad39595b20_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/OfficeExtension.WacRuntime.js
Source: 0bb91d310fc8f48c_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/OneNote.box4.dll2.js
Source: 205ef0c584d89ac9_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/OneNoteSimplified.Wac.TellMeSugges
Source: 6ce673d9d43c7a3d_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/OsfRuntimeOneNoteWAC.js
Source: d5b6ea09967e5c42_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/appChrome.min.js
Source: df616072ed05fe37_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/appChromeLazy.min.js
Source: e0ac675daa08938b_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/appIconsLazy.min.js
Source: 99840c9a9136abf6_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/common.min.js
Source: c3c2b2f548f3ba44_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/common50.min.js
Source: f1c8f28f7b9cefec_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/navigation.min.js
Source: 4c768a03884be887_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/otelFullNext.min.js
Source: 0ed937f35102492d_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/suiteux-shell/js/suiteux.shell.con
Source: 0e92be4d4afa6709_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/suiteux-shell/js/suiteux.shell.cor
Source: 3e2045da28285ce5_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/suiteux-shell/js/suiteux.shell.plu
Source: 78bedd258028e0c4_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/uiFabricLazy.min.js
Source: 12be61d7f6fe1090_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/uiSlice20.min.js
Source: de272f24ef9bbe31_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/App_Scripts/onenote-boot.min.js
Source: 7cd4eb7d184ef6b5_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h06FE78141D1F3A43_App_Scripts/Compat.js
Source: 1a7750ff440fe8cc_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h47F4322F99F46093_App_Scripts/2057/WoncaIntl.js
Source: b24c7ce889c44bd7_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h59FC7B214127519C_App_Scripts/OneNote.box4.dll1.js
Source: c578d2a2ae09a113_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h6A90C95AE995BE75_App_Scripts/2057/Box4Intl.js
Source: f3b70381e0b52174_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h83B1CF4978D4D8AD_App_Scripts/2057/OneNoteIntl.js
Source: cff45f8378caad97_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h8882E6B1B66D0BB7_App_Scripts/wacBoot.min.js
Source: timesi.ttf.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h9284C3CF56325F23_App_Scripts/common.min.js
Source: 6127d4bd9cdcd01a_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h9559DFA267B44DDC_App_Scripts/onenoteSync.min.js
Source: 1a049a383c9f2c9a_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h9F67ECA760252947_App_Scripts/OneNote.js
Source: 089da834c75847e1_0.1.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/hCF8E38AF39F430EA_App_Scripts/jSanity.js
Source: ee2d74af9fde7e01_0.1.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/BrowserUls.js
Source: 6daa52f36522edb6_0.1.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/CommonDiagnostics.js
Source: d1b76a59a9e3f660_0.1.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/ExternalResources/js-cookie.js
Source: e1f7ecb6fc0a528f_0.1.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/Instrumentation.js
Source: 04ffe34ebd2761c7_0.1.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/LearningTools/LearningTools.js
Source: 037a117947eadf82_0.1.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/aria-web-telemetry-2.9.0.min.js
Source: 6d6a4f3b7a75956a_0.1.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/pickadate.min.js
Source: c28cce5b128f8326_0.1.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json0.1.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: Network Action Predictor.1.dr String found in binary or memory: https://code.jquery.com/
Source: cae36ae7fa4d6ce2_0.1.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: manifest.json0.1.dr String found in binary or memory: https://content.googleapis.com
Source: 000003.log6.1.dr String found in binary or memory: https://content.growth.office.net/mirrored/resources/programmablesurfaces/prod/officewebsurfaces.cor
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, 07eca047-39bf-46e5-a5e9-7ba29693166e.tmp.3.dr, 13e0462d-ffe1-4465-bb57-4b0e15d6a733.tmp.3.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://dns.google
Source: manifest.json0.1.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.1.dr String found in binary or memory: https://fonts.googleapis.com/
Source: manifest.json0.1.dr String found in binary or memory: https://fonts.googleapis.com;
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.1.dr String found in binary or memory: https://fonts.gstatic.com;
Source: cae36ae7fa4d6ce2_0.1.dr, Network Action Predictor.1.dr String found in binary or memory: https://gabby-gratis-tarascosaurus.glitch.me/
Source: c28cce5b128f8326_0.1.dr String found in binary or memory: https://gabby-gratis-tarascosaurus.glitch.me/P
Source: Current Session.1.dr String found in binary or memory: https://gabby-gratis-tarascosaurus.glitch.me/wein.html
Source: History.1.dr String found in binary or memory: https://gabby-gratis-tarascosaurus.glitch.me/wein.htmlShare
Source: manifest.json0.1.dr String found in binary or memory: https://hangouts.google.com/
Source: Network Action Predictor.1.dr String found in binary or memory: https://kit.fontawesome.com/
Source: 8fb80b44416c605e_0.1.dr String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: History.1.dr, History Provider Cache.1.dr String found in binary or memory: https://linkprotect.cudasvc.com/url?a=https%3a%2f%2f1drv.ms%3a443%2fo%2fs%21BKZQjSsteGBggQGWxWGDijKX
Source: 8ec4cb91ffcb0ae0_0.1.dr, 7972073d97ac6a72_0.1.dr, 6fe11d08e6f3391d_0.1.dr, b63c1cd7c7087090_0.1.dr String found in binary or memory: https://live.com/
Source: f3b70381e0b52174_0.1.dr String found in binary or memory: https://live.com/$WQ8A
Source: fbfdce35af9204d9_0.1.dr String found in binary or memory: https://live.com/=
Source: 6ce673d9d43c7a3d_0.1.dr String found in binary or memory: https://live.com/E
Source: c3c2b2f548f3ba44_0.1.dr String found in binary or memory: https://live.com/H(
Source: 0ed937f35102492d_0.1.dr String found in binary or memory: https://live.com/J
Source: d598c76bdc491128_0.1.dr String found in binary or memory: https://live.com/R
Source: 93a3fa42e61c139b_0.1.dr String found in binary or memory: https://live.com/T/
Source: 617f78aaa544a720_0.1.dr String found in binary or memory: https://live.com/X1
Source: a5534787ec2d07e5_0.1.dr String found in binary or memory: https://live.com/j
Source: df616072ed05fe37_0.1.dr String found in binary or memory: https://live.com/p$
Source: Network Action Predictor.1.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/
Source: 52f8f953e4a5a9ab_0.1.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://ogs.google.com
Source: 000003.log6.1.dr String found in binary or memory: https://onedrive.live.com
Source: Current Session.1.dr String found in binary or memory: https://onedrive.live.com/
Source: d6c9ff9f20c21023_0.1.dr String found in binary or memory: https://onedrive.live.com/handlers/clientstring.mvc?mkt=en-GB&group=GroupFolders&v=19.710.0628.2003&
Source: f251984d116eca5b_0.1.dr String found in binary or memory: https://onedrive.live.com/handlers/clientstring.mvc?mkt=en-GB&group=Office&v=19.710.0628.2003&useReq
Source: History.1.dr, History Provider Cache.1.dr, Current Session.1.dr String found in binary or memory: https://onedrive.live.com/redir?resid=6060782D2B8D50A6
Source: Current Session.1.dr String found in binary or memory: https://onedrive.live.com/redir?resid=6060782D2B8D50A6%21129&authkey=%21ApbFYYOKMpcYgog&page=View&wd
Source: Current Session.1.dr String found in binary or memory: https://onedrive.live.com/view.aspx?resid=6060782D2B8D50A6
Source: Current Session.1.dr String found in binary or memory: https://onedrive.live.comh
Source: 6d6a4f3b7a75956a_0.1.dr, 6daa52f36522edb6_0.1.dr String found in binary or memory: https://onenote.com/
Source: d1b76a59a9e3f660_0.1.dr String found in binary or memory: https://onenote.com/_
Source: 7444ea2da1317cfb_0.1.dr String found in binary or memory: https://onenote.com/w
Source: 04ffe34ebd2761c7_0.1.dr String found in binary or memory: https://onenote.com/x=
Source: 810e53cf61aed9ba_0.1.dr String found in binary or memory: https://onenote.com/y
Source: 000003.log6.1.dr String found in binary or memory: https://onenote.officeapps.live.com
Source: QuotaManager.1.dr, Current Session.1.dr, 000003.log0.1.dr String found in binary or memory: https://onenote.officeapps.live.com/
Source: QuotaManager.1.dr String found in binary or memory: https://onenote.officeapps.live.com//
Source: Current Session.1.dr String found in binary or memory: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-GB&rs=en-US&hid=4Kwqom6xbEyammH
Source: afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://p.sfx.ms
Source: a5534787ec2d07e5_0.1.dr String found in binary or memory: https://p.sfx.ms//storage/aria-2.5.0.min.js
Source: manifest.json.1.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://play.google.com
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.1.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: Current Session.1.dr String found in binary or memory: https://skyapi.onedrive.live.com/api/proxy?v=3
Source: d598c76bdc491128_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/jquery-1.7.2-
Source: 8ec4cb91ffcb0ae0_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac0-efa56458
Source: 161fd244fa689573_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac1-cdc297b4
Source: 9895df97930d526d_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac2-bf8b3319
Source: fbfdce35af9204d9_0.1.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac_s_office-
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://ssl.gstatic.com
Source: messages.json83.1.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json83.1.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, manifest.json0.1.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.1.dr String found in binary or memory: https://www.google.com;
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.1.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: 87973641-dfe5-478e-89b4-a47e807cb30c.tmp.3.dr, afe41f25-7f26-4736-8874-c06c4503a714.tmp.3.dr String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.1.dr String found in binary or memory: https://www.gstatic.com;
Source: 000003.log6.1.dr String found in binary or memory: https://www.onenote.com
Source: 000003.log0.1.dr String found in binary or memory: https://www.onenote.com/
Source: Current Session.1.dr String found in binary or memory: https://www.onenote.com/officeaddins/learningtools/?et=
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown HTTPS traffic detected: 18.196.58.60:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 18.196.58.60:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.5.55.81:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.5.55.81:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: classification engine Classification label: mal56.phis.win@33/293@27/17
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61097B64-12C8.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\618e691f-7b99-42c2-bf4d-97e59d7882af.tmp Jump to behavior
Source: QuotaManager-journal.1.dr Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://linkprotect.cudasvc.com/url?a=https%3a%2f%2f1drv.ms%3a443%2fo%2fs%21BKZQjSsteGBggQGWxWGDijKXGIKI%3fe%3dYSYU1OrRbk-OgIBVwfjzEw%26at%3d9&c=E,1,kIuIGEH799izsJ8ZzgEzo4vQsPME7QtXgthIwQx0qxxoPwhTl2ujgDMlbeQxn4ZdZQB-OFmNbdIvk9f4X00Afp0hXBwXDa-unMy-xntb&typo=1'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,16837710322178850958,12009668449574082098,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1696 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,16837710322178850958,12009668449574082098,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1696 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs