Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Certificial Client Invitation.msg

Overview

General Information

Sample name:Certificial Client Invitation.msg
Analysis ID:1447164
MD5:5012c3bda461e188b3c5a4a78ab80f0e
SHA1:d91c23d71db700502b620d686ae2014a573f1f26
SHA256:dc351d7d63c2d7cb109ac1b7c1e4719324eba122cf0dfb8db90d6e0f804972e7
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

  • System is w10x64
  • OUTLOOK.EXE (PID: 7424 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Certificial Client Invitation.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7616 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "060EBF36-3F84-47EC-9D7B-DF0D571EEDF6" "8E90DF3F-1C8F-4803-A0E2-237D645BBF22" "7424" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7424, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.aadrm.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.aadrm.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.cortana.ai
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.microsoftstream.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.office.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.onedrive.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://api.scheduler.
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://augloop.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://augloop.office.com/v2
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://cdn.entity.
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://clients.config.office.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://clients.config.office.net/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://config.edge.skype.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://cortana.ai
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://cortana.ai/api
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://cr.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://d.docs.live.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://dev.cortana.ai
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://devnull.onenote.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://directory.services.
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ecs.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://edge.skype.com/rps
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://graph.windows.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://graph.windows.net/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ic3.teams.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://invites.office.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://lifecycle.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://login.microsoftonline.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://make.powerautomate.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://management.azure.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://management.azure.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messaging.action.office.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://messaging.office.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: Certificial Client Invitation.msg, ~WRS{4EAFBDF0-093A-4134-AF6F-AE6EFE561E8C}.tmp.0.drString found in binary or memory: https://my.certificial.com/sign-up-agent/new/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ncus.contentsync.
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://officeapps.live.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://onedrive.live.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://outlook.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://outlook.office365.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://outlook.office365.com/connectors
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://powerlift.acompli.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://pushchannel.1drv.ms
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://res.cdn.office.net
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.39
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://settings.outlook.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://staging.cortana.ai
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://substrate.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://tasks.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://templatesmetadata.office.net/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: Certificial Client Invitation.msg, ~WRS{4EAFBDF0-093A-4134-AF6F-AE6EFE561E8C}.tmp.0.drString found in binary or memory: https://url.us.m.mimecastprotect.com/s/GOHOCzpQvjUR1lmgsXBXHG
Source: Certificial Client Invitation.msg, ~WRS{4EAFBDF0-093A-4134-AF6F-AE6EFE561E8C}.tmp.0.drString found in binary or memory: https://url.us.m.mimecastprotect.com/s/NtcUCyP7ogCN1vyXCZnIOt
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://webshell.suite.office.com
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://wus2.contentsync.
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean1.winMSG@3/13@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240524T0853300261-7424.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Certificial Client Invitation.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "060EBF36-3F84-47EC-9D7B-DF0D571EEDF6" "8E90DF3F-1C8F-4803-A0E2-237D645BBF22" "7424" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "060EBF36-3F84-47EC-9D7B-DF0D571EEDF6" "8E90DF3F-1C8F-4803-A0E2-237D645BBF22" "7424" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1447164 Sample: Certificial Client Invitation.msg Startdate: 24/05/2024 Architecture: WINDOWS Score: 1 5 OUTLOOK.EXE 49 121 2->5         started        process3 7 ai.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://api.diagnosticssdf.office.com0%URL Reputationsafe
https://login.microsoftonline.com/0%URL Reputationsafe
https://shell.suite.office.com:14430%URL Reputationsafe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize0%URL Reputationsafe
https://useraudit.o365auditrealtimeingestion.manage.office.com0%URL Reputationsafe
https://outlook.office365.com/connectors0%URL Reputationsafe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://api.addins.omex.office.net/appinfo/query0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/tenantassociationkey0%URL Reputationsafe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://lookup.onenote.com/lookup/geolocation/v10%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/imports0%URL Reputationsafe
https://cloudfiles.onenote.com/upload.aspx0%URL Reputationsafe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://entitlement.diagnosticssdf.office.com0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://ic3.teams.office.com0%URL Reputationsafe
https://www.yammer.com0%URL Reputationsafe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies0%URL Reputationsafe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies0%URL Reputationsafe
https://api.microsoftstream.com/api/0%URL Reputationsafe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive0%URL Reputationsafe
https://cr.office.com0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://otelrules.svc.static.microsoft0%URL Reputationsafe
https://portal.office.com/account/?ref=ClientMeControl0%URL Reputationsafe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory0%URL Reputationsafe
https://edge.skype.com/registrar/prod0%URL Reputationsafe
https://graph.ppe.windows.net0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://tasks.office.com0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://my.microsoftpersonalcontent.com0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://edge.skype.com/rps0%URL Reputationsafe
https://outlook.office.com/autosuggest/api/v1/init?cvid=0%URL Reputationsafe
https://globaldisco.crm.dynamics.com0%URL Reputationsafe
https://messaging.engagement.office.com/0%URL Reputationsafe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.diagnosticssdf.office.com/v2/feedback0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/groups0%URL Reputationsafe
https://web.microsoftstream.com/video/0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://graph.windows.net0%URL Reputationsafe
https://graph.windows.net0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://substrate.office.com0%URL Reputationsafe
https://outlook.office365.com/autodiscover/autodiscover.json0%URL Reputationsafe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios0%URL Reputationsafe
https://consent.config.office.com/consentcheckin/v1.0/consents0%URL Reputationsafe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json0%URL Reputationsafe
https://safelinks.protection.outlook.com/api/GetPolicy0%URL Reputationsafe
https://safelinks.protection.outlook.com/api/GetPolicy0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h0%Avira URL Cloudsafe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/0%URL Reputationsafe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/0%URL Reputationsafe
http://weather.service.msn.com/data.aspx0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://url.us.m.mimecastprotect.com/s/GOHOCzpQvjUR1lmgsXBXHG0%Avira URL Cloudsafe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks0%URL Reputationsafe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks0%URL Reputationsafe
https://templatesmetadata.office.net/0%URL Reputationsafe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios0%URL Reputationsafe
https://messaging.lifecycle.office.com/0%URL Reputationsafe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml0%URL Reputationsafe
https://pushchannel.1drv.ms0%URL Reputationsafe
https://management.azure.com0%URL Reputationsafe
https://outlook.office365.com0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://incidents.diagnostics.office.com0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/ios0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://api.addins.omex.office.net/api/addins/search0%URL Reputationsafe
https://insertmedia.bing.office.net/odc/insertmedia0%URL Reputationsafe
https://outlook.office365.com/api/v1.0/me/Activities0%URL Reputationsafe
https://api.office.net0%URL Reputationsafe
https://incidents.diagnosticssdf.office.com0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/android/policies0%URL Reputationsafe
https://entitlement.diagnostics.office.com0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://login.microsoftonline.com/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://shell.suite.office.com:1443FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://useraudit.o365auditrealtimeingestion.manage.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://outlook.office365.com/connectorsFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://cdn.entity.FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.addins.omex.office.net/appinfo/queryFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://clients.config.office.net/user/v1.0/tenantassociationkeyFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://powerlift.acompli.netFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://rpsticket.partnerservices.getmicrosoftkey.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://lookup.onenote.com/lookup/geolocation/v1FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://cortana.aiFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.powerbi.com/v1.0/myorg/importsFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://cloudfiles.onenote.com/upload.aspxFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://entitlement.diagnosticssdf.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.aadrm.com/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://ofcrecsvcapi-int.azurewebsites.net/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://ic3.teams.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://www.yammer.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://api.microsoftstream.com/api/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://cr.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;hFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • Avira URL Cloud: safe
unknown
https://messagebroker.mobile.m365.svc.cloud.microsoftFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://otelrules.svc.static.microsoftFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://portal.office.com/account/?ref=ClientMeControlFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://clients.config.office.net/c2r/v1.0/DeltaAdvisoryFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://edge.skype.com/registrar/prodFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://url.us.m.mimecastprotect.com/s/GOHOCzpQvjUR1lmgsXBXHGCertificial Client Invitation.msg, ~WRS{4EAFBDF0-093A-4134-AF6F-AE6EFE561E8C}.tmp.0.drfalse
  • Avira URL Cloud: safe
unknown
https://graph.ppe.windows.netFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://res.getmicrosoftkey.com/api/redemptioneventsFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://powerlift-frontdesk.acompli.netFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://tasks.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://officeci.azurewebsites.net/api/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/workFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.scheduler.FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://my.microsoftpersonalcontent.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://store.office.cn/addinstemplateFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.aadrm.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://edge.skype.com/rpsFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://globaldisco.crm.dynamics.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://messaging.engagement.office.com/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://dev0-api.acompli.net/autodetectFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://www.odwebp.svc.msFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.diagnosticssdf.office.com/v2/feedbackFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.powerbi.com/v1.0/myorg/groupsFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://web.microsoftstream.com/video/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.addins.store.officeppe.com/addinstemplateFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://graph.windows.netFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://dataservice.o365filtering.com/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://officesetup.getmicrosoftkey.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://prod-global-autodetect.acompli.net/autodetectFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://substrate.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://outlook.office365.com/autodiscover/autodiscover.jsonFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://consent.config.office.com/consentcheckin/v1.0/consentsFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/GetvoicesFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://d.docs.live.netFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://safelinks.protection.outlook.com/api/GetPolicyFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://ncus.contentsync.FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
http://weather.service.msn.com/data.aspxFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://apis.live.net/v5.0/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://templatesmetadata.office.net/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://messaging.lifecycle.office.com/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://pushchannel.1drv.msFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://management.azure.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://outlook.office365.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://wus2.contentsync.FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://incidents.diagnostics.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://clients.config.office.net/user/v1.0/iosFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://make.powerautomate.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.addins.omex.office.net/api/addins/searchFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://insertmedia.bing.office.net/odc/insertmediaFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://outlook.office365.com/api/v1.0/me/ActivitiesFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://api.office.netFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://incidents.diagnosticssdf.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://url.us.m.mimecastprotect.com/s/NtcUCyP7ogCN1vyXCZnIOtCertificial Client Invitation.msg, ~WRS{4EAFBDF0-093A-4134-AF6F-AE6EFE561E8C}.tmp.0.drfalse
  • Avira URL Cloud: safe
unknown
https://asgsmsproxyapi.azurewebsites.net/FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://clients.config.office.net/user/v1.0/android/policiesFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://entitlement.diagnostics.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://substrate.office.com/search/api/v2/initFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://storage.live.com/clientlogs/uploadlocationFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://webshell.suite.office.comFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveFC3BD5FC-A9C1-4A7A-986D-8B416EDAD541.0.drfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1447164
Start date and time:2024-05-24 14:52:24 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 35s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:7
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Certificial Client Invitation.msg
Detection:CLEAN
Classification:clean1.winMSG@3/13@0/0
EGA Information:Failed
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 0
  • Number of non-executed functions: 0
Cookbook Comments:
  • Found application associated with file extension: .msg

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
  • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.168.117.169
  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, officeclient.microsoft.com, onedscolprdeus10.eastus.cloudapp.azure.com, ukw-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net, mobile.events.data.microsoft.com, mobile.events.data.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size getting too big, too many NtQueryAttributesFile calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):231348
Entropy (8bit):4.395950920231978
Encrypted:false
SSDEEP:1536:KtYL7P/gs0aVVUFv19FRgsXfNcAz79ysQqt2dCuy4qoQPprcm0FvU2kyepWgttvq:VjgDdBgQmiGu2PqoQhrt0Fvpteq2YNv
MD5:EB94400A2E698482696C4B4D885DAD04
SHA1:76F24C30486D5E2020F6160B32D84559B28EEEF1
SHA-256:7DA30D267608FDE62E51EE839F09E16BEB1E3116C2A693437E2217DA081980D0
SHA-512:019866406816FE22D7EB907EBF5BBBE7FBB591CAFBA2E5595AAE0F610C7480336C4D3076C85A08637C204F46C0FF2BBABD882F28038321062A86EBC7BC95E753
Malicious:false
Reputation:low
Preview:TH02...... ..[$W.......SM01X...,......W...........IPM.Activity...........h...............h............H..ht.>......Aa....h..........H..h\hub ...AppD...h..0....>....hdF'............h........_`.k...h(E'.@...I.Dw...h....H...8..k...0....T...............d.........2h...............k..............!h.............. ht........>...#h....8.........$h......8....."h.F.......E....'h..j...........1hdF'.<.........0h....4.....k../h....h......kH..h._..p...t.>...-h .........>...+h.G'.....h.>................. ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FC3BD5FC-A9C1-4A7A-986D-8B416EDAD541

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:XML 1.0 document, ASCII text, with CRLF line terminators
Category:dropped
Size (bytes):167135
Entropy (8bit):5.150331228373223
Encrypted:false
SSDEEP:1536:r+C7FPgOsB3U9guwwJQ9DQA+zqzhQok4F77nXmvYd8XRPE:6IQ9DQA+zqzYXu
MD5:D4C9315C9613E5B8A850BA4B5872D9B0
SHA1:BB8D5CAF267DE94FC26C09E5A59A459102E7A824
SHA-256:4C55A98242C8D67D5E63CE15002CFC83436D3C68642309D92093761128481C54
SHA-512:1DC9BB2B30444DA282138B431B7A3B783999AEA21CD25001BF92844E63D4F7E619CFB54557541675A84947DFFF5E71D284BA5789A7EE3A076403EF62DA1E9AC4
Malicious:false
Reputation:low
Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-05-24T12:53:32">.. Build: 16.0.17707.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):32768
Entropy (8bit):0.04485505099671007
Encrypted:false
SSDEEP:3:GtlxtjlqawRlCxOwSll3lxtjlqawRlCxOwtt1R9//8l1lvlll1lllwlvlllglbep:Gt7rOj/37rOo9X01PH4l942wU
MD5:41B3729076202DBC8EF4D6376C5EA7B1
SHA1:3D3BA5C85D94DCF81F2B614BF382388B24669C10
SHA-256:5B556C503FF5D6A0BC265FEB3F1B9C0E2FD22E1C80558176EB3EFB4CE22289CD
SHA-512:0D6DC39F2B01F7A3FFF8DC20D73CE2B7F346D30C30F474DD937A9CFC9CA2276EF79A57163621397AA74806E976581747C404F27698DA01C43A7B733813B02618
Malicious:false
Reputation:low
Preview:..-................................_...l).t}-k...-................................_...l).t}-k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:SQLite Write-Ahead Log, version 3007000
Category:modified
Size (bytes):49472
Entropy (8bit):0.4808347135747321
Encrypted:false
SSDEEP:24:KHZhQ3zRDZbWUll7DBtDi4kZERDugzqt8VtbDBtDi4kZERDe+Bqt8VtbDBtDi4kC:u3Q1EUll7DYMCgzO8VFDYM3BO8VFDYML
MD5:C3262B8421D45F2D07E1EF7649DB5BF9
SHA1:DDF5B2CB994F5752D4256E97E6703ADCCC5C6FDA
SHA-256:15E45A919FCCC6BBC26DF0C1C5283849E3DBB9B50142EB3D5E49B9D1AF2F0697
SHA-512:0FF89C5510C8C165BA4E840F8ECE280D6C921A5F4FAD31845112F71F6BC095458E94FB9587B4007A84C3D5D9451F4355835D3220496F15E5DA5AE1B523C51423
Malicious:false
Reputation:low
Preview:7....-............._......jm............._...j4.C.Ye.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3C6C0E9E.dat

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:PNG image data, 206 x 103, 8-bit/color RGBA, non-interlaced
Category:dropped
Size (bytes):6627
Entropy (8bit):7.952576622927053
Encrypted:false
SSDEEP:192:7dl7yqpJkPOIfBXqvKrF/KbGmCTnON6rsATqO:7D7HJkPOyBXy8/FmC726rzTqO
MD5:03BCD6C91A5AF2FE16EA7EB2996160FF
SHA1:9D99744019DC4C1F5944FC70CF8D6FEE73BCF5C7
SHA-256:1DFF826C708F93136056A06577853957A1ACCF6CEA45FEEF61049FBC473B394E
SHA-512:3CA100358197972C3B706C42C797025920FA4ECB71099082E9D52C3CE00DCAFC8EFB2B6BD5DD8F8F45AE0EEA4C9A702DABBA49899086E3BBA382778F1BDDF53A
Malicious:false
Reputation:low
Preview:.PNG........IHDR.......g.....H.}.....sRGB.........gAMA......a.....pHYs..........+.....xIDATx^..|.....{o.@....A.V..".".\.C............V.[j.. .*...X.#".....}.@Nr.fw..3..y.....>u........}g.7...k....@.$.-...[...9`6z`...7<pS.<.......<.........\..@...#..&....Vbqa-...Q(...[rY...z.IBC...YR.....@..._I.>W....x.L.+......-.'..K....n..8...v.v...vU...q,.............8\E..L..T..'...M......?.Q?ae......(..J.8......._'..].E..R8M.1..:.9X...Pc.&...E$..)...R..F.."....)..#.....0..6..$.Ajx.........t..iB.c./p....z..by.@.eq..A...OF.K....$..U.^.6..........M..?n...Z1..Uw.7..i....p8X]^*..L.Z..g\0.......gZ......A....y.8.m..\.2#..6<.V.'..p....fQ.......ZeK}...R...9..v_j...KJ..H...H"@...I...'.......j1<.0........n...j....N.....b.8...Z.4..........YKqb.Kn....q...'\&t...g..O.>.`..oLD.X..%.AqV...C.m.RO...AqZ[x9...2#...,.G.]".r#-.].../..4..U.._.t.l.}H0....j..4$...e......H/.m...j.:.0..9Hd$..b...S...8)E..PnK..X..........)...=P.Pz..)a......I..).h.H8T.....<..!...../..R8.I.H.\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4EAFBDF0-093A-4134-AF6F-AE6EFE561E8C}.tmp

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):4100
Entropy (8bit):3.134172523782873
Encrypted:false
SSDEEP:48:N02bNns3lndu6HA/3v6conb///NiOSuJ4wYL9j8HqZr4EyYxNIL9j8HCAb:a+nQndu6HKC///AOSBtlrHBxN41
MD5:F04F64C775E85C8047BE8950473DCBB7
SHA1:432F00515F0F59C4CF31CB79494BB33169765AAB
SHA-256:B40DB29BF68BDBBB93D4792874290A9F6CC38D59380F589CF2216C2F4764C156
SHA-512:696C20EACD27164DA3694CC805070543D49AC4FAFECD550CCAEDAFAA6E36398820763B7FC7D7441437E30D5C012E63CF905E3542DC22235A14B361BD3E6B4A76
Malicious:false
Reputation:low
Preview:....I.N.C.L.U.D.E.P.I.C.T.U.R.E. .".c.i.d.:.l.o.g.o...p.n.g.". .\.*. .M.E.R.G.E.F.O.R.M.A.T.I.N.E.T... . ...................................................................................................................................................................................................................................................................................................................................................................................................................................h...j.............................................................................................................................................................................................................................................................................................................................................$..$.If....:V.......t.....6......4........4........a.........$.a$.*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4.

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1716555210492657300_FE71D8A1-E929-425C-B0BF-7D1E4C72DA50.log

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:ASCII text, with very long lines (28756), with CRLF line terminators
Category:dropped
Size (bytes):20971520
Entropy (8bit):0.15945953198980753
Encrypted:false
SSDEEP:1536:hjOWIUBdTz5F6AuEtx/51hq9k1zppjyLtvKnjEYOBH:UUbhF6PkQ4Q
MD5:C87318779AF7DC6FD9F3FE610A5C6CD6
SHA1:7364BA28234D8AE4F29EE9C6F670D2DE5523E62D
SHA-256:7EC65B1408ACF158FF15CD416A9108B88C703ED91B28C4DF85DB6922B123B3E9
SHA-512:01DD2F3FA54E8E45167794C3C93171EC027C009E1C9BBE5DC7EF673AB0F30DE0B61F961F8D4B3F41218075680DDB6A25D177DE58CD2B002FBB37F4E68C9C4AD3
Malicious:false
Reputation:low
Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..05/24/2024 12:53:30.543.OUTLOOK (0x1D00).0x1D04.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":17,"Time":"2024-05-24T12:53:30.543Z","Contract":"Office.System.Activity","Activity.CV":"odhx/inpXEKwv30eTHLaUA.4.9","Activity.Duration":11,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...05/24/2024 12:53:30.558.OUTLOOK (0x1D00).0x1D04.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-05-24T12:53:30.558Z","Contract":"Office.System.Activity","Activity.CV":"odhx/inpXEKwv30eTHLaUA.4.10","Activity.Duration":9550,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVe

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1716555210493349600_FE71D8A1-E929-425C-B0BF-7D1E4C72DA50.log

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):20971520
Entropy (8bit):0.0
Encrypted:false
SSDEEP:3::
MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:false
Reputation:high, very likely benign file
Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240524T0853300261-7424.etl

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):94208
Entropy (8bit):4.42533180391115
Encrypted:false
SSDEEP:768:ZShSYH52Pk3h6ey740ib9ZChz3WNITsLXlFmjnW9WdW6WKk:Yq40ib9ZC7yXvCk
MD5:24C1DE3911C8095E0DD33352B8DAD8F9
SHA1:16E035C3CEEA883CA8EA557CED81355A82EC3381
SHA-256:80FF925AB97BC21CF134DBC3D5F7866894438E714BDEE57364DDE4E901F05B32
SHA-512:0AB00C72B3CF6AE721A51B8433A1B72E8BC370CF082E9E41202E60E3669FC147939B356FF28652635783218F1149EEC63AB8FDDBB3BA9D82C1FF9ED0ADE0D140
Malicious:false
Reputation:low
Preview:............................................................................d...........w..`...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0.|.Y...........w..`...........v.2._.O.U.T.L.O.O.K.:.1.d.0.0.:.9.4.9.a.f.0.3.a.4.b.6.2.4.a.f.0.9.c.e.2.9.0.6.a.f.b.0.e.9.e.1.6...C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.5.2.4.T.0.8.5.3.3.0.0.2.6.1.-.7.4.2.4...e.t.l...........P.P.........w..`...................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF2F4C72DF4B2E73B2.TMP

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):163840
Entropy (8bit):0.3469237761894621
Encrypted:false
SSDEEP:192:/rqH/Pr+HsqxS2X1LOQL+f6r4sgNgz0XHWQOAIAbAFAqwNh/:z8/Pr+HsP2XQQL+f6suz0XHOAIMu
MD5:05E0606B47BBF925A6B75432C7A06889
SHA1:1D29F9CEC31811461465A64D60C00D6D4B0ED6D8
SHA-256:A6428031FCA990493C7BDCF40667EDFB9FEDECEBBBE76F82BBBCFAF673086E14
SHA-512:A507CB7E7CE6E950116B857E5A9EE6319F175204669499242582191E36F3B26C95F3166AE300445DE344E5D0584C60C15228F8BD8BB2F07D28C6E765FCE3CD20
Malicious:false
Reputation:low
Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):30
Entropy (8bit):1.2389205950315936
Encrypted:false
SSDEEP:3:Tsnhv:gnh
MD5:075182063A8E68C283D98AF86FBDE581
SHA1:81C1C973807F58823B7BA11CDD56B55A7422C552
SHA-256:6BF859404BA43CE0F0467C1D197D822C2FFB2F4C130B1746EFBAC09CFC7C5A58
SHA-512:D4E8356821FFAAF6F1A6E061E41BA7F8827E66D1759081F873E8F3E330F80851A52009BD308DF57EE25D7456D46AA7E6DECC45744905EE797DA74EFCAED59892
Malicious:false
Reputation:low
Preview:....$I........................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:Microsoft Outlook email folder (>=2003)
Category:dropped
Size (bytes):271360
Entropy (8bit):1.3020810566096404
Encrypted:false
SSDEEP:768:0aQcczma/8ejtGH0N5Vs1sbIi5bsPrCqGPLbBfl8BUTIZb:KsM/Nb56qtfleNZ
MD5:E3110E8EA05D240C16EDFEE91211391F
SHA1:B66577AA56B40EB5039A7FC2021154E1EC11FAFC
SHA-256:F5E36200A42A8D4C042DA976D34380A244C9398D61187891C880DAA95C02312A
SHA-512:5B818CAF65BD8B0EE4192DE93383F6C0978F01A53212FE669130BB92BCDCB3765F622E2B195D1E291BD66B6260ECAAF0C72D82E2A9294B090A8E4FE70FA14F86
Malicious:false
Preview:!BDN..z.SM......\....B..........F.......U................@...........@...@...................................@...........................................................................$.......D......@Q..............B...............E....................................................................................................................................................................................................................................................................................................~..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File
Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:data
Category:dropped
Size (bytes):131072
Entropy (8bit):1.3558146585522297
Encrypted:false
SSDEEP:384:XyjTIXJbODebjqHl6/niHffxTTpS4MYwRtPTeAmCN7GNgFoZG0yO4r+Wsi8g47ub:2TIZbOGilm0XrqAqG+HBf57N
MD5:18E6E4EFACDBE200586972CDB62A551B
SHA1:99F89E732186E286F7CE27A145FBAA805BDA2755
SHA-256:9F828CFB45054D80274991F45085AA540DB29BF49A0FB8621FAED7665EC509AA
SHA-512:B81FB2DF60D0020D32432CE72FA6A2C00D24C9BCB87ACCCD34026E1FEB4E665EB46D502B75B2D9AE0B5B030CEBD8663B3443A3D5F6BA2D236913734476CB309B
Malicious:false
Preview:....C...\...........7..`.....................#.!BDN..z.SM......\....B..........F.......U................@...........@...@...................................@...........................................................................$.......D......@Q..............B...............E....................................................................................................................................................................................................................................................................................................~......7..`........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:CDFV2 Microsoft Outlook Message
Entropy (8bit):4.7582231258042285
TrID:
  • Outlook Message (71009/1) 58.92%
  • Outlook Form Template (41509/1) 34.44%
  • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:Certificial Client Invitation.msg
File size:46'080 bytes
MD5:5012c3bda461e188b3c5a4a78ab80f0e
SHA1:d91c23d71db700502b620d686ae2014a573f1f26
SHA256:dc351d7d63c2d7cb109ac1b7c1e4719324eba122cf0dfb8db90d6e0f804972e7
SHA512:73b4fe389e637aac60040a16578640ef0445e6b0f1bfe8c7419dd36392d4d8abd496c554b6a5dd2c5140a22d6b84fd4886ac95430118ac9dc3541edc9f77f13a
SSDEEP:768:bnOY34dOwIygSGWsKgWsKcllOI77oNPdD7HO/7trz2e1:iY3z9WYWCfS+tm
TLSH:3D23011436E98B16F27B9F724DE280C799267CD1FE10D78F3291734E1972980A971B2B
File Content Preview:........................>......................................................................................................................................................................................................................................

Static Mail

General

Subject:Certificial: Client Invitation
From:Certificial <noreply@certificial.com>
To:maryah@nebcoinc.com
Cc:
BCC:
Date:Wed, 22 May 2024 17:36:09 +0200
Communications:
  • Client Invitation Hello, Ryan Eschliman, Constructors Inc, has requested your agency as the responsible producer for managing and verifying policy information on Certificial. Please click the below link to create an account for free now! https://my.certificial.com/sign-up-agent/new/ <https://url.us.m.mimecastprotect.com/s/NtcUCyP7ogCN1vyXCZnIOt> Thank you, The Certificial Team www.certificial.com <https://url.us.m.mimecastprotect.com/s/GOHOCzpQvjUR1lmgsXBXHG> | 101 Hudson Street, 21st Floor, Jersey City, NJ 07302 | info@certificial.com
Attachments:
  • Logo.png

Headers

Key Value
Authentication-Resultsrelay.mimecast.com;
spf=pass (relay.mimecast.comdomain of 0101018fa0f2114b-b5cb85e1-a194-46e0-b164-8c8eb1fb9058-000000@us-west-2.amazonses.com designates 54.240.27.190 as permitted sender) smtp.mailfrom=0101018fa0f2114b-b5cb85e1-a194-46e0-b164-8c8eb1fb9058-000000@us-west-2.amazonses.com
Receivedfrom a27-190.smtp-out.us-west-2.amazonses.com
us-mta-317-XBYPaHhBOXm2cglZHnR2VA-1; Wed, 22 May 2024 1136:11 -0400
X-MC-UniqueXBYPaHhBOXm2cglZHnR2VA-1
DKIM-Signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
h=DateFrom:To:Message-ID:Subject:MIME-Version:Content-Type:Feedback-ID;
DateWed, 22 May 2024 15:36:09 +0000
FromCertificial <noreply@certificial.com>
Tomaryah@nebcoinc.com
Message-ID<0101018fa0f2114b-b5cb85e1-a194-46e0-b164-8c8eb1fb9058-000000@us-west-2.amazonses.com>
SubjectCertificial: Client Invitation
MIME-Version1.0
Feedback-ID::1.us-west-2.V2scpUw9kKn8R75PO/2aPjpwctJPXRvy16zCKx+/+ak=:AmazonSES
X-SES-Outgoing2024.05.22-54.240.27.190
X-Mimecast-Spam-Score1
Content-Typemultipart/mixed;
dateWed, 22 May 2024 17:36:09 +0200

File Icon

Icon Hash:c4e1928eacb280a2

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:08:53:30
Start date:24/05/2024
Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):true
Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Certificial Client Invitation.msg"
Imagebase:0x170000
File size:34'446'744 bytes
MD5 hash:91A5292942864110ED734005B7E005C0
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:false

General

Target ID:2
Start time:08:53:32
Start date:24/05/2024
Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):false
Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "060EBF36-3F84-47EC-9D7B-DF0D571EEDF6" "8E90DF3F-1C8F-4803-A0E2-237D645BBF22" "7424" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:0x7ff74b3f0000
File size:710'048 bytes
MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:false

Disassembly

⊘No disassembly