Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Sample name:	phish_alert_sp2_2.0.0.0.eml
Analysis ID:	1544254
MD5:	e88ef66db0525f116b698a6152bbfcbe
SHA1:	b9a6e6351e0556a2c7b015d34a8292fec8a50459
SHA256:	37b071611c213cc53447bb1b3d1f2e00c4017a2be13756bfb6ed8a6c49e4c275
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates a window with clipboard capturing capabilities

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Suspicious Office Outbound Connections

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49970 version: TLS 1.2

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.246.45 13.107.246.45

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/ebd1da46-5d90-ef11-ac21-6045bdd88425?ts=638651883871101109 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/07cb3dfa-6cd1-ee11-9079-000d3a1b99b1?ts=638441944531652733 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/d04bc7c8-d891-ef11-ac21-6045bdd88425?ts=638653513834098786 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/47fceed3-1395-ef11-8a6a-6045bdd88425?ts=638657065932161473 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/0210afd2-8d8c-ef11-ac21-6045bdd88425?ts=638647694283804824 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/059dee09-8e8c-ef11-ac21-6045bdd88425?ts=638647695186496666 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/ebd1da46-5d90-ef11-ac21-6045bdd88425?ts=638651883871101109 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/07cb3dfa-6cd1-ee11-9079-000d3a1b99b1?ts=638441944531652733 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/d04bc7c8-d891-ef11-ac21-6045bdd88425?ts=638653513834098786 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/47fceed3-1395-ef11-8a6a-6045bdd88425?ts=638657065932161473 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/0210afd2-8d8c-ef11-ac21-6045bdd88425?ts=638647694283804824 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/059dee09-8e8c-ef11-ac21-6045bdd88425?ts=638647695186496666 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com

Source: global traffic	DNS traffic detected: DNS query: deefdd6e50d8438292d27fd577e4eccd.svc.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: assets-usa.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: augloop.office.com

Source: prep_ram Files (x86)_Microsoft Office_root_Office16_AugLoop_bundle_js_V8_perf.cache.0.dr	String found in binary or memory: http://augloop.office.com/settings.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: prep_ram Files (x86)_Microsoft Office_root_Office16_AugLoop_bundle_js_V8_perf.cache.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: http://www.w3.=
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.office.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.scheduler.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://app.powerbi.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://are01.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://are01.safelinks.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://are01.safelinks.protection.outlook.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://are01.safelinks.protection.outlook.com/?=
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://are01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdeefdd6e50d8438292d27fd577e4eccd.s
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://assets-usa.mkt.dynamics.=
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/0210af
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/059dee
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/07cb3d
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/47fcee
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/d04bc7
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/ebd1da
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee5438=
Source: App1730177790892622900_BF56DEDC-95C9-4FCA-A7EC-ACA9E7C039D0.log.0.dr	String found in binary or memory: https://augloop.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://canary.designerapp.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.entity.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cortana.ai
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cr.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://d.docs.live.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://deefdd6e50d8438292d27fd577e4eccd.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://deefdd6e50d8438292d27fd577e4eccd.svc.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://deefdd6e50d8438292d27fd577e4eccd.svc.dynamics.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://deefdd6e50d8438292d27fd577e4eccd.svc.dynamics=
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://directory.services.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ecs.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://graph.windows.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://invites.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.windows.local
Source: OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl.0.dr	String found in binary or memory: https://login.windows.local;
Source: OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl.0.dr	String found in binary or memory: https://login.windows.locale.OR
Source: OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl.0.dr	String found in binary or memory: https://login.windows.localnull
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://management.azure.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://management.azure.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://mss.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/PushNotifications.Register
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://powerlift-user.acompli.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://service.powerapps.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-2
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-100
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-150
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-200
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-light-
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://substrate.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://tasks.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49970 version: TLS 1.2

Creates a window with clipboard capturing capabilities

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: classification engine

Classification label: clean4.winEML@3/43@3/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user~1\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A2E811BA-8EE8-4D9B-B294-2324B35EC9D9" "9DC555F0-4DDE-45D0-8693-5EC74425237E" "7568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A2E811BA-8EE8-4D9B-B294-2324B35EC9D9" "9DC555F0-4DDE-45D0-8693-5EC74425237E" "7568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Stores large binary data to the registry

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	File Volume queried: C:\Windows\SysWOW64 FullSizeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	File Volume queried: C:\Windows\SysWOW64 FullSizeInformation			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true
assets-usa.mkt.dynamics.com	unknown	unknown
augloop.office.com	unknown	unknown
deefdd6e50d8438292d27fd577e4eccd.svc.dynamics.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/07cb3dfa-6cd1-ee11-9079-000d3a1b99b1?ts=638441944531652733	false	unknown
https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/47fceed3-1395-ef11-8a6a-6045bdd88425?ts=638657065932161473	false	unknown
https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/d04bc7c8-d891-ef11-ac21-6045bdd88425?ts=638653513834098786	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression	1BFE591A4FE3D91B03CDF26EAACD8F89	719C37C320F518AC168C86723724891950911CEA	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	data	6CBD622E47C94B00A1E07A0FD3319F8B	ACFC22FA9889BDECB8246158E3A096016F56EB7B	B52F84AA79DE10FDDEA8C96C43B66213D3179ED553FC6D9E5D4A354388B2E2A2
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT	data	B26D5EB0F178706B7BAC6AF32C6F7BA5	89E64900B5755F070B3B6A41972D39A32ADF6D47	420A6ABCBC00BA06E885B3066E7B2538BBB06B1E67CD6568823DEEA2D133DFC0
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json	JSON data	C37972CBD8748E2CA6DA205839B16444	9834B46ACF560146DD7EE9086DB6019FBAC13B4E	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365	4296A064B917926682E7EED650D4A745	3953A6AA9100F652A6CA533C2E05895E52343718	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin	ASCII text, with very long lines (65536), with no line terminators	CC90D669144261B198DEAD45AA266572	EF164048A8BC8BD3A015CF63E78BDAC720071305	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin	ASCII text, with no line terminators	C5743AA4D53C7060E85F9FFE8ECC0916	194BCA00992BAC6C795C332B2303C5F2D8F5716A	B356D4C413CDC10C0406871DE8D54219C05F0FCE4C9CC0A833D6BB92C3360308
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\2D856CF8-223E-4CCC-8CBE-45FB4A4947CC	XML 1.0 document, ASCII text, with CRLF line terminators	3397C73C40B6E3D86D3B48804A43CB2C	4DFBA1FFFF855D901BC01E767180FDA17667BEB1	739B45FBD0B1159F9B78AE68218C79F5B2BB01C8355E99275E9BCADD32D7298E
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2	F138A66469C10D5761C6CBB36F2163C3	EEA136206474280549586923B7A4A3C6D5DB1E25	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal	SQLite Rollback Journal	0E7EFC80F7DC50B3156D83B5632C5FEC	5414FA714E334CFC097F0092DE693EBFDDBF2D98	2AD50BB394F1728F3BF9F5910DDBDFD26B518F7BF8CA8CFBB31FAD3B6F00611F
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	9D3AA53D07BB18A481CA03FE8C2F8FF5	6EDE8DDA18649F99754FC7211AB5D7C755F7EEDD	89C7839F245006659822937A75D69D18387A982376EF619F7E954098AFE24584
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	BBBF0419B9A06531A5C35CA3931ED36D	6F473BBDC22AE5A53292D98AB759107A31BC2783	09CAFECC33B32756718493D5D44EBA131720D2FBF547F99DB9BD49264EFEDC1D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1D3D117B.tmp	PNG image data, 961 x 58, 8-bit/color RGBA, non-interlaced	BDEAB1E6E59F6240E1B87972614D76E4	304FE8DD4AF0728CB2BECABC20F89844D8FFB33A	3C786630CD085BB900CEB4DF0BCD62F39C63319B13AB345C42CA6BED9A38769B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1F9A2441.tmp	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 800x450, components 3	EC573B4C3D40E487E5562A3A097883ED	19DE0EED0A61CA6077C8BAC41ABEE5B523C9C47B	5A07BC4A30B6CEC23226C3C4B9F0B6E026D654016410C03B421A9CCBF05BAFF0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\21CD0FBF.tmp	PNG image data, 1300 x 500, 8-bit/color RGBA, non-interlaced	CCC79D9EBF8E573716F06285B02416A2	7791E0D6E3EDBD2E23BEA5563F3047E4734C76E5	2C98B28E30ACF416827DF0EB49CEC109B6134CBBF60E653A743F48877732F499
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\35C2B587.tmp	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 25.3 (Windows), datetime=2024:10:17 16:41:09], baseline, precision 8, 30x30, components 3	4FFABC344F5A85A8C4D21598CE13F966	8E1AFF67F191D31B2158F033E4CC1EB7DC95CE85	D04F23F714BE1088FD886495072A38BA019247E16F419F65C5F225081A9A02B3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\35C3250B.tmp	GIF image data, version 89a, 1 x 1	4408EFC0174F07AD685C456F1DE521CA	E3BC3250F8F32BD98DC7B05FD8940B74617EB8D1	D1371FEB0512D700CF724B05A588CE79F8D8DFBB0991AE5F45ECD3AB08983A38
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8613E540.tmp	GIF image data, version 89a, 1 x 1	4408EFC0174F07AD685C456F1DE521CA	E3BC3250F8F32BD98DC7B05FD8940B74617EB8D1	D1371FEB0512D700CF724B05A588CE79F8D8DFBB0991AE5F45ECD3AB08983A38
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8F9EBD4E.tmp	PNG image data, 1300 x 500, 8-bit/color RGBA, non-interlaced	CCC79D9EBF8E573716F06285B02416A2	7791E0D6E3EDBD2E23BEA5563F3047E4734C76E5	2C98B28E30ACF416827DF0EB49CEC109B6134CBBF60E653A743F48877732F499
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\93BB04A.tmp	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 25.3 (Windows), datetime=2024:10:17 16:41:54], baseline, precision 8, 30x30, components 3	10006604367F5482701521BFD6B44F00	C4F77BB7F0344B0D8A4F010CDC2D792CDD24F3C2	41D8940549F52B01F433C4FF3278FBA8015915EE00AD41FD87751279C55907CC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9CE96F25.tmp	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 25.3 (Windows), datetime=2024:10:17 16:41:09], baseline, precision 8, 30x30, components 3	4FFABC344F5A85A8C4D21598CE13F966	8E1AFF67F191D31B2158F033E4CC1EB7DC95CE85	D04F23F714BE1088FD886495072A38BA019247E16F419F65C5F225081A9A02B3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A70C41C9.tmp	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	D105CA1E1CDE941FEA3029A290D8E23C	1299426414F93CB3C7B6B1A7B642541260F105D7	AA70E20C13A48F26561A574518097030DDBC062B670C65E5B05F21F845F32625
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B6A4CE51.tmp	PNG image data, 961 x 58, 8-bit/color RGBA, non-interlaced	BDEAB1E6E59F6240E1B87972614D76E4	304FE8DD4AF0728CB2BECABC20F89844D8FFB33A	3C786630CD085BB900CEB4DF0BCD62F39C63319B13AB345C42CA6BED9A38769B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CA766D36.tmp	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 800x450, components 3	EC573B4C3D40E487E5562A3A097883ED	19DE0EED0A61CA6077C8BAC41ABEE5B523C9C47B	5A07BC4A30B6CEC23226C3C4B9F0B6E026D654016410C03B421A9CCBF05BAFF0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D4C062E2.tmp	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 25.3 (Windows), datetime=2024:10:17 16:41:54], baseline, precision 8, 30x30, components 3	10006604367F5482701521BFD6B44F00	C4F77BB7F0344B0D8A4F010CDC2D792CDD24F3C2	41D8940549F52B01F433C4FF3278FBA8015915EE00AD41FD87751279C55907CC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F556E6B4.tmp	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	D105CA1E1CDE941FEA3029A290D8E23C	1299426414F93CB3C7B6B1A7B642541260F105D7	AA70E20C13A48F26561A574518097030DDBC062B670C65E5B05F21F845F32625
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{2277350A-F30D-4146-AE96-FA5C96F690A4}.tmp	data	830FBF83999E052538EAF156AB6ECB17	9F6C69FA4232801D3A4857C630BA7A719662135A	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{2507E2E6-7557-462C-B340-A41814BCDBB1}.tmp	data	830FBF83999E052538EAF156AB6ECB17	9F6C69FA4232801D3A4857C630BA7A719662135A	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{31A38F12-09AF-42A9-815A-3523449BFA78}.tmp	data	830FBF83999E052538EAF156AB6ECB17	9F6C69FA4232801D3A4857C630BA7A719662135A	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{3FAF8EDB-2B22-43EF-A1E4-D63D94D8A97E}.tmp	data	830FBF83999E052538EAF156AB6ECB17	9F6C69FA4232801D3A4857C630BA7A719662135A	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{742AB048-9FA4-44B0-BE96-C66F43041D42}.tmp	data	830FBF83999E052538EAF156AB6ECB17	9F6C69FA4232801D3A4857C630BA7A719662135A	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{9055459F-3340-468A-BB41-B1456AADD1C5}.tmp	data	830FBF83999E052538EAF156AB6ECB17	9F6C69FA4232801D3A4857C630BA7A719662135A	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C12CDA22-B387-4A1A-A324-7FEFDC69AB4C}.tmp	data	830FBF83999E052538EAF156AB6ECB17	9F6C69FA4232801D3A4857C630BA7A719662135A	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp	data	41302D8A6620F30F7CF2725A156E8445	DAE0F51DC5B57EE9B8BCAA42ED76CC4732991897	372FBEEF8A7E574BC0194B519879218F2C147187D9848145DFFEE2187A83CFF9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{FF88447E-D852-45A0-AEE2-B54B8FCFD0AC}.tmp	data	830FBF83999E052538EAF156AB6ECB17	9F6C69FA4232801D3A4857C630BA7A719662135A	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730177790892622900_BF56DEDC-95C9-4FCA-A7EC-ACA9E7C039D0.log	ASCII text, with very long lines (859), with CRLF line terminators	1D2487002B40B955C1AF8FA4443DC81A	06E63FF1A284D5C8709178480AB5C46ACF5B6979	C15DDFE0F7A6A8AF30D021C34156A6B0F2626D54148E1D511EC2BCBE9D3601B1
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730177790893453100_BF56DEDC-95C9-4FCA-A7EC-ACA9E7C039D0.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl	data	947F11EEEF944B2D1B86440B850BBA08	0B18028E857B0A0524E41D287407AC43C71630DC	522A5E191E86E0AB74EF760653AE0A64D5F37C8A9354B94CCB9DC867D9E2221A
C:\Users\user\AppData\Local\Temp\prep_ram Files (x86)_Microsoft Office_root_Office16_AugLoop_bundle_js_V8_perf.cache	data	41C12E2662B97D838212D7CEF4916EB9	C9371BC87158CA0CB806B8C76F53672345360A5B	6A557A711D1FFA9580366E2D63146D6175BC01AF89012C395EE220136DD6F1D5
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	B440B562DA05E2330FD087D64A551AA3	CDB5A44E6028D2F9BAFE74A3F7AD05CEE412CA7C	8B0FB146FA9CDF43F0F72959FB9A5B938AA3C411FF02CBAF8ECC86A9C4B043FA
C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs	Composite Document File V2 Document, Cannot read section info	046C406F94948BA0277EB50BC5D51156	A1D385EB389C035824DE7ECA0B81EA856179827F	019F75F0C3B0CECB26467E2473B9D5838BD8F1CAF889CFB8D9E06CB5EB9BDB25
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	A09B5BEA8E9378FA6497519286DC91AF	3AA5AD708FBEC36E25041574EEB82094B346CAF2	429F4EC6AD9DFBB97070B989EA3DCB86473FE59138EF51E143A54EF5FE0B95D6
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	0999578F0A3F858A2C9F70D12F2D881E	D64E367A6600C0AD5673A71BD1F2BC66ACB8E152	CA1470EC485FAABA928EC4650DCA07E673CEDE557429AB6E45264C8F1251E21A

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49970 version: TLS 1.2

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 13.107.246.45 13.107.246.45

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/ebd1da46-5d90-ef11-ac21-6045bdd88425?ts=638651883871101109 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/07cb3dfa-6cd1-ee11-9079-000d3a1b99b1?ts=638441944531652733 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/d04bc7c8-d891-ef11-ac21-6045bdd88425?ts=638653513834098786 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/47fceed3-1395-ef11-8a6a-6045bdd88425?ts=638657065932161473 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/0210afd2-8d8c-ef11-ac21-6045bdd88425?ts=638647694283804824 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/059dee09-8e8c-ef11-ac21-6045bdd88425?ts=638647695186496666 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/ebd1da46-5d90-ef11-ac21-6045bdd88425?ts=638651883871101109 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/07cb3dfa-6cd1-ee11-9079-000d3a1b99b1?ts=638441944531652733 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/d04bc7c8-d891-ef11-ac21-6045bdd88425?ts=638653513834098786 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/47fceed3-1395-ef11-8a6a-6045bdd88425?ts=638657065932161473 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/0210afd2-8d8c-ef11-ac21-6045bdd88425?ts=638647694283804824 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com
Source: global traffic	HTTP traffic detected: GET /af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/059dee09-8e8c-ef11-ac21-6045bdd88425?ts=638647695186496666 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Host: assets-usa.mkt.dynamics.com

Source: global traffic	DNS traffic detected: DNS query: deefdd6e50d8438292d27fd577e4eccd.svc.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: assets-usa.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: augloop.office.com

Source: prep_ram Files (x86)_Microsoft Office_root_Office16_AugLoop_bundle_js_V8_perf.cache.0.dr	String found in binary or memory: http://augloop.office.com/settings.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: prep_ram Files (x86)_Microsoft Office_root_Office16_AugLoop_bundle_js_V8_perf.cache.0.dr	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: http://www.w3.=
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.office.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://api.scheduler.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://app.powerbi.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://are01.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://are01.safelinks.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://are01.safelinks.protection.outlook.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://are01.safelinks.protection.outlook.com/?=
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://are01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdeefdd6e50d8438292d27fd577e4eccd.s
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://assets-usa.mkt.dynamics.=
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/0210af
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/059dee
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/07cb3d
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/47fcee
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/d04bc7
Source: ~WRS{C277272F-979A-4C08-AC10-96CE14551EB5}.tmp.0.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee54389d5f/digitalassets/images/ebd1da
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://assets-usa.mkt.dynamics.com/af245e55-1cec-4b74-8ba0-9aee5438=
Source: App1730177790892622900_BF56DEDC-95C9-4FCA-A7EC-ACA9E7C039D0.log.0.dr	String found in binary or memory: https://augloop.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://canary.designerapp.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.entity.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cortana.ai
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://cr.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://d.docs.live.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://deefdd6e50d8438292d27fd577e4eccd.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://deefdd6e50d8438292d27fd577e4eccd.svc.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://deefdd6e50d8438292d27fd577e4eccd.svc.dynamics.=
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://deefdd6e50d8438292d27fd577e4eccd.svc.dynamics=
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://directory.services.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ecs.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://graph.windows.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://invites.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.windows.local
Source: OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl.0.dr	String found in binary or memory: https://login.windows.local;
Source: OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl.0.dr	String found in binary or memory: https://login.windows.locale.OR
Source: OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl.0.dr	String found in binary or memory: https://login.windows.localnull
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://management.azure.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://management.azure.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://mss.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/PushNotifications.Register
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://powerlift-user.acompli.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://service.powerapps.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-1
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-2
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-100
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-150
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-200
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-light-
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://substrate.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://tasks.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 2D856CF8-223E-4CCC-8CBE-45FB4A4947CC.0.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49970 version: TLS 1.2

Creates a window with clipboard capturing capabilities

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: classification engine

Classification label: clean4.winEML@3/43@3/1

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user~1\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241029T0056290232-7568.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A2E811BA-8EE8-4D9B-B294-2324B35EC9D9" "9DC555F0-4DDE-45D0-8693-5EC74425237E" "7568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A2E811BA-8EE8-4D9B-B294-2324B35EC9D9" "9DC555F0-4DDE-45D0-8693-5EC74425237E" "7568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Stores large binary data to the registry

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	File Volume queried: C:\Windows\SysWOW64 FullSizeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	File Volume queried: C:\Windows\SysWOW64 FullSizeInformation			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

ID:	1544254
Product:	CloudBasic
Start time:	05:55:15
Start date:	29.10.2024
Sample:	phish_alert_sp2_2.0.0.0.eml
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	e88ef66db0525f116b698a6152bbfcbe
SHA1:	b9a6e6351e0556a2c7b015d34a8292fec8a50459
SHA256:	37b071611c213cc53447bb1b3d1f2e00c4017a2be13756bfb6ed8a6c49e4c275
Filetype:	E-Mail message (Var. 5) (54515/1) 100.00%

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml