Windows Analysis Report https://onedrive.live.com/redir?resid=F956A0E4D4C28AFA%21235&authkey=%21AONBNICGdeIlM7s&page=View&wd=target%28Quick%20Notes.one%7C04266132-1687-4fc4-b3c2-39e379222a57%2FTHE%20OMNIA%20GROUP%2C%20INC%7C92f98044-bb5c-4c8e-a6f2-64d3960703d3%2F%29

Overview

General Information

Sample URL: https://onedrive.live.com/redir?resid=F956A0E4D4C28AFA%21235&authkey=%21AONBNICGdeIlM7s&page=View&wd=target%28Quick%20Notes.one%7C04266132-1687-4fc4-b3c2-39e379222a57%2FTHE%20OMNIA%20GROUP%2C%20INC%7C92f98044-bb5c-4c8e-a6f2-64d3960703d3%2F%29
Analysis ID: 458056
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Yara detected HtmlPhish10
Yara detected HtmlPhish7
HTML body contains low number of good links
HTML title does not match URL
Suspicious form URL found

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://freedomfrombackpains.com/srorrer/ SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Yara detected HtmlPhish10
Source: Yara match File source: 47033.3.pages.csv, type: HTML
Yara detected HtmlPhish7
Source: Yara match File source: 47033.3.pages.csv, type: HTML
HTML body contains low number of good links
Source: https://freedomfrombackpains.com/srorrer/ HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://freedomfrombackpains.com/srorrer/ HTTP Parser: Title: Share Point Online does not match URL
Suspicious form URL found
Source: https://freedomfrombackpains.com/srorrer/ HTTP Parser: Form action: ./next.php
Source: https://freedomfrombackpains.com/srorrer/ HTTP Parser: Form action: ./next.php
Source: https://freedomfrombackpains.com/srorrer/ HTTP Parser: No <meta name="author".. found
Source: https://freedomfrombackpains.com/srorrer/ HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 162.241.117.19:443 -> 192.168.2.4:49840 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.241.117.19:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: 77EC63BDA74BD0D0E0426DC8F8008506.1.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Reporting and NEL.1.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=ZO0llsZT71eKy4hHIYVmH7mrO2EcDX7Y41TnQF8GjjEpwvWvI2tE7sJxbTO
Source: Reporting and NEL.1.dr String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=qg0Qt6K8qJ0i9150tZgdoiaqOx7n%2FRwpnah4sjTk4ag5qnxcARzLimcnS
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, manifest.json0.0.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: 93a3fa42e61c139b_0.0.dr String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js
Source: 7444ea2da1317cfb_0.0.dr String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-2.1.3.min.js
Source: Network Action Predictor.0.dr String found in binary or memory: https://ajax.googleapis.com/
Source: 6e118dd92d0f9dd9_0.0.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 16dae40c863d3370_0.0.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.jsa
Source: 16dae40c863d3370_0.0.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.jsaD
Source: bf789c709f3fbb5b_0.0.dr String found in binary or memory: https://amcdn.msftauth.net/me?partner=OneNoteOnline&version=10.21153.1&market=EN-GB&wrapperId=suites
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, manifest.json0.0.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: 7972073d97ac6a72_0.0.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161432541018_App_Scripts/Feedback/latest/Intl/en-gb/offi
Source: 617f78aaa544a720_0.0.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161432541018_App_Scripts/Feedback/latest/officebrowserfe
Source: b2b369b661608142_0.0.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/161432541018_App_Scripts/wacairspaceanimationlibrary.js
Source: b63c1cd7c7087090_0.0.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/h1E2EA8A7D7D7DBF1_App_Scripts/2057/CommonIntl.js
Source: fa1d01002fa990ce_0.0.dr String found in binary or memory: https://c1-officeapps-15.cdn.office.net/o/s/h4DDC354F0F9CEFBE_App_Scripts/MicrosoftAjax.js
Source: Favicons.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/resources/1033/FavIcon_OneNote.ico
Source: 936ea5f25b0204ed_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/OneNoteSimplified.Wac.TellMeM
Source: 1b3e5202d92bd1be_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/onenote-intl-mlr.min.js
Source: 45de7baa1e70f6fd_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/onenote-navpane-strings.min.j
Source: 69d491139461ce46_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/onenote-ribbon-intl.min.js
Source: 6fe11d08e6f3391d_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/onenote-ribbon-sprite-lazy.mi
Source: 509916821a0fc2da_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/2057/osfruntime_strings.js
Source: 30df1dad39595b20_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/OfficeExtension.WacRuntime.js
Source: 0bb91d310fc8f48c_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/OneNote.box4.dll2.js
Source: 205ef0c584d89ac9_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/OneNoteSimplified.Wac.TellMeSugges
Source: 6ce673d9d43c7a3d_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/OsfRuntimeOneNoteWAC.js
Source: d5b6ea09967e5c42_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/appChrome.min.js
Source: df616072ed05fe37_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/appChromeLazy.min.js
Source: e0ac675daa08938b_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/appIconsLazy.min.js
Source: 99840c9a9136abf6_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/common.min.js
Source: c3c2b2f548f3ba44_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/common50.min.js
Source: f1c8f28f7b9cefec_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/navigation.min.js
Source: f460cc2c852106e0_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/onenoteloadingspinner.min.js
Source: 0c1b3d52a9af7b69_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/oreolazy.min.js
Source: 1c6ef0d7255b46f9_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/oreonavpane.min.js
Source: 85dcdd750ea0ab0f_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/oreonotebookpane.min.js
Source: 86da0adc7a337dd1_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/oreosearchpane.min.js
Source: 4c768a03884be887_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/otelFullNext.min.js
Source: 0ed937f35102492d_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/suiteux-shell/js/suiteux.shell.con
Source: 0e92be4d4afa6709_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/suiteux-shell/js/suiteux.shell.cor
Source: 3e2045da28285ce5_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/suiteux-shell/js/suiteux.shell.plu
Source: 12be61d7f6fe1090_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/161432541018_App_Scripts/uiSlice20.min.js
Source: de272f24ef9bbe31_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/App_Scripts/onenote-boot.min.js
Source: 7cd4eb7d184ef6b5_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h06FE78141D1F3A43_App_Scripts/Compat.js
Source: 1a7750ff440fe8cc_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h47F4322F99F46093_App_Scripts/2057/WoncaIntl.js
Source: b24c7ce889c44bd7_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h59FC7B214127519C_App_Scripts/OneNote.box4.dll1.js
Source: c578d2a2ae09a113_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h6A90C95AE995BE75_App_Scripts/2057/Box4Intl.js
Source: f3b70381e0b52174_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h83B1CF4978D4D8AD_App_Scripts/2057/OneNoteIntl.js
Source: cff45f8378caad97_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h8882E6B1B66D0BB7_App_Scripts/wacBoot.min.js
Source: dc87fd40092b9a2f_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h9284C3CF56325F23_App_Scripts/common.min.js
Source: 6127d4bd9cdcd01a_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h9559DFA267B44DDC_App_Scripts/onenoteSync.min.js
Source: 1a049a383c9f2c9a_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/h9F67ECA760252947_App_Scripts/OneNote.js
Source: 089da834c75847e1_0.0.dr String found in binary or memory: https://c1-onenote-15.cdn.office.net/o/s/hCF8E38AF39F430EA_App_Scripts/jSanity.js
Source: ee2d74af9fde7e01_0.0.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/BrowserUls.js
Source: 6daa52f36522edb6_0.0.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/CommonDiagnostics.js
Source: d1b76a59a9e3f660_0.0.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/ExternalResources/js-cookie.js
Source: e1f7ecb6fc0a528f_0.0.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/Instrumentation.js
Source: 04ffe34ebd2761c7_0.0.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/LearningTools/LearningTools.js
Source: 037a117947eadf82_0.0.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/aria-web-telemetry-2.9.0.min.js
Source: 6d6a4f3b7a75956a_0.0.dr String found in binary or memory: https://cdn.onenote.net/officeaddins/161432640454_Scripts/pickadate.min.js
Source: b34d4619ef91857f_0.0.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://code.jquery.com/
Source: ed66c2c1baf42c6d_0.0.dr String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: 804bce9b958ba711_0.0.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: 7bc38226041fc3dd_0.0.dr String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: manifest.json0.0.dr String found in binary or memory: https://content.googleapis.com
Source: 000003.log4.0.dr String found in binary or memory: https://content.growth.office.net/mirrored/resources/programmablesurfaces/prod/officewebsurfaces.cor
Source: a6a982fc-1d80-41df-91ea-a5902a053fed.tmp.1.dr, c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, b82af586-99f0-4809-95f8-4280f6f5c044.tmp.1.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://dns.google
Source: manifest.json0.0.dr String found in binary or memory: https://feedback.googleusercontent.com
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.0.dr String found in binary or memory: https://fonts.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.googleapis.com;
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://fonts.gstatic.com;
Source: b34d4619ef91857f_0.0.dr, Network Action Predictor.0.dr, 183d3ec709e45b4b_0.0.dr String found in binary or memory: https://freedomfrombackpains.com/
Source: ed66c2c1baf42c6d_0.0.dr String found in binary or memory: https://freedomfrombackpains.com/F4
Source: 774a54a960503d9c_0.0.dr String found in binary or memory: https://freedomfrombackpains.com/Rs
Source: 804bce9b958ba711_0.0.dr String found in binary or memory: https://freedomfrombackpains.com/q
Source: Current Session.0.dr String found in binary or memory: https://freedomfrombackpains.com/srorrer/
Source: Current Session.0.dr String found in binary or memory: https://freedomfrombackpains.com/srorrer/.
Source: History.0.dr String found in binary or memory: https://freedomfrombackpains.com/srorrer/Share
Source: Current Session.0.dr String found in binary or memory: https://freedomfrombackpains.com/srorrer/next.php
Source: manifest.json0.0.dr String found in binary or memory: https://hangouts.google.com/
Source: Network Action Predictor.0.dr String found in binary or memory: https://ka-f.fontawesome.com/
Source: Network Action Predictor.0.dr String found in binary or memory: https://kit.fontawesome.com/
Source: 183d3ec709e45b4b_0.0.dr String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: 3e2045da28285ce5_0.0.dr, e0ac675daa08938b_0.0.dr, dc87fd40092b9a2f_0.0.dr, 12be61d7f6fe1090_0.0.dr, 4c768a03884be887_0.0.dr, 509916821a0fc2da_0.0.dr String found in binary or memory: https://live.com/
Source: 9895df97930d526d_0.0.dr String found in binary or memory: https://live.com/&TM
Source: b63c1cd7c7087090_0.0.dr String found in binary or memory: https://live.com/.
Source: cff45f8378caad97_0.0.dr String found in binary or memory: https://live.com/2
Source: d598c76bdc491128_0.0.dr String found in binary or memory: https://live.com/;%J
Source: 85dcdd750ea0ab0f_0.0.dr String found in binary or memory: https://live.com/B
Source: 1b3e5202d92bd1be_0.0.dr String found in binary or memory: https://live.com/D
Source: 45de7baa1e70f6fd_0.0.dr String found in binary or memory: https://live.com/D~2
Source: 7cd4eb7d184ef6b5_0.0.dr String found in binary or memory: https://live.com/HP
Source: 86da0adc7a337dd1_0.0.dr String found in binary or memory: https://live.com/L
Source: 205ef0c584d89ac9_0.0.dr String found in binary or memory: https://live.com/O
Source: a5534787ec2d07e5_0.0.dr String found in binary or memory: https://live.com/V/
Source: 1c6ef0d7255b46f9_0.0.dr String found in binary or memory: https://live.com/X
Source: 1a049a383c9f2c9a_0.0.dr String found in binary or memory: https://live.com/Y
Source: b2b369b661608142_0.0.dr String found in binary or memory: https://live.com/Z52
Source: 30df1dad39595b20_0.0.dr, fbfdce35af9204d9_0.0.dr String found in binary or memory: https://live.com/h
Source: 0bb91d310fc8f48c_0.0.dr String found in binary or memory: https://live.com/j
Source: 69d491139461ce46_0.0.dr String found in binary or memory: https://live.com/l
Source: 0c1b3d52a9af7b69_0.0.dr String found in binary or memory: https://live.com/p
Source: b24c7ce889c44bd7_0.0.dr String found in binary or memory: https://live.com/qMN
Source: 617f78aaa544a720_0.0.dr String found in binary or memory: https://live.com/t
Source: fa1d01002fa990ce_0.0.dr String found in binary or memory: https://live.com/v
Source: Network Action Predictor.0.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/
Source: 774a54a960503d9c_0.0.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: 000003.log4.0.dr String found in binary or memory: https://onedrive.live.com
Source: Current Session.0.dr String found in binary or memory: https://onedrive.live.com/
Source: Favicons.0.dr String found in binary or memory: https://onedrive.live.com/View.aspx?resid=F956A0E4D4C28AFA
Source: 2a86594e59e83ccd_0.0.dr String found in binary or memory: https://onedrive.live.com/handlers/clientstring.mvc?mkt=en-GB&group=GroupFolders&v=19.680.0514.2004&
Source: 712ba233b75c9c44_0.0.dr String found in binary or memory: https://onedrive.live.com/handlers/clientstring.mvc?mkt=en-GB&group=Office&v=19.680.0514.2004&useReq
Source: History-journal.0.dr String found in binary or memory: https://onedrive.live.com/redir?resid=F956A0E4D4C28AFA%21235&authkey=%21AONBNICGdeIlM7s&page=View&wd
Source: Current Session.0.dr String found in binary or memory: https://onedrive.live.comh
Source: 6daa52f36522edb6_0.0.dr String found in binary or memory: https://onenote.com/
Source: 6d6a4f3b7a75956a_0.0.dr String found in binary or memory: https://onenote.com/&
Source: 511f06892f5a721b_0.0.dr String found in binary or memory: https://onenote.com/;
Source: e1f7ecb6fc0a528f_0.0.dr String found in binary or memory: https://onenote.com/B
Source: e2fa7340d4950923_0.0.dr String found in binary or memory: https://onenote.com/h
Source: d1b76a59a9e3f660_0.0.dr String found in binary or memory: https://onenote.com/ov
Source: 000003.log4.0.dr, 000003.log0.0.dr String found in binary or memory: https://onenote.officeapps.live.com
Source: QuotaManager.0.dr, index.txt.tmp.0.dr, 000003.log0.0.dr String found in binary or memory: https://onenote.officeapps.live.com/
Source: QuotaManager.0.dr String found in binary or memory: https://onenote.officeapps.live.com//
Source: Current Session.0.dr String found in binary or memory: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-GB&rs=en-US&hid=yKLh1r8tikaeAp8
Source: 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://p.sfx.ms
Source: a5534787ec2d07e5_0.0.dr String found in binary or memory: https://p.sfx.ms//storage/aria-2.5.0.min.js
Source: manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://play.google.com
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: Current Session.0.dr String found in binary or memory: https://skyapi.onedrive.live.com/api/proxy?v=3
Source: d598c76bdc491128_0.0.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/jquery-1.7.2-
Source: 8ec4cb91ffcb0ae0_0.0.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac0-efa56458
Source: 161fd244fa689573_0.0.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac1-cdc297b4
Source: 9895df97930d526d_0.0.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac2-bf8b3319
Source: fbfdce35af9204d9_0.0.dr String found in binary or memory: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20210614.002/wac_s_office-
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: 8bdf773fa09bf631_0.0.dr String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json41.0.dr String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, manifest.json0.0.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.google.com;
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: c05ef6a2-70cf-4da8-9593-b1d17624bfda.tmp.1.dr, 1ba56da4-4582-4a82-981d-4910287d8966.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: manifest.json0.0.dr String found in binary or memory: https://www.gstatic.com;
Source: 000003.log4.0.dr String found in binary or memory: https://www.onenote.com
Source: 000003.log0.0.dr String found in binary or memory: https://www.onenote.com/
Source: Current Session.0.dr String found in binary or memory: https://www.onenote.com/officeaddins/learningtools/?et=
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown HTTPS traffic detected: 162.241.117.19:443 -> 192.168.2.4:49840 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.241.117.19:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: classification engine Classification label: mal64.phis.win@33/306@22/14
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61082356-1068.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\46752879-cd51-4e43-86c6-a11b26690acb.tmp Jump to behavior
Source: QuotaManager.0.dr Binary or memory string: CREATE TABLE HostQuotaTable(host TEXT NOT NULL, type INTEGER NOT NULL, quota INTEGER DEFAULT 0, UNIQUE(host, type));
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://onedrive.live.com/redir?resid=F956A0E4D4C28AFA%21235&authkey=%21AONBNICGdeIlM7s&page=View&wd=target%28Quick%20Notes.one%7C04266132-1687-4fc4-b3c2-39e379222a57%2FTHE%20OMNIA%20GROUP%2C%20INC%7C92f98044-bb5c-4c8e-a6f2-64d3960703d3%2F%29'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,11931564742531319186,17718584323291993722,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1740 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,11931564742531319186,17718584323291993722,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1740 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs