Edit tour

Windows Analysis Report
Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml

Overview

General Information

Sample name:	Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml
Analysis ID:	1542225
MD5:	f8403c70e941620f45cf1ab1a21a45df
SHA1:	c40393d14af2e9ffc82e04b7ca1ca8b1fd99cd8f
SHA256:	539394dbaea9de138bef76f19fb4a3322918979f61eb571287693df2ff37cce2
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

Process Tree

System is w10x64

OUTLOOK.EXE (PID: 7624 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7936 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3A0CDE8C-BCF5-4CB1-B2EB-601C76CD7CAF" "3CE05695-DC6F-4B0A-9D80-E70937AE288A" "7624" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7624, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown

DNS traffic detected: query: 171.39.242.20.in-addr.arpa replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://sc.symcb.com/sc.crl0W
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://sc.symcb.com/sc.crt0
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://sc.symcd.com0&
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://scripts.sil.org/OFLCopyright
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: http://www.symauth.com/rpa04
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.aadrm.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.aadrm.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.cortana.ai
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.office.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.onedrive.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://api.scheduler.
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://app.powerbi.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://augloop.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://canary.designerapp.
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.entity.
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://clients.config.office.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://clients.config.office.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cortana.ai
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cortana.ai/api
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://cr.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://d.docs.live.net
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 28744608880.ttf.1.dr, 35021733747.ttf.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://dev.cortana.ai
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://devnull.onenote.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://directory.services.
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ecs.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://graph.windows.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://graph.windows.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://invites.office.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://lifecycle.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://login.windows.local
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://make.powerautomate.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://management.azure.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://management.azure.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://messaging.office.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://mss.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ncus.contentsync.
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://officeapps.live.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://onedrive.live.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://outlook.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://outlook.office.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://outlook.office365.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://outlook.office365.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://powerlift-user.acompli.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://res.cdn.office.net
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://service.powerapps.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://settings.outlook.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://staging.cortana.ai
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://substrate.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: ~WRS{FABFCBD8-CA2B-405C-8B9F-42CD8C569A1B}.tmp.1.dr	String found in binary or memory: https://supucansign.na4.echosign.com/public/resend?tsid=CBFCIBAACBSCTBABDUAAABACAABAAgPaL7iylF6oNfcu
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://tasks.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://wus2.contentsync.
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	String found in binary or memory: https://www.yammer.com

Source: classification engine

Classification label: mal48.winEML@3/14@1/0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user~1\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1108130696-7624.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3A0CDE8C-BCF5-4CB1-B2EB-601C76CD7CAF" "3CE05695-DC6F-4B0A-9D80-E70937AE288A" "7624" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3A0CDE8C-BCF5-4CB1-B2EB-601C76CD7CAF" "3CE05695-DC6F-4B0A-9D80-E70937AE288A" "7624" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'Review and sign' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'review and sign'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email claims to be from Adobe Sign/Pitney Bowes but uses multiple suspicious redirect URLs

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://api.diagnosticssdf.office.com	0%	URL Reputation	safe
https://login.microsoftonline.com/	0%	URL Reputation	safe
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://api.addins.omex.office.net/appinfo/query	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/tenantassociationkey	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/imports	0%	URL Reputation	safe
https://cloudfiles.onenote.com/upload.aspx	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://entitlement.diagnosticssdf.office.com	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
https://ic3.teams.office.com	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://portal.office.com/account/?ref=ClientMeControl	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://graph.ppe.windows.net	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-user.acompli.net	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://globaldisco.crm.dynamics.com	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.diagnosticssdf.office.com/v2/feedback	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://analysis.windows.net/powerbi/api	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
https://outlook.office365.com/autodiscover/autodiscover.json	0%	URL Reputation	safe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://officepyservice.office.net/service.functionality	0%	URL Reputation	safe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	0%	URL Reputation	safe
https://templatesmetadata.office.net/	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://messaging.lifecycle.office.com/	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://mss.office.com	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://management.azure.com	0%	URL Reputation	safe
https://outlook.office365.com	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://incidents.diagnostics.office.com	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://insertmedia.bing.office.net/odc/insertmedia	0%	URL Reputation	safe
https://outlook.office365.com/api/v1.0/me/Activities	0%	URL Reputation	safe
https://api.office.net	0%	URL Reputation	safe
https://incidents.diagnosticssdf.office.com	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
171.39.242.20.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://shell.suite.office.com:1443	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/connectors	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://powerlift.acompli.net	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://cortana.ai	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://supucansign.na4.echosign.com/public/resend?tsid=CBFCIBAACBSCTBABDUAAABACAABAAgPaL7iylF6oNfcu	~WRS{FABFCBD8-CA2B-405C-8B9F-42CD8C569A1B}.tmp.1.dr	false		unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/imports	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://cloudfiles.onenote.com/upload.aspx	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnosticssdf.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://ic3.teams.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.microsoftstream.com/api/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false		unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://cr.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false		unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false		unknown
https://portal.office.com/account/?ref=ClientMeControl	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://graph.ppe.windows.net	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://powerlift-user.acompli.net	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.scheduler.	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false		unknown
https://store.office.cn/addinstemplate	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false		unknown
https://globaldisco.crm.dynamics.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/cps0(	28744608880.ttf.1.dr, 35021733747.ttf.1.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://dataservice.o365filtering.com/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://prod-global-autodetect.acompli.net/autodetect	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://d.docs.live.net	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false		unknown
https://safelinks.protection.outlook.com/api/GetPolicy	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false		unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa04	28744608880.ttf.1.dr, 35021733747.ttf.1.dr	false		unknown
https://apis.live.net/v5.0/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://officepyservice.office.net/service.functionality	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://templatesmetadata.office.net/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://messaging.lifecycle.office.com/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://mss.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://management.azure.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://wus2.contentsync.	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://make.powerautomate.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://api.office.net	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://incidents.diagnosticssdf.office.com	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown
https://asgsmsproxyapi.azurewebsites.net/	9FFB6226-B29E-4B25-8BC8-50A76FE47C40.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542225
Start date and time:	2024-10-25 17:06:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml
Detection:	MAL
Classification:	mal48.winEML@3/14@1/0
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.68, 20.190.159.73, 40.126.31.67, 20.190.159.23, 20.190.159.64, 20.190.159.71, 20.190.159.4, 40.126.31.71, 52.109.76.240, 184.28.90.27, 52.113.194.132, 51.105.71.137
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, onedscolprduks03.uksouth.cloudapp.azure.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, www.tm.v4.a.prd.aadg.trafficmanager.net, s-0005-office.config.skype.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, neu-azsc-config.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.387523464185854
Encrypted:	false
SSDEEP:	3072:2eGgu4ggwmiGu2MqoQ9rt0FvLyw/yGA4t:2eTkmi2Zhw/yGA2
MD5:	6B8062864E07973800FB7CF952F9CD45
SHA1:	54F7BADCD362BAA0653D2BE3834D2C3134FA5163
SHA-256:	52C49E8C0E554CAEC93B1CCE35D2628B66393B9D30D60E67749D5CF2F8FC68E9
SHA-512:	80800524276A37780CDE12C56C0968FB87B2FB77D5A8B9F931C7EC1CE706D16E70B5F523CBC44195D8219BEB3E2797128B91F9621DA98F0F47804FFD1CE4F075
Malicious:	false
Reputation:	low
Preview:	TH02...... .@.I..&......SM01X...,...`.=..&..........IPM.Activity...........h...............h............H..h........T..o...h............H..h\FRO ...1\Ap...hp...0..........h..............h........_`Fk...h....@...I.tw...h....H...8.Kk...0....T...............d.........2h...............k..............!h.............. h9............#h....8.........$h........8....."h(.......X.....'h..............1h...<.........0h....4....Kk../h....h.....KkH..h8)..p.........-h .......D.....+h\................... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (2183), with no line terminators
Category:	modified
Size (bytes):	2183
Entropy (8bit):	5.114602147951964
Encrypted:	false
SSDEEP:	48:cGF+YdnzyrIOnzyQudy9qdSymiJdyCGdyreDnzyb8Syd+ASy8bdy7IkSyrotnzy3:EYd2kO2QuE9qdbm0ECGEqD2b8bd+Ab8o
MD5:	55DEE7EE315DF2731D7DB095015997EA
SHA1:	4D2705BDD89AEC2099600B01FB74A78E0FC8CFF3
SHA-256:	F0201D2F6DFFDE594B582FF2466FF4D903E35A47B2BA6BDFE4FFF25BC67008C8
SHA-512:	CDC7B2494FD9D6402ED799EEB576044423E401CC44FD0C14B9646D195A5AC4AA12ADB80E9F2551D1080AD57118E1BEFC45952912382CCEF8D49DA89FC73CA534
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>14</Count><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-05T07:49:21Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-05T07:49:21Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_26215680</Id><LAT>2023-10-05T07:49:21Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-05T07:49:21Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_26215682</Id><LAT>2023-10-05T07:49:21Z</LAT><key>31169036496.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-05T07:49:21Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Display_458764

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Source Sans Pro\28744608880.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, digitally signed, 19 tables, 1st "BASE", 26 names, Macintosh, Copyright 2010, 2012, 2014 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Fon
Category:	dropped
Size (bytes):	290916
Entropy (8bit):	5.788574728550447
Encrypted:	false
SSDEEP:	3072:q0qxC6YM3nG22R/FADAm9reurRnZqcqotiB0XYRMZ/AlDAz6o8CcYdTJTIhI29:976BWD/Fy9reGacSll0z6ol/Ih19
MD5:	0D9B62A03206F739CD34B2936A5929F1
SHA1:	F5CAD74E9791D2EF725F9FF5D53216CFFF4F3678
SHA-256:	DA4F442E66843990825ED4757E27AD3442CAD83F9844CC503E8ECE85E00F77F2
SHA-512:	D3738085D8F4891BF1A475A52108A4298B07C8959100E32D1C79038AF8B39C182E45FB9D531DD75F7BD2A514D70CF808649DCE83D3558BE236C74160923FF794
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...........0BASEe.]........FDSIG.p;...WL....GDEF..z........GPOS.{.........TGSUB...+......<ZOS/2_.........`cmapm~.... p..5.cvt ...9..W....fpgm.Y.7..U....sgasp............glyf..=1..vP..J.head.......<...6hhea...U...t...$hmtx.^.........Xloca.L....W....\maxp...r....... name.8.....l....post..Hr.....K.prep2.....Wp...V.......`D..._.<..................?\..7...m...........................7.7.m.............................m...............s.......,.........X...K...X...^.2.)............`...............ADBO. . ............ .............. .....P.....=...].M.F...{.M.$.M...M.~.....M.-.M.....f.M...M...M...M.....T.M.....e.M.,.#.,.....I.,...-...7.........$....=.A...$.=.'...$.U.....".;.A...5.....$.A...A.Y.A.<.A.+.$.=.A.=.'...A.........8.<...................&.=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...M...M...M...t...].M.F...F...F...F...F...{.M.{.M.{.M.....$.M.$.M.$.M.$.M.$.M.$.M.$.M.$.M.$.M.$.M.$.M.$.M.$.#.$.M.$.M.$.M.$.M.$.M.~...~...~...~...~...~...~...~..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Source Sans Pro\35021733747.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	TrueType Font data, digitally signed, 19 tables, 1st "BASE", 26 names, Macintosh, Copyright 2010, 2012, 2014 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Fon
Category:	dropped
Size (bytes):	293516
Entropy (8bit):	5.782267836191412
Encrypted:	false
SSDEEP:	3072:LgqxC65nO0Z77DOwtyp59cyrz5Ar0HQMB2HhG9CUYhYrMvH2dtoTX4rISTap6KuK:k76NFOc+IDHhCC0wvH2dtoilawnK
MD5:	5182DA425F811908BED9F5B8C72FA44F
SHA1:	17C25475C0369F7F8C8462AF9CF127A4CF6F1332
SHA-256:	71D10A86B4C54A5A9C0C8B467E53AC67D79EDB96C956E4E9F65A7074DFB9992A
SHA-512:	CF37EE1E2C3574DE5819E5C5328EE010832987750A3CDC0BC43F102C3BDAFD3993A9984C8D51F66B18198E80049C0323FA2F8F692025D8947F9580EDA6A7A5B2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...........0BASEe.]........FDSIG..>...at....GDEF..z...<....GPOS.,$...#.....GSUB...+..%...<ZOS/2].........`cmapm~.... p..5.cvt ."....W....fpgm.Y.7..U....sgasp............glyf.<0...vP..R\head.......<...6hhea...X...t...$hmtx.f.\.......Xloca.gD$..W....\maxp...z....... name.([.......=post..Hr......K.prep.c....Wp...V.......`XK.c_.<..................?\..:...o...........................:.:.o.............................v...............s.................X...K...X...^.2.#............`...............ADBO.@. ............ .............. .....Y..... ...L.Z.;.4.g.Z...Z...Z.i.4...Z...Z.....C.Z...Z...Z...Z...4.6.Z...4.9.Z..........W...................-...4.).R.....+./.....$.....-. .R...C.......R...R.=.R.#.R.....+.R.+./.[.R.....R... .K..................... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...6...6...6...[...L.Z.;.4.;.4.;.4.;.4.;.4.g.Z.g.Z.g.Z.~.!...Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...I...Z...Z...Z...Z...Z.i.4.i.4.i.4.i.4.i.4.i.4.i.4.i.4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9FFB6226-B29E-4B25-8BC8-50A76FE47C40

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178267
Entropy (8bit):	5.2902879141278945
Encrypted:	false
SSDEEP:	1536:si2XfRAqFbH41gwEwLe7HW8QM/o/NMdcAZl1p5ihs7EXXDEAD2Odago:2Ce7HW8QM/o/TXgk9o
MD5:	5DC581A5DA2D578F978E79C8456045F6
SHA1:	82A4668F7D59A71FE1C20FB1B94AA1FF55D4C146
SHA-256:	5516016F870A1E31C744B396D14DFD5106C2CFA0056F4986855F986F566A694A
SHA-512:	B111E830D2174100F4E7182BDCFAE74045681AB308D07DA85CE68DBBB4D124C7040D5936E3FDD6A336DBF76EEC7DFA551EE30144AA4DE5BED62C4C2FDD8065A5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-25T15:08:17">.. Build: 16.0.18209.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04591939678467531
Encrypted:	false
SSDEEP:	3:GtlxtjlHRiBGtlxtjlHRiBX9R9//8l1lvlll1lllwlvlllglbelDbllAlldl+l:GtnRgGtnRgXX9X01PH4l942wU
MD5:	49AFCAB3D0E57263830EA15D4710FA06
SHA1:	44A7C379E29B422A9B7388CD8C6B44DCCB71A9B5
SHA-256:	FC2A0CA395DD0297A8CC8F2910B7368AE1292CDDA097D90A46B6CD0184E2D337
SHA-512:	B1699A4B26F7AE266A4FD147136D21919D80785565F0F9FC5B7AF1DFF9105ED3BD60B606B72E22C4399E14928C8F4B89ECB6E4BBC4A8DCBF2E573300C5EEA8ED
Malicious:	false
Reputation:	low
Preview:	..-.......................P#QiJ8..:...r..5=..`.H..-.......................P#QiJ8..:...r..5=..`.H........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	49472
Entropy (8bit):	0.48472768062353655
Encrypted:	false
SSDEEP:	48:CxQ1IUll7DYMdzO8VFDYM2FIBO8VFDYML:nBll4ajVGWjVGC
MD5:	E121E8B315B185EB1CCF7226DE0F3987
SHA1:	4C35AB8A98A09C6382C7ADCFFC60B249ECBD6FAE
SHA-256:	13F8E967ACA3EC2F880C846B79DE3F771CB85D5FD36BF30952C77A0DFE697487
SHA-512:	D90F2D962212000E43A62ECC503A6080F859B6D712EC99AFD9DD276497DA3379DED842A56CD46F9B0B70D5E90B21D260C835A89CCDF42023DC716D54E4FE1D6B
Malicious:	false
Preview:	7....-............:...r..!.. {...........:...r..a...3.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{FABFCBD8-CA2B-405C-8B9F-42CD8C569A1B}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	8116
Entropy (8bit):	4.300453513855265
Encrypted:	false
SSDEEP:	96:PsA6fidJsjrSpfndTS/koE7UE7UE7UE7UE7EE7Dkecr1ZecRajAwIx7l1:5pJTZS/kv7z7z7z7z7D7RBmxh
MD5:	F9EE7CA00855A84865C92A2235892B78
SHA1:	F799D1AAFF6ECF92FAD8F9CB0BAAF7627F0A21B7
SHA-256:	8C342AF1768E5F6CB0F395F6DA83C9ABDF88ABAE0E1977346879D6FF81A359B8
SHA-512:	016C5E0CBB4A8F05240ECA2FCA64943D450EE508194251C369B36A7F33439F581185F7474E23BD8C5FEAC2188E799979B5BCDA0AF6322CF9803810163F37CAFA
Malicious:	false
Preview:	....A.T.T.E.N.T.I.O.N. .:. .C.o.u.r.r.i.e.l. .e.x.t.e.r.n.e. .-. .C.A.U.T.I.O.N.:.E.x.t.e.r.n.a.l. .e.m.a.i.l......... .....................................................................................................................................................................................................................................................................................................................................................................................................................p...t...z...\|...(......,.......0...2...4......................................................................................................................................................................................................................................................................................$.a$.........$..$.If....:V.......t.....6......4........4........a.......$..$.If........!v..h.#v....:V.......t.....6......5.......4........4........a........

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729868893965586300_1F26C579-8351-4D52-A004-74EFAF7E84E9.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28767), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.18032519018632237
Encrypted:	false
SSDEEP:	1536:0NOLaHZ3TE5Uub4jS9/haNaJ8v5Cw5xlWHms7ktDjaIht7HRkT4RU23edWfnavBe:MH1cUu33aNaJc0bs
MD5:	6B14C88D9218CBD0A7F41B5378AA355A
SHA1:	0F3986F000B532642F067538E7453CF677B345F8
SHA-256:	57EAB3595F525194F5FA2B76F439299D063C544CE2F3B9883185984EDC255F02
SHA-512:	C528379C0CA0DA13BF6ECCA9E73C6AC399CF689E026C692AF64320D91A17C7C76582C9F9C00563863657607AF4B236D8C6FA7427AA0F0CFDD2D556285A39392C
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/25/2024 15:08:14.071.OUTLOOK (0x1DC8).0x1DCC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-10-25T15:08:14.071Z","Contract":"Office.System.Activity","Activity.CV":"ecUmH1GDUk2gBHTvr36E6Q.4.9","Activity.Duration":13,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/25/2024 15:08:14.149.OUTLOOK (0x1DC8).0x1DCC.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-10-25T15:08:14.149Z","Contract":"Office.System.Activity","Activity.CV":"ecUmH1GDUk2gBHTvr36E6Q.4.10","Activity.Duration":12771,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729868893966399100_1F26C579-8351-4D52-A004-74EFAF7E84E9.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1108130696-7624.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	4.526977208208514
Encrypted:	false
SSDEEP:	768:nzMCWO2hjEDK5Bt4104hREWIBp9CDn6NXgWXWPjmVFg8wWlWoVxEAi/s66WP5JdE:nk4hREWY9CD6NX7F
MD5:	443986FAD720071AB897110C7461B628
SHA1:	510ED8F250EC90A5305171DEB658A949730D745A
SHA-256:	BE2A2D1B865E3A7ACBBB765043CEC9BC56CC2D53887B6D9BD1455A903F0D16C5
SHA-512:	CE9A6E30CF3492D77D3FBF95A31CFDB6D33D1376A3E8F04F3829AB50312C3112839B2E1B8CA947B72790ABFDC37196039CD94D94805921163163345622E21DC2
Malicious:	false
Preview:	............................................................................h............fi..&..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................P1..V............fi..&..........v.2._.O.U.T.L.O.O.K.:.1.d.c.8.:.6.1.6.a.f.d.d.d.1.9.6.4.4.d.c.2.a.5.c.4.c.a.c.1.f.8.a.c.7.9.d.a...C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.5.T.1.1.0.8.1.3.0.6.9.6.-.7.6.2.4...e.t.l.......P.P..........fi..&..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:IoX:Io
MD5:	5FA89AB31023D50F90E519561DAB3816
SHA1:	E4582B3D67C47370AF4482BEC5CBB61DA8B73D2E
SHA-256:	4A95AA2A10E25E9C3658FDF3F8DD3E9F3B858634242EBE4847EAE6EFF6FE094A
SHA-512:	7782AEFCEF19D8A85D9FE97EE79DBA59B64708DB4F3ABD43AB50B241149314F46976F943CFC80298F7AA6B5061312F8D69F640B043FF89305FB8762581604C5C
Malicious:	false
Preview:	.....I........................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	2.5881739718883154
Encrypted:	false
SSDEEP:	1536:NTk8DhNU2NBTF5D9G/WT64q1DFW53jEpEHP4qQ10PAwrILDOwW53jEpEHP4qQ10t:9nXRF5AWazp9Yyp9
MD5:	989EA894F10DAC5F77A2247C8A2B7CF7
SHA1:	41D6C459F45699457658BD7B5F73DAE432A2449D
SHA-256:	E089B9CFC70ED8AFE1A31D0FA87EDE045BA2E2584A9136BF3B20082500DACFB2
SHA-512:	7C83A55E5780FA8EEDBC89840F66A30B20B14210E63476E7CA50FC0B2B4743B48B2BB43D239B5BDECA2A18F518EA3350DE1F1CB672B11C74F356B52C71E81EB3
Malicious:	true
Preview:	!BDN.E8BSM......\...@G..................Y................@...........@...@...................................@...........................................................................$.......D......@...........................................................................................................................................................................................................................................................................................................................T.......G7..R.#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	3.157650881307874
Encrypted:	false
SSDEEP:	1536:VW53jEpEHP4qQ10PAwr1pDO2KzsRW53jEpEHP4qQ10PAwrVT+DDZLVzr:jp9z2zp92uZ
MD5:	EA872BC584C2754A0D169F0603CEAA67
SHA1:	2DB64086285F4ED0DE69B1A60148F625AA0E8A4C
SHA-256:	0FF5F19787A855A9DEA941519969219D1685569885E834B7BB5B91647F5E9686
SHA-512:	6AC2BAA64E3CEE1F56910B7BD12D953995533FF7F563D5C046BBF9917AC4CAF2D86765080563F09DA4C89C9F5ED9ABB421B9FE1831A46AB509FEF5DDFE9EBE00
Malicious:	true
Preview:	)...0...o...........,....&.......D............#...........................................................\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................u..D.......7z.0...p...........,....&.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (348), with CRLF line terminators
Entropy (8bit):	6.089464020127869
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml
File size:	22'071 bytes
MD5:	f8403c70e941620f45cf1ab1a21a45df
SHA1:	c40393d14af2e9ffc82e04b7ca1ca8b1fd99cd8f
SHA256:	539394dbaea9de138bef76f19fb4a3322918979f61eb571287693df2ff37cce2
SHA512:	772b1975eec9c5615de603debf354da642d1b283c9d860ed5162ec55b4a5950dbf4d22117e265284afed3671c9803a107c3f5348b3cb6dd8d59c63bda30a9a87
SSDEEP:	384:phCMcc2u3ngqxGp3LodwXAZdJxfjdUYpGQn0Ktq0Po7/:phCc2u3gOCLXXAZdJFdUYMQ0Ktq0Po/
TLSH:	77A25C919A032C29CB4055865CAC4E9D183EFF43A2BB80D4647FF2BD15B91BB2FE1D45
File Content Preview:	Received: from YQBPR0101MB9344.CANPRD01.PROD.OUTLOOK.COM.. (2603:10b6:c01:63::18) by YQXPR01MB5052.CANPRD01.PROD.OUTLOOK.COM with HTTPS;.. Wed, 23 Oct 2024 12:54:32 +0000..Received: from YT4PR01CA0320.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:10a::13).. by

Static Mail

General

Subject:	Signature requested on "REGULVAR INC 0016746022 Y103420151 SMB 3000"
From:	Pitney Bowes Agreement - Johnny Rim via Adobe Acrobat Sign <adobesign@adobesign.com>
To:	Karine Bedard <kbedard@regulvar.com>
Cc:
BCC:
Date:	Wed, 23 Oct 2024 12:54:16 +0000
Communications:	ATTENTION : Courriel externe - CAUTION:External email <https://pitneybowes.na4.documents.adobe.com/cobrand_logo/CBNCJCAABACAABAAlChgxIvCoRfV9jMwrpJwNQzLvVSIeGg8djMbtveAqXWbEUaj3QSSDAnwwozaupU570RI3WCfG1LYUoFl1FmElU_hP9bWHhyRzxLMMOqJPra7DRt5H5oSQNckH17qgVgF48HSGQAthy5aS39BUj2T7svjVpsVS1_GJE2epdMHx1Cbxx6ZxXsLXYgfh1h-4YnTPnFYsEQ0zN6E0bbzBdmEX1fK2zEvTB-ihWoaCJEfpIi_naeY27LKtz5Ybq4XyHPWVucZTEKxuampPOw2nqBau2QX-p_cb4LtXQ7sLoxVNvtgRt9uXPxsYDtNg9BsZ5Gv> Pitney Bowes Agreement - Johnny Rim requests your signature on REGULVAR INC 0016746022 Y103420151 SMB 3000<https://pitneybowes.na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAA_yF1Ew6Fnl4H96ZeVlyc6beq7jgqNoG6CWsVWETnwB96HTDKTT85s0Udhezgdf9o92eIaqL-WJiJLXI1_cCt-X1R2mnCV-idQTm5i0GaulCfm0zUAWdcouqVbt2m5khg&> Review and sign <https://pitneybowes.na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAA_yF1Ew6Fnl4H96ZeVlyc6beq7jgqNoG6CWsVWETnwB96HTDKTT85s0Udhezgdf9o92eIaqL-WJiJLXI1_cCt-X1R2mnCV-idQTm5i0GaulCfm0zUAWdcouqVbt2m5khg&> _____ After you sign REGULVAR INC 0016746022 Y103420151 SMB 3000, all parties will receive a final PDF copy. Don't forward this email: If you don't want to sign, you can delegate<https://supucansign.na4.echosign.com/public/resend?tsid=CBFCIBAACBSCTBABDUAAABACAABAAgPaL7iylF6oNfcudwHe-V7HRxvHmhCJdCTQUYMM_qnvVehvBRcHuFIELTZA-NrE_Extko7x6goYBjab23F1Y-YpQhCZ4IVchUjFR5vRvyaCSia0GZ5oThjCLXDzALg02> to someone else. By proceeding, you agree that this agreement may be signed using electronic or handwritten signatures. To ensure that you continue receiving our emails, please add adobesign@adobesign.com to your address book or safe list. 2024 Adobe. All rights reserved. <https://pitneybowes.na4.documents.adobe.com/track/CBFCIBAA3AAABLblqZhAIVBJDsFRC8XCiuGNRgbHLplEiQzKwztZYqlBCSsAP82AI55fAoCfY_fSa2rHRJjU*/blank.gif>
Attachments:

Headers

Key	Value
Received	from relay.uswest2.utility.echosign.com (52.41.255.238) by mx-gate10-hz11.hornetsecurity.com; Wed, 23 Oct 2024 08:54:27 -0400
From	Pitney Bowes Agreement - Johnny Rim via Adobe Acrobat Sign <adobesign@adobesign.com>
To	Karine Bedard <kbedard@regulvar.com>
Subject	Signature requested on "REGULVAR INC 0016746022 Y103420151 SMB 3000"
Thread-Topic	Signature requested on "REGULVAR INC 0016746022 Y103420151 SMB 3000"
Thread-Index	AQHbJUq0Mkywzz129UWVR8WE2d1oYA==
X-MS-Exchange-MessageSentRepresentingType	1
Date	Wed, 23 Oct 2024 12:54:16 +0000
Message-ID	<840612653.666.1729688056641@event-consumer-prod-b-d7fb64449-c8wcw>
Reply-To	Pitney Bowes Agreement - Johnny Rim <johnny.rim@pb.com>
Content-Language	fr-FR
X-MS-Exchange-Organization-AuthSource	TO1PEPF00005344.CANPRD01.PROD.OUTLOOK.COM
X-MS-Has-Attach
X-MS-Exchange-Organization-Network-Message-Id	e459e071-3925-4076-cdc1-08dcf361d47d
X-MS-TNEF-Correlator
X-MS-Exchange-Organization-RecordReviewCfmType	0
x-ms-publictraffictype	Email
received-spf	Fail (protection.outlook.com: domain of mail.na4.adobesign.com does not designate 209.172.38.68 as permitted sender) receiver=protection.outlook.com; client-ip=209.172.38.68; helo=hsmx01-hz11.hornetsecurity.com;
authentication-results	spf=fail (sender IP is 209.172.38.68) smtp.mailfrom=mail.na4.adobesign.com; dkim=pass (signature was verified) header.d=adobesign.com;dmarc=pass action=none header.from=adobesign.com;compauth=pass reason=100
x-ms-office365-filtering-correlation-id	e459e071-3925-4076-cdc1-08dcf361d47d
x-ms-traffictypediagnostic	TO1PEPF00005344:EE_\|YQBPR0101MB9344:EE_\|YQXPR01MB5052:EE_
x-forefront-antispam-report	CIP:209.172.38.68;CTRY:CA;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:hsmx01-hz11.hornetsecurity.com;PTR:hsmx01-hz11.hornetsecurity.com;CAT:NONE;SFS:(13230040)(6062899009)(5082899009)(5073199012)(12012899012)(3092899012)(2092899012)(4092899012)(5062899012)(69100299015)(13102899012)(13012899012)(3072899012)(8096899003)(4076899003)(8142799012);DIR:INB;
x-microsoft-antispam	BCL:0;ARA:13230040\|6062899009\|5082899009\|5073199012\|12012899012\|3092899012\|2092899012\|4092899012\|5062899012\|69100299015\|13102899012\|13012899012\|3072899012\|8096899003\|4076899003\|8142799012;
x-ms-exchange-crosstenant-originalarrivaltime	23 Oct 2024 12:54:28.1847 (UTC)
x-ms-exchange-crosstenant-fromentityheader	Internet
x-ms-exchange-crosstenant-id	417fb5a3-bdeb-4e46-8a16-fa39afbc7d97
x-ms-exchange-crosstenant-network-message-id	e459e071-3925-4076-cdc1-08dcf361d47d
x-ms-exchange-transport-crosstenantheadersstamped	YQBPR0101MB9344
x-eopattributedmessage	0
x-eoptenantattributedmessage	417fb5a3-bdeb-4e46-8a16-fa39afbc7d97:0
x-ms-exchange-transport-endtoendlatency	00:00:04.1329076
x-ms-exchange-processed-by-bccfoldering	15.20.8093.017
x-ms-exchange-crosstenant-authsource	TO1PEPF00005344.CANPRD01.PROD.OUTLOOK.COM
x-ms-exchange-crosstenant-authas	Anonymous
x-antispameurope-sender	bounces@mail.na4.adobesign.com
x-antispameurope-recipient	kbedard@regulvar.com
x-antispameurope-msgid	13e08abf2c28584dfdc88503e2055177-0f4baa1745ca69c79362661b8d04a1b4
x-antispameurope-body-digest	a47a65336fef3c93a34869f70a84b695
x-antispameurope-virusscan	CLEAN
x-antispameurope-spfresult	NONE
x-antispameurope-orig-ip	52.41.255.238
x-antispameurope-orig-host	relay.uswest2.utility.echosign.com
x-antispameurope-orig	a5df1e2315d2ff20707acb42aefc6859
x-antispameurope-disclaimer	This E-Mail was scanned by www.antispameurope.com E-Mailservice on mx-gate10-hz11 with 4XYTWt73q8z57g4
x-antispameurope-date	1729688060
x-antispameurope	INCOMING:
x-antispameurope-connect	relay.uswest2.utility.echosign.com[52.41.255.238],TLS=1;EMIG=0
x-antispameurope-wc	9:349:2:8957:0:200:0:0:0:0:0:0:2:2:1:0:3:162:155:162:0:0:0:0:0:64:0:0:0:0:0:0:0:0::0:1:0:0:0:0:0
x-antispameurope-spamstatus	CLEAN
x-antispameurope-reason	XARG-WL:xw_exprx_201113-62-0033
dkim-signature	v=1; a=rsa-sha256; c=relaxed/simple; d=adobesign.com; s=mailv2; t=1729688057; bh=HLf4N+Nh8eFXTkOq3VZU+iozrrNcqQKNK4bblfEjeh4=; h=Date:From:Reply-To:To:Subject; b=h5ATePiV0ZYyUwxUxLfR11wbAg+s4I7SbYg+YlLTbGBwmGePbrfq6ceZtrkx6Dre6 +dDVHTNvWls7aZGSJoI8Tvbc489eJzRZEN65H/r9IRBfn/MfUxr6ojrSE67SaIKhU+ AiKs/UtAKW/S3MqJveAHTDOLHTFcwg7GoXCMdOWC0NDY0rJwS22s/iKSAosyflrgiA Y9H+m0Khi0hgP60vUbK4m86bFNC9umKl8EtFuP0qV2x+iu14n3AFlgowoyuaK0Uj2y +GiAVBy+Okyc4L5ZDcDzO4trVl6cOvVVUSse6jlHov9WhmdhnjWjIHYeuzejarjLIk 8yUfznCBqTm3g==
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	tg8c8UR8+s44OPL4wbGN4PtPjmecbkMdRB4G89jVXeEU66UXNqkgxS0OdQRSM0WX77SRLO8vZWGUvG/wpvtalMwxQHYGlz4Luon3YD70nMDye3WHSHcX6cl6wFHYBzLbJ6s5p5/kZcX2y9cZ70Tc3rb4i8xZAmbyfRfcRtg7WCYpMvwmQwVQ0jTW04CLZxqzGo+JSOaGRLJNEVR+FpblzELyXkRczjYVVQiFClKWQLPrbjDVNrbBmHrU3Qp54d7Y1fBrjSTm5ABNLfH3NQGXrsgkd4t9b0BlgprATcbffTFFq1AvsQ6uvfL9xer90CT6AZZ9O//wvtTpJAkSU8WngtO/XneP6jEJNIVHUTmS8K/oZhWbsektgpZ57j28CIDhwMeGXo42yjbwxz3Mp5Ak3Q5XxFQpka5hY0CFDVSBB9L5qBrja25s+pqqWids4lwdO8Zd5SfoVw721bBs4qM5l/0KHxYqMbvOrYtHFcXQIVmi33I87QLRiJPtj0ZBtMtAwYKN1draUaD8lknrZNmJY+hyxiw8f8uN4/QwJgEscE56mdU5EbsvA5iHk7a+fTJoBLoPtgWuO6GEOwwsTd3laqM59XXeFbL0RadQVv2vhFWCxvkWfRkYI3VTt8Ly142EaIWZA79Wo51FCUVBzSQRtLlYA8Jj/S0CYGVySBOoDT9dLTzn9vFJzAeF4cJNr98rxsI7tY6Z26k+I5WBY2MOFcS9QYpeyXV/czNhVKpwGYu8aady2p6X1K6DvFpD5QsO7DaCiBv3m5JypPW9REldAv5XsS5g+Vo0yDDDfZs6HTn881yiDSEzhWmq9Idmzf7n7Tloe79Hrkm7oTBac4IKUtPyIA575O0p62COJutVKinrN12OhrFwMGG1xsHzNO98R32Jqn6lHGHd4vBf8HUjLTrPko7MjEjjRF+BuHFbKriKTS7O5AhcDIJrXV7ifCG3b5MS9hE/MtCyGEsVmlLwYhy/S//4wz41AeSaWExqbg6AeDcAxUQX3KL7iV/9aVrSlH9tLEXvVKCuqjVOyNC4h0QYgtULdZwSSD6ENpQNoB0bmYeTyAaNDd6HY3xJ7DgFMFWcgSzMj0B+gYbF10sE9b2DuDPXQXPIjEjWJT4LiwunfHbPkqqUVeJSIxJ2TddYQ1Y52Myxjrgbmq3kR5n2+f1nPtNYIYw2VQgoQLG/DC4yv9a3Yy6PRGMray/2XGLc9QTv/OgrSnDTbVPDXaMfLlqQ4jWgk6J+FxQIUJXb5kQSyToLX7BmML5lCEJUfF6VExiYjo5+mymEPrguvDAIFXevfDmbB4RL576oU5iiPTR0mdHp6a+2dBo1rsM7kGQV84JnGBPX88D1lrY6i0nnddk23r6TEqfysPmMrpNrAl56jimfhiSfxvcUSHXTm7ov+xtNV23fbDAW7tRKWKbyRCrRRlmuLpdlDYJPTp600RRsSO/SCo4hYyEGZvhpQwK19MqrtRsAMX9d4KU28cQbMsefJMfAsXX320S8HeFjXa9zjdKYOeRSRjAq2fVaMnI80F+zbdKwrPisEIGHuiRiH4Qu9WmUftNo9kYXs8UaeOd/h3z4IpLEQC6fMKYJIReLOo0LvIxy9ci82l5xg5CzwEctSblFeqgifQEpTcCLBIuKgwuhPU1RTh79DQEo3SyG5o7n100abN0wKqfvvRvb49WeZ81mmKzKPnTeKcyELMP2b3qm0IKELL3h+s16FlqfJhucJg1n1IFI6xk+20vhqRvzqSZXo4DSfO55AP0LeV2x8X1s7sXWdOtvJps25vtF7H8JLYenrH6kI7JABJixais89wcjNnchDmYyffNAGsf5KC9y0s22f/OgwkpfETazn5FSKOH66YWbT4GHTHGC/NKSKtLC8d/FPpvXx+lK1Q1JalOvoaMV5dVj6d+2yYUNVjh2FwBxvTWgRrU/VDotruQ+4QO6OQgiPzn36o2awzr8ZHxFW17hSSZ7EY9kunUq60TDU1NwW5MinJSkrx/z6W2kEKQBJk8rWxgxh54Ine454isG/7iCDfq1Gsidf1ynV8sp7TZa7J/HZvUordU7JivQNsM/tj9D3JUard7XeEjPZJaS4FK7l3dTgpbpF1REXpBv3bA80nnyMrcmD2+r+ZWljX398dUjSPFNM0/EYt2/SCCerPEqGJK1SLqBi3XOuztr8NKIcX+7w2LlQ8Fqf7nTKxti0Dr692vNlbhbDtneUoTO34RufiorvaMlKeqD+tc77mY7GfDrsdT8rVww1YbAzEJX25rjJYqpODObWOs1PHTU56WwSQ8ReSTnLogK
Content-Type	multipart/alternative; boundary="_000_8406126536661729688056641eventconsumerprodbd7fb64449c8w_"
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 17:08:34.912830114 CEST	53	58039	162.159.36.2	192.168.2.7
Oct 25, 2024 17:08:35.588249922 CEST	56537	53	192.168.2.7	1.1.1.1
Oct 25, 2024 17:08:35.596533060 CEST	53	56537	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 17:08:35.588249922 CEST	192.168.2.7	1.1.1.1	0x1442	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 17:08:35.596533060 CEST	1.1.1.1	192.168.2.7	0x1442	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	1
Start time:	11:08:10
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml"
Imagebase:	0xf80000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:08:15
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3A0CDE8C-BCF5-4CB1-B2EB-601C76CD7CAF" "3CE05695-DC6F-4B0A-9D80-E70937AE288A" "7624" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff645300000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Source Sans Pro\28744608880.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Source Sans Pro\35021733747.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9FFB6226-B29E-4B25-8BC8-50A76FE47C40

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{FABFCBD8-CA2B-405C-8B9F-42CD8C569A1B}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729868893965586300_1F26C579-8351-4D52-A004-74EFAF7E84E9.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729868893966399100_1F26C579-8351-4D52-A004-74EFAF7E84E9.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1108130696-7624.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Static File Info

General

Static Mail

General

Headers

File Icon

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
Signature requested on _REGULVAR INC 0016746022 Y103420151 SMB 3000_.eml