Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Potential Phish Please provide your feedback (you could be thanked with $100!).msg

Overview

General Information

Sample name:Potential Phish Please provide your feedback (you could be thanked with $100!).msg
Analysis ID:1546031
MD5:c70298e6544dca7785e35a83fe010637
SHA1:fbcc77b517d4c657603cf0de64f81119dfea70f1
SHA256:5c2a25ef2f68feced4c572c1f3215d9357077da6091b4a1cd3b4c8083a0a7c83
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

  • System is w10x64
  • OUTLOOK.EXE (PID: 7328 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Potential Phish Please provide your feedback (you could be thanked with $100!).msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 8168 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "409E7DC6-D584-49D9-9D03-1BBB00223894" "602D875E-325A-442C-B931-6E8CD179B770" "7328" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • OUTLOOK.EXE (PID: 7376 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding MD5: 91A5292942864110ED734005B7E005C0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7328, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-10-31T11:54:03.961683+010020229301A Network Trojan was detected20.12.23.50443192.168.2.849718TCP
2024-10-31T11:54:51.096333+010020229301A Network Trojan was detected20.12.23.50443192.168.2.849733TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.8:49733
Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.8:49718
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.aadrm.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.aadrm.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.cortana.ai
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.microsoftstream.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.office.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.onedrive.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://api.scheduler.
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://app.powerbi.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://augloop.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://augloop.office.com/v2
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://canary.designerapp.
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.entity.
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://clients.config.office.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://clients.config.office.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cortana.ai
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cortana.ai/api
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://cr.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://d.docs.live.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://designerapp.azurewebsites.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://designerappservice.officeapps.live.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://dev.cortana.ai
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://devnull.onenote.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://directory.services.
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ecs.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://edge.skype.com/rps
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://graph.windows.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://graph.windows.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ic3.teams.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: Potential Phish Please provide your feedback (you could be thanked with $100!).msgString found in binary or memory: https://info.nhanow.com/-temporary-slug-39182f43-3c8c-4741-beaa-74081392f799
Source: Potential Phish Please provide your feedback (you could be thanked with $100!).msgString found in binary or memory: https://info.nhanow.com/e3t/Cto/T5+113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVW95jsXz3Db1T
Source: Potential Phish Please provide your feedback (you could be thanked with $100!).msgString found in binary or memory: https://info.nhanow.com/hs-fs/hubfs/COOL-header-logo.png?width=300&upscale=true&name=COOL-he
Source: ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drString found in binary or memory: https://info.nhanow.com/hs-fs/hubfs/COOL-header-logo.png?width=300&upscale=true&name=COOL-header-log
Source: ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drString found in binary or memory: https://info.nhanow.com/hs/hsstatic/TemplateAssets/static-1.262/img/hs_default_template_images/modul
Source: Potential Phish Please provide your feedback (you could be thanked with $100!).msg, ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drString found in binary or memory: https://info.nhanow.com/hs/subscription-preferences/v2/unsubscribe-all?data=W2nXS-N30h-H8W34gPnK3LG4
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://invites.office.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://lifecycle.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://login.microsoftonline.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://login.microsoftonline.com/organizations
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.dr, OUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etl.0.drString found in binary or memory: https://login.windows.local
Source: OUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etl.0.drString found in binary or memory: https://login.windows.localR
Source: OUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etl.0.drString found in binary or memory: https://login.windows.localnull
Source: OUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etl.0.drString found in binary or memory: https://login.windows.localnullD
Source: App1730372039789984200_7A2E42BB-257F-4B00-A95A-A5232CBEFC37.log.0.drString found in binary or memory: https://login.windows.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://make.powerautomate.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://management.azure.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://management.azure.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messaging.action.office.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://messaging.office.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://mss.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ncus.contentsync.
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://notification.m365.svc.cloud.microsoft/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://notification.m365.svc.cloud.microsoft/PushNotifications.Register
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://officeapps.live.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://officepyservice.office.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://onedrive.live.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://outlook.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://outlook.office.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://outlook.office365.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://outlook.office365.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://outlook.office365.com/connectors
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: Potential Phish Please provide your feedback (you could be thanked with $100!).msg, ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drString found in binary or memory: https://policy.hubspot.com/abuse-complaints)
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://pushchannel.1drv.ms
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://res.cdn.office.net
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://service.powerapps.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://settings.outlook.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://staging.cortana.ai
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-1
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-2
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-100
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-150
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-200
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-light-
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://substrate.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://tasks.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://templatesmetadata.office.net/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drString found in binary or memory: https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5
Source: Potential Phish Please provide your feedback (you could be thanked with $100!).msg, ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drString found in binary or memory: https://urldefense.com/v3/__https://info.nhanow.com/hs/preferences-center/en/direct?data=W2nXS-N30h-
Source: Potential Phish Please provide your feedback (you could be thanked with $100!).msg, ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drString found in binary or memory: https://urldefense.com/v3/__https://info.nhanow.com/hs/preferences-center/en/page?data=W2nXS-N30h-G8
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://webshell.suite.office.com
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://wus2.contentsync.
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: 87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean2.winMSG@4/21@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Potential Phish Please provide your feedback (you could be thanked with $100!).msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "409E7DC6-D584-49D9-9D03-1BBB00223894" "602D875E-325A-442C-B931-6E8CD179B770" "7328" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "409E7DC6-D584-49D9-9D03-1BBB00223894" "602D875E-325A-442C-B931-6E8CD179B770" "7328" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Modify Registry		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1546031 Sample: Potential Phish Please prov... Startdate: 31/10/2024 Architecture: WINDOWS Score: 2 5 OUTLOOK.EXE 97 145 2->5         started        7 OUTLOOK.EXE 3 2 2->7         started        process3 9 ai.exe 5->9         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://api.diagnosticssdf.office.com0%URL Reputationsafe
https://login.microsoftonline.com/0%URL Reputationsafe
https://shell.suite.office.com:14430%URL Reputationsafe
https://designerapp.azurewebsites.net0%URL Reputationsafe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize0%URL Reputationsafe
https://autodiscover-s.outlook.com/0%URL Reputationsafe
https://useraudit.o365auditrealtimeingestion.manage.office.com0%URL Reputationsafe
https://outlook.office365.com/connectors0%URL Reputationsafe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://api.addins.omex.office.net/appinfo/query0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/tenantassociationkey0%URL Reputationsafe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://lookup.onenote.com/lookup/geolocation/v10%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/imports0%URL Reputationsafe
https://cloudfiles.onenote.com/upload.aspx0%URL Reputationsafe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://entitlement.diagnosticssdf.office.com0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://canary.designerapp.0%URL Reputationsafe
https://ic3.teams.office.com0%URL Reputationsafe
https://www.yammer.com0%URL Reputationsafe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies0%URL Reputationsafe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive0%URL Reputationsafe
https://cr.office.com0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://portal.office.com/account/?ref=ClientMeControl0%URL Reputationsafe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory0%URL Reputationsafe
https://edge.skype.com/registrar/prod0%URL Reputationsafe
https://graph.ppe.windows.net0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://tasks.office.com0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://edge.skype.com/rps0%URL Reputationsafe
https://globaldisco.crm.dynamics.com0%URL Reputationsafe
https://messaging.engagement.office.com/0%URL Reputationsafe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.diagnosticssdf.office.com/v2/feedback0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/groups0%URL Reputationsafe
https://web.microsoftstream.com/video/0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://graph.windows.net0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://analysis.windows.net/powerbi/api0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://substrate.office.com0%URL Reputationsafe
https://outlook.office365.com/autodiscover/autodiscover.json0%URL Reputationsafe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios0%URL Reputationsafe
https://consent.config.office.com/consentcheckin/v1.0/consents0%URL Reputationsafe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json0%URL Reputationsafe
https://safelinks.protection.outlook.com/api/GetPolicy0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/0%URL Reputationsafe
http://weather.service.msn.com/data.aspx0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://officepyservice.office.net/service.functionality0%URL Reputationsafe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks0%URL Reputationsafe
https://templatesmetadata.office.net/0%URL Reputationsafe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios0%URL Reputationsafe
https://messaging.lifecycle.office.com/0%URL Reputationsafe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml0%URL Reputationsafe
https://mss.office.com0%URL Reputationsafe
https://pushchannel.1drv.ms0%URL Reputationsafe
https://management.azure.com0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
  • URL Reputation: safe
unknown
https://urldefense.com/v3/__https://info.nhanow.com/hs/preferences-center/en/page?data=W2nXS-N30h-G8Potential Phish Please provide your feedback (you could be thanked with $100!).msg, ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drfalse
    		unknown
    https://info.nhanow.com/hs/hsstatic/TemplateAssets/static-1.262/img/hs_default_template_images/modul~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drfalse
      		unknown
      https://login.microsoftonline.com/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
      • URL Reputation: safe
      		unknown
      https://shell.suite.office.com:144387AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
      • URL Reputation: safe
      		unknown
      https://designerapp.azurewebsites.net87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
      • URL Reputation: safe
      		unknown
      https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
      • URL Reputation: safe
      		unknown
      https://autodiscover-s.outlook.com/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
      • URL Reputation: safe
      		unknown
      https://useraudit.o365auditrealtimeingestion.manage.office.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
      • URL Reputation: safe
      		unknown
      https://outlook.office365.com/connectors87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
      • URL Reputation: safe
      		unknown
      https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
      • URL Reputation: safe
      		unknown
      https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drfalse
        		unknown
        https://cdn.entity.87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
        • URL Reputation: safe
        		unknown
        https://api.addins.omex.office.net/appinfo/query87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
        • URL Reputation: safe
        		unknown
        https://clients.config.office.net/user/v1.0/tenantassociationkey87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
        • URL Reputation: safe
        		unknown
        https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
        • URL Reputation: safe
        		unknown
        https://login.windows.localnullOUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etl.0.drfalse
          		unknown
          https://powerlift.acompli.net87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
          • URL Reputation: safe
          		unknown
          https://urldefense.com/v3/__https://info.nhanow.com/hs/preferences-center/en/direct?data=W2nXS-N30h-Potential Phish Please provide your feedback (you could be thanked with $100!).msg, ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drfalse
            		unknown
            https://rpsticket.partnerservices.getmicrosoftkey.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
            • URL Reputation: safe
            		unknown
            https://lookup.onenote.com/lookup/geolocation/v187AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
            • URL Reputation: safe
            		unknown
            https://cortana.ai87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
            • URL Reputation: safe
            		unknown
            https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
            • URL Reputation: safe
            		unknown
            https://api.powerbi.com/v1.0/myorg/imports87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
            • URL Reputation: safe
            		unknown
            https://notification.m365.svc.cloud.microsoft/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
              		unknown
              https://cloudfiles.onenote.com/upload.aspx87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
              • URL Reputation: safe
              		unknown
              https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
              • URL Reputation: safe
              		unknown
              https://entitlement.diagnosticssdf.office.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
              • URL Reputation: safe
              		unknown
              https://api.aadrm.com/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
              • URL Reputation: safe
              		unknown
              https://ofcrecsvcapi-int.azurewebsites.net/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
              • URL Reputation: safe
              		unknown
              https://info.nhanow.com/hs-fs/hubfs/COOL-header-logo.png?width=300&upscale=true&name=COOL-hePotential Phish Please provide your feedback (you could be thanked with $100!).msgfalse
                		unknown
                https://canary.designerapp.87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                • URL Reputation: safe
                		unknown
                https://ic3.teams.office.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                • URL Reputation: safe
                		unknown
                https://www.yammer.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                • URL Reputation: safe
                		unknown
                https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                • URL Reputation: safe
                		unknown
                https://api.microsoftstream.com/api/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                  		unknown
                  https://info.nhanow.com/e3t/Cto/T5+113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVW95jsXz3Db1TPotential Phish Please provide your feedback (you could be thanked with $100!).msgfalse
                    		unknown
                    https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://cr.office.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                      		unknown
                      https://messagebroker.mobile.m365.svc.cloud.microsoft87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                      • URL Reputation: safe
                      		unknown
                      https://otelrules.svc.static.microsoft87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                        		unknown
                        https://portal.office.com/account/?ref=ClientMeControl87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://clients.config.office.net/c2r/v1.0/DeltaAdvisory87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://edge.skype.com/registrar/prod87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://graph.ppe.windows.net87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://res.getmicrosoftkey.com/api/redemptionevents87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://powerlift-frontdesk.acompli.net87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://tasks.office.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://login.windows.localROUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etl.0.drfalse
                          		unknown
                          https://officeci.azurewebsites.net/api/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://sr.outlook.office.net/ws/speech/recognize/assistant/work87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://info.nhanow.com/-temporary-slug-39182f43-3c8c-4741-beaa-74081392f799Potential Phish Please provide your feedback (you could be thanked with $100!).msgfalse
                            		unknown
                            https://api.scheduler.87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://my.microsoftpersonalcontent.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                              		unknown
                              https://store.office.cn/addinstemplate87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://api.aadrm.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://edge.skype.com/rps87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://outlook.office.com/autosuggest/api/v1/init?cvid=87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                		unknown
                                https://globaldisco.crm.dynamics.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://messaging.engagement.office.com/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://dev0-api.acompli.net/autodetect87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://www.odwebp.svc.ms87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://api.diagnosticssdf.office.com/v2/feedback87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://api.powerbi.com/v1.0/myorg/groups87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://web.microsoftstream.com/video/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://api.addins.store.officeppe.com/addinstemplate87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://info.nhanow.com/hs-fs/hubfs/COOL-header-logo.png?width=300&upscale=true&name=COOL-header-log~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drfalse
                                  		unknown
                                  https://graph.windows.net87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://dataservice.o365filtering.com/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://login.windows.localnullDOUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etl.0.drfalse
                                    		unknown
                                    https://officesetup.getmicrosoftkey.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://analysis.windows.net/powerbi/api87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://prod-global-autodetect.acompli.net/autodetect87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://substrate.office.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://outlook.office365.com/autodiscover/autodiscover.json87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://consent.config.office.com/consentcheckin/v1.0/consents87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://notification.m365.svc.cloud.microsoft/PushNotifications.Register87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                      		unknown
                                      https://d.docs.live.net87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                        		unknown
                                        https://safelinks.protection.outlook.com/api/GetPolicy87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://ncus.contentsync.87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                          		unknown
                                          https://policy.hubspot.com/abuse-complaints)Potential Phish Please provide your feedback (you could be thanked with $100!).msg, ~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp.0.drfalse
                                            		unknown
                                            https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://weather.service.msn.com/data.aspx87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://apis.live.net/v5.0/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://officepyservice.office.net/service.functionality87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://templatesmetadata.office.net/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://messaging.lifecycle.office.com/87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://mss.office.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://pushchannel.1drv.ms87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://management.azure.com87AB19CE-801B-4DFF-A61A-1FAB024D6CE0.0.drfalse
                                            • URL Reputation: safe
                                            		unknown

                                            World Map of Contacted IPs

                                            ⊘No contacted IP infos

                                            General Information

                                            Joe Sandbox version:41.0.0 Charoite
                                            Analysis ID:1546031
                                            Start date and time:2024-10-31 11:52:36 +01:00
                                            Joe Sandbox product:CloudBasic
                                            Overall analysis duration:0h 5m 4s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                            Number of analysed new started processes analysed:13
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • EGA enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Sample name:Potential Phish Please provide your feedback (you could be thanked with $100!).msg
                                            Detection:CLEAN
                                            Classification:clean2.winMSG@4/21@0/0
                                            Cookbook Comments:
                                            • Found application associated with file extension: .msg

                                            Warnings

                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                                            • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 52.109.68.129, 2.19.126.160, 2.19.126.151, 40.74.98.194
                                            • Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, a1864.dscd.akamai.net, onedscolprdjpw02.japanwest.cloudapp.azure.com, ecs.office.com, self-events-data.trafficmanager.net, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                            • VT rate limit hit for: Potential Phish Please provide your feedback (you could be thanked with $100!).msg

                                            Simulations

                                            Behavior and APIs

                                            ⊘No simulations

                                            LLM Input / Output

                                            Joe Sandbox View / Context

                                            IPs

                                            ⊘No context

                                            Domains

                                            ⊘No context

                                            ASNs

                                            ⊘No context

                                            JA3 Fingerprints

                                            ⊘No context

                                            Dropped Files

                                            ⊘No context

                                            Created / dropped Files

                                            C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):231348
                                            Entropy (8bit):4.384508030449989
                                            Encrypted:false
                                            SSDEEP:1536:JXYL0lgsUUI2opkvBgsXyNcAz79ysQqt2RAywqoQ0ercm0FvI68yh6ul5bcqq7ec:GegkGKgNmiGu2YqoQ5rt0Fv99DUPJSkj
                                            MD5:29A9EDD634DF9EFF68A08A8C752CC5BB
                                            SHA1:1786928FDE6768F0B42DC6162A4EEBABB4D8E701
                                            SHA-256:7A2D94B2C55541D7FBD38E2BF4758B3AD220390E6CF08FEBB9580CE98654170C
                                            SHA-512:FFFDA5E97B9B71E0BF467E8FEFCE0CB11B708401E8DEACBD93AC76E2F7C077772256F04A79D1EBD57B2DEE2806D512C24AB5027E3F001BB728B06A7F239F68B7
                                            Malicious:false
                                            Reputation:low
                                            Preview:TH02...... ...3!.+......SM01X...,....b%!.+..........IPM.Activity...........h...............h............H..h.........%C....h.........F..H..h\hub ...AppD...h8...0.........h+#.g...........h........_`&k...h.!.g@...I.Dw...h....H...8.+k...0....T...............d.........2h...............k..............!h.............. hDR............#h....8.........$h.F......8....."h..............'h..............1h+#.g<.........0h....4....+k../h....h.....+kH..h....p.........-h .......4.....+h.#.g........................ ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                            Category:dropped
                                            Size (bytes):322260
                                            Entropy (8bit):4.000299760592446
                                            Encrypted:false
                                            SSDEEP:6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
                                            MD5:CC90D669144261B198DEAD45AA266572
                                            SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                                            SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                                            SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                                            Malicious:false
                                            Reputation:high, very likely benign file
                                            Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:ASCII text, with no line terminators
                                            Category:modified
                                            Size (bytes):10
                                            Entropy (8bit):2.7219280948873625
                                            Encrypted:false
                                            SSDEEP:3:LIq:V
                                            MD5:ECC919B63FEAAFA40C33120281AA727B
                                            SHA1:DC9EC01330AC191B55D30AAE997C4F5A07CE85F9
                                            SHA-256:798638A573C8522267A3B1B3BC3D24CA97219131D1963491FAF6CB7A96085026
                                            SHA-512:1D12966AA5F3B5B409DFF615F06A12585D2437F9F3282D2E1DD74928B1BE2BD79A11A09B1858FA3157382006BFBED6098EB5E75C6BDF1B93009CE779D3E8E733
                                            Malicious:false
                                            Reputation:low
                                            Preview:1730372054

                                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\87AB19CE-801B-4DFF-A61A-1FAB024D6CE0

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):180288
                                            Entropy (8bit):5.290996002837195
                                            Encrypted:false
                                            SSDEEP:1536:Di2XfRAqFbH41gLEwLe7HW8QM/o/NMOcAZl1p5ihs7EXXOEADpOoagYdGVF8S7CC:JPe7HW8QM/o/aXbbkx
                                            MD5:954B02EE4EAFD98937FBB5A081C12625
                                            SHA1:A4EC81247D5BB6476C6EBC64076F7DC65E203906
                                            SHA-256:53F81F63C14C208031B31FE3D1C1E41C0461ACE46AD68A1ED6C8686FD1083E90
                                            SHA-512:EC98F91D0EA57BA3C4307F0480846B4D2317F763CFBBF13FE8CEAC06CA5F7BB40118AC0F85C406D96DC98E286AC55CAEB502AB57D66EE2BA21A4BC2CCA6F4556
                                            Malicious:false
                                            Reputation:low
                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-31T10:54:03">.. Build: 16.0.18222.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                                            Category:dropped
                                            Size (bytes):4096
                                            Entropy (8bit):0.09216609452072291
                                            Encrypted:false
                                            SSDEEP:3:lSWFN3l/klslpF/4llfll:l9F8E0/
                                            MD5:F138A66469C10D5761C6CBB36F2163C3
                                            SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
                                            SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
                                            SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
                                            Malicious:false
                                            Reputation:high, very likely benign file
                                            Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:SQLite Rollback Journal
                                            Category:dropped
                                            Size (bytes):4616
                                            Entropy (8bit):0.13760166725504608
                                            Encrypted:false
                                            SSDEEP:3:7FEG2l+Tl/sll/FllkpMRgSWbNFl/sl+ltlslVlllfllTn:7+/laSg9bNFlEs1EP/j
                                            MD5:9A96F145C7E0E5859DCD814D00BE22C5
                                            SHA1:083B0B80E242525783E15B44EB2F83B518BD0A61
                                            SHA-256:6801291DAD719DE83D42D7B95594B2D5B4FCBA8F353332235B6007BF98C73F44
                                            SHA-512:2F634EE0E17DBCB1EE85B1C0DAD092119E0B744A914B23FFB1715EB36786614D5FF43D6CC7F6F850BA6B38E3E74A603DC00ED97EA3D95B6B0C5C2AFE5A8541E5
                                            Malicious:false
                                            Reputation:low
                                            Preview:.... .c......|.k....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):32768
                                            Entropy (8bit):0.04384012686664322
                                            Encrypted:false
                                            SSDEEP:3:G4l2waajwfurnl2waajwfur1lWlL9//Xlvlll1lllwlvlllglbXdbllAlldl+l:G4l2wvj3nl2wvj310L9XXPH4l942U
                                            MD5:B49AF4FC18252A118A03A71B1DD4E56C
                                            SHA1:D41FE481CDAF40D1CF09C849AB9DB0F90B79096D
                                            SHA-256:F1144EB95FCBB42C1658580AB1A0C058869D45F245FA9617689FC450A8EAADEE
                                            SHA-512:EF5C57EC77BA2054274102430178BB65A34D28B76340A6C363916F7815308CD375FA69450145A48EC467232C6712C03A98074C1A172349868F99C00EF728DD19
                                            Malicious:false
                                            Reputation:low
                                            Preview:..-....................... _T........|p.).........-....................... _T........|p.)...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:SQLite Write-Ahead Log, version 3007000
                                            Category:dropped
                                            Size (bytes):45352
                                            Entropy (8bit):0.39310087722309933
                                            Encrypted:false
                                            SSDEEP:24:KDcMX2v8Q3zRD88Ull7DBtDi4kZERDLJsTzqt8VtbDBtDi4kZERDs:hMX2UQ1Y8Ull7DYMxizO8VFDYM
                                            MD5:416E7EB42D519FFBF05F46DD718950B5
                                            SHA1:4858F6DECCB25C3C0174EFF6D9AC71028E9A33C1
                                            SHA-256:C872429D8E95E1FA53B741B30BCD430ADAD7F874CE0C839C2C0156EB9484B6B4
                                            SHA-512:BAF6B4AC4F5D2ED981F5FE6C009D6BC8A97AC2EE010F7C573587372C62E4C8A6549170428F1F2BFB22D12821147629940979751BF1245D71458C958D998807A2
                                            Malicious:false
                                            Preview:7....-...............|p.....2VZ..............|p..6,.:.//SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):2278
                                            Entropy (8bit):3.8424778094522196
                                            Encrypted:false
                                            SSDEEP:48:uiTrlKxsxxCxl9Il8ufgr+yAlP2qsQ8WbtjOpDYd1rc:vmY2K+6nbtjOpr
                                            MD5:8899142A9BD120EF4A5FDBD6ADFF491C
                                            SHA1:04D5447D6A6CF6BA346FF8DDF10B94FA24C6A2A6
                                            SHA-256:46D29376C7D4518FA78BBADC2B2DC93E0AB988437E6069108556152FDF319680
                                            SHA-512:E9D20969A8086C56C479842C1AE9C69E1BC34FBA9BB96B2CF3EB8DFDA93EF49E40BF06FAEF72B9652F5FD9E79EB21811D5D67D575D7928EB83C1BD07155378A1
                                            Malicious:false
                                            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.2.0.m.I.s.r.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.3.g.b.q.J.F.

                                            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):2684
                                            Entropy (8bit):3.913721737705682
                                            Encrypted:false
                                            SSDEEP:48:uiTrlKxJx/lxl9Il8ufgrs1pIr2bk1FU0v5egTlYPad/vc:SBY2s15uFUM8yIH
                                            MD5:991BEF78E44528486C357A3D3D885E06
                                            SHA1:389F6A10A2AE3CC58535610C22A34E9FAD6EAF10
                                            SHA-256:5BACD0B4FAD301E4C225E5C2611FCD68462F943E5E9AF89AC9B58868A962ECA2
                                            SHA-512:4C8CADFB715CBC3F738153B5105A8C0AD0C827C06F7864631218A9B88BC4336C75024619E4548490DC9479979764DC4B4C5103354E68905B9FF580C19AC20298
                                            Malicious:false
                                            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.5.+.O.s.F.R.K.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.3.g.b.q.J.F.

                                            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):4542
                                            Entropy (8bit):3.9951243836826826
                                            Encrypted:false
                                            SSDEEP:48:uiTrlKxxxgxD9Il8ufgrjyeXGSuYZC/Vzf8dGCvtF5KjTO5vqP1b8knjiSbnlsPh:zY2jyeruY6BYFsJh7iGlgPXydDd8NV
                                            MD5:E16AAB11E575361DD63A3082A038743E
                                            SHA1:7E362DD975A49410E482E6A40638429C61A7F56E
                                            SHA-256:60FAD98A82F7A48154809235F32792754F264D50A4F6B5552D61AE8436A0EB81
                                            SHA-512:0254DFF33EB4F572BCF35E497027321E2723A485A0E0774DCF54F6A2460243E7151C742131B617DCA4E22E8F92020EEEBFB91B57CA7D3D5AE64A5966D45AF4C9
                                            Malicious:false
                                            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".d.u.h.Q.f.o.M.r.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.3.g.b.q.J.F.

                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{1D89CE50-E4ED-45A0-9175-99CBF38594E6}.tmp

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):59920
                                            Entropy (8bit):4.186749379043188
                                            Encrypted:false
                                            SSDEEP:1536:tPDWdULVvBHQZaUpASd8zoLtVGBGgAxKyxLN79io56PSHfIIzzI:tPydULlxQZj69oLfL9noeI
                                            MD5:E7DA6FFAAB03CC06EA35D5B681D06D9F
                                            SHA1:A414E89775DE012524E7429763522187C2A3079A
                                            SHA-256:03381AD9D418E2A104C9F291CD5DE4D9340CA52C5C3E47F8E409527FCC5A388A
                                            SHA-512:FFA3B2CBDB7E2F494C0077583F00E8C41531AE6C28786F36F8AB95F8E45C6861197C012AA9EABAE14044809E6DA6AF9A3001B186B0D433FDBB043DA287A8FDDE
                                            Malicious:false
                                            Preview:......-.-.-.-.-.-.-.-.-.-. .B.e.g.i.n. .E.m.a.i.l. .H.e.a.d.e.r.s. .-.-.-.-.-.-.-.-.-.-.....................................................................................................................................................................................................................................................................................................................................................................................................................................................\...$.......8...........R...F...6.......X....%...%..b&...&...&...'...(...(..z)...)..F*...4...5..:5..^5...5..................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730372039789984200_7A2E42BB-257F-4B00-A95A-A5232CBEFC37.log

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:ASCII text, with very long lines (1981), with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):20971520
                                            Entropy (8bit):0.00868476868440631
                                            Encrypted:false
                                            SSDEEP:384:kOBCTxS+qe1jL687a/TGUsjwMbMOstXB76:kOBCTxSjGX687a/TGUsjFbMZpB76
                                            MD5:1D7369052AD24B5648C1825AC2AE6705
                                            SHA1:B05A206D5C55C25D3383D99CE1A4737DCF6A3A6C
                                            SHA-256:6A3F164C2E1A2D150891B31D56A6395DBE1C83D202D572E9589F640216771C7A
                                            SHA-512:64FFC2C5C94275D7D7F7ABA98788150C4285F67A3918CD081B31FD45D836690E8E9E9383D63F7594C0F25156BCBDBF1411091D422865F2F5BEFE398274219905
                                            Malicious:false
                                            Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/31/2024 10:53:59.974.OUTLOOK (0x1CA0).0x1CA4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-10-31T10:53:59.974Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"6FA7C3DB-5A63-45CE-9D3A-535FF7D7E5FA","Data.PreviousSessionInitTime":"2024-10-31T10:53:32.500Z","Data.PreviousSessionUninitTime":"2024-10-31T10:53:35.656Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...10/31/2024 10:54:00.630.OUTLOOK (0x1CA0).0x1DE4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":24

                                            C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730372039791782900_7A2E42BB-257F-4B00-A95A-A5232CBEFC37.log

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):20971520
                                            Entropy (8bit):0.0
                                            Encrypted:false
                                            SSDEEP:3::
                                            MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                            SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                            SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                            SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                            Malicious:false
                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T0653580833-7328.etl

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):204800
                                            Entropy (8bit):4.878882867408128
                                            Encrypted:false
                                            SSDEEP:3072:V4RYeWNfuORrDNVHxhPTXlt//U3GS7xfx7JU6oBQ4b3xggI0hRRM:XuORrDe
                                            MD5:B18431E93D929227FDBC2368869F0C94
                                            SHA1:F5B92D1FC6E85A046418687D7D3EFBBC10CBB7DF
                                            SHA-256:58C78E11A6E329D260E975108044D277BD9401FC8628D985D5B44743BD295059
                                            SHA-512:A88EFB50F6E9A69043DF3697268A98A891CAAEE9B144A4FE48C92A6BDA1FD489C9ABF62C899AE87E3AFFF15B77197EA8B2CCDB4EF224A4248ABFA5B6D9D977AF
                                            Malicious:false
                                            Preview:............................................................................d...........,.H0.+..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................@zW...........,.H0.+..........v.2._.O.U.T.L.O.O.K.:.1.c.a.0.:.d.c.e.5.3.d.0.e.6.f.d.f.4.4.b.7.8.b.a.9.0.7.a.0.f.5.2.4.a.2.d.0...C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.3.1.T.0.6.5.3.5.8.0.8.3.3.-.7.3.2.8...e.t.l...........P.P.........,.H0.+..................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241031T0654310754-7376.etl

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):16384
                                            Entropy (8bit):3.5893574380956093
                                            Encrypted:false
                                            SSDEEP:96:CzqVZUFFYLPMB04EaLpl2Ys+9lCRLcM2aye4fLu5D6eV:KqmaL0B04rLL2YfWRLcMDX4fLu1jV
                                            MD5:7DF75469CBBDF9472C841F6CB41EB905
                                            SHA1:BDA42CC3B672901DB082D520D3979483EEE73D07
                                            SHA-256:3AF4906F1688D886E6A78EC232D5E491A76C3B5ED2043EA751350F2DE7427247
                                            SHA-512:EE7D152E0762DDAA0C806D72760D16A937B45C8203E4B16B12C66198841F8866BF5D49E62A1810D73D859CE73DB7C20BD4B686D9F2D350DE53A1AE3F3237CA00
                                            Malicious:false
                                            Preview:............................................................................d..............C.+..................eJ......<..D.+..Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................@zW..............C.+..........v.2._.O.U.T.L.O.O.K.:.1.c.d.0.:.8.2.1.e.3.c.b.6.f.8.5.d.4.5.e.2.8.6.a.0.7.f.3.d.3.0.7.4.c.9.6.a...C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.3.1.T.0.6.5.4.3.1.0.7.5.4.-.7.3.7.6...e.t.l...........P.P............C.+..................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\~DF3AA228386344A721.TMP

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):163840
                                            Entropy (8bit):0.3565708816008891
                                            Encrypted:false
                                            SSDEEP:192:m4I6/glilkno0ldcFnHsXY1pzYn4MrM4CjNgiXHW1OuqAbAsk/:HI64liWjdclMob84MrM4BiXH1uqMt
                                            MD5:FA1F07E8886932780FB3A95627246BCD
                                            SHA1:7B6563C901E18EA9507C71B385BA0DAF9E1D0FD7
                                            SHA-256:9577724498F56262E19475C1F35705CB9550432F41812A6408132BC35AD979E8
                                            SHA-512:34714F31C8CB753FC63AA83AC4F069C2EAD8386A1794CA732595E433F633057C143F7C44DB5F1CBAB7E96F17F8E2F18BA7AF8F732F33841ACC4C91C80CFEF6DC
                                            Malicious:false
                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):30
                                            Entropy (8bit):1.172253928364927
                                            Encrypted:false
                                            SSDEEP:3:qk/X:qk/
                                            MD5:8860D52461605EDFAE4AE9CE0BE0A4C5
                                            SHA1:4636FE2FF37612F301D05804AADD6F55366FDB29
                                            SHA-256:CA29FE3066B1B7600D604DB0564D54CC47C237594CF2C4F0FB89862F84DCB784
                                            SHA-512:C12C58EF58CFB591BBA0B505DEA2794D86237ACECEEF1A449E36FF14A42C52DE54E36425D772776E967F1D31E97E86FBF17221D57DEE0A4B96ED3D8FDE632701
                                            Malicious:false
                                            Preview:..............................

                                            C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:Composite Document File V2 Document, Cannot read section info
                                            Category:dropped
                                            Size (bytes):16384
                                            Entropy (8bit):0.6701424416776844
                                            Encrypted:false
                                            SSDEEP:12:rl3baFpqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheC5t:r1mnq1Py961z
                                            MD5:1613C3FFE2599B8CFDBA6B0C1F0B43FE
                                            SHA1:56FEA8FBC1CAF22F16D859B8827D8410206CB886
                                            SHA-256:305E9738FE50A9344310FE7808AF27E648487BDDBE820AA3460BB9356D49944B
                                            SHA-512:22C2B8F78CAAB69630B61152B8A8AEF5DCC648AE4FE48C0ABCD6365CCB084D5C71F9ACFAC5136D7FA6F1AC200B1CAE555B4266C49B6C554AA649A794145FA0AC
                                            Malicious:false
                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:Microsoft Outlook email folder (>=2003)
                                            Category:dropped
                                            Size (bytes):271360
                                            Entropy (8bit):1.530778708210384
                                            Encrypted:false
                                            SSDEEP:768:FQccgLg79+CRMEZHQq8KALXse5D4JiNk0YG+0/VIxruTIFV:mgU75GsHOLce5cJJaNI1T/
                                            MD5:E951B1A0AB7BD3FE84CD3B66A58D7A29
                                            SHA1:B25CD3A24AEB1360ECD41C6223FE9549EEE2C500
                                            SHA-256:099C9B52B99976AE63BDECFB4E1A1DA6FC3E757648D229ABF6F5F1306ACF8BCC
                                            SHA-512:36C8F282067B373E360581E17124AE3CA0DF678729839E7496A4065EFECDFD081399D34D8D4CA63697319E62D198216865F55184F19E824F580ABB1CEA671D8C
                                            Malicious:false
                                            Preview:!BDN.O.?SM......\.......................\................@...........@...@...................................@...........................................................................$.......D.......:..........................................................................................................................................................................................................................................................................................................................D........^.s.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                            Download File
                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):131072
                                            Entropy (8bit):0.9443706572981222
                                            Encrypted:false
                                            SSDEEP:192:Rf7wjTIFVgwJ5DePMrzEiJaYKL/r/34bk9tO8AdiyN+uh4dNsi:WjTIFVHrDeRigYqV/Ydiyvhiyi
                                            MD5:A17C96B81FFEC59C6ED8C763EDD36AC3
                                            SHA1:4BD0E6D6AB77B5E0FF9550B5FA11D99F410617DC
                                            SHA-256:694459A1656DE0575294811539B0F2E6E0F2D09D864C8F539883A9B4673CD929
                                            SHA-512:DB97233A01954AE061668D89748D3F7F9A479FE14DA11DFA7F9E355E02F6B3FB01EFF452788DB5CB3235DC5DA6C647D811BDA98F9C165967F9412D16A747786C
                                            Malicious:false
                                            Preview:f{..C...K............V.-.+....................#.!BDN.O.?SM......\.......................\................@...........@...@...................................@...........................................................................$.......D.......:..........................................................................................................................................................................................................................................................................................................................D........^.s....V.-.+.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                                            Static File Info

                                            General

                                            File type:CDFV2 Microsoft Outlook Message
                                            Entropy (8bit):5.4422630913529
                                            TrID:
                                            • Outlook Message (71009/1) 58.92%
                                            • Outlook Form Template (41509/1) 34.44%
                                            • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                            File name:Potential Phish Please provide your feedback (you could be thanked with $100!).msg
                                            File size:160'768 bytes
                                            MD5:c70298e6544dca7785e35a83fe010637
                                            SHA1:fbcc77b517d4c657603cf0de64f81119dfea70f1
                                            SHA256:5c2a25ef2f68feced4c572c1f3215d9357077da6091b4a1cd3b4c8083a0a7c83
                                            SHA512:762d5216d59477c127625951fe135abd3f55f9a4bfa26e2363570500d9cacc12dd6f335858fd3bfd0b20f165927419886f6391293a89177530939c954f0815b0
                                            SSDEEP:3072:w/e28FtrcqGOYIi9w/lgSJQLz6kt9EiF6g0IbNc0gE4LC23Q+yiF82dQlcvEkUAl:Xxz/Yr9wS6QLTEiF6g0Ir+dYcT
                                            TLSH:FBF3D82076E5020AF177DB769DF25492D937BD92AE308A8E3099730E4773D41A861F3E
                                            File Content Preview:........................>.......................................................T..............................................................................................................................................................................

                                            Static Mail

                                            General

                                            Subject:Potential Phish: Please provide your feedback (you could be thanked with $100!)
                                            From:Amy Glenn <Amy.Glenn@myLRH.org>
                                            To:IT Tech Sec <ITTEchSec@myLRH.org>
                                            Cc:
                                            BCC:
                                            Date:Thu, 31 Oct 2024 11:35:03 +0100
                                            Communications:
                                            • ---------- Begin Email Headers ---------- Received: from PRDHCCEXCH05.lrmcad.lrmcnet.com (10.152.37.21) by PRDPWCEXCH03.lrmcad.lrmcnet.com (172.23.129.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11 via Mailbox Transport; Wed, 30 Oct 2024 18:41:45 -0400 Received: from PRDHCCEXCH01.lrmcad.lrmcnet.com (10.152.37.16) by PRDHCCEXCH05.lrmcad.lrmcnet.com (10.152.37.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 30 Oct 2024 18:41:44 -0400 Received: from mx0b-00024d01.pphosted.com (192.168.244.21) by PRDHCCEXCH01.lrmcad.lrmcnet.com (10.152.37.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11 via Frontend Transport; Wed, 30 Oct 2024 18:41:44 -0400 Received: from pps.filterd (m0307741.ppops.net [127.0.0.1]) by mx0b-00024d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 49UAUcSS005212 for <amy.glenn@mylrh.org>; Wed, 30 Oct 2024 18:41:44 -0400 Authentication-Results: ppops.net; spf=pass smtp.mailfrom=1axbxwrj6tx5uan30v441bfeo1gewpi23mbvt3-amy+2Eglenn=mylrh.org@bf01x.hubspotemail.net; dkim=pass header.s=hs1 header.d=bf01x.hubspotemail.net; dkim=pass header.s=hs1-1430252 header.d=nhanow.com; dmarc=pass header.from=nhanow.com Received: from bid47up.bf01x.hubspotemail.net (bid47up.bf01x.hubspotemail.net [158.247.24.111]) by mx0b-00024d01.pphosted.com (PPS) with ESMTPS id 42k261hryf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for <amy.glenn@mylrh.org>; Wed, 30 Oct 2024 18:41:43 -0400 (EDT) Received: by 172.16.224.35 with SMTP id a0b2377bl4ybydqyzqqacqwwx8t9curukft8ay4krev; Wed, 30 Oct 2024 22:41:43 GMT DKIM-Signature: v=1; s=hs1; d=bf01x.hubspotemail.net; i=@bf01x.hubspotemail.net; h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id:list-unsubscribe-post; a=rsa-sha256; c=relaxed/relaxed; bh=JRwjR2vQ3KHBr1Iv6xP5NxtdLsY6PVNjZjIcmCG+YnQ=; b=E6OUOqSml+0qWvA/dSgkdYAlZJULnNgnITXYtSkcxzwcJEOQf6Juw7//PlnBsG nnaiuTtfj1z3lU+tQ+a2I6gfdJ1F/1eIGeoGzxDshyy3GXod8JuyiTVagdt5Mvg 40ju2u8W02Wv3VCAf5jAfvAoiDdhlFOBK/bemK18NX9YnlOIkSLw1wsdYcbjbtX ldiJttQarSo2ojpq8wWF8HusPVH0K8m+JSWQCOHW0TR9NQOEBI/g4njKUCp7Scx AM3qThHlvD/yh08+mIK1C1IfqSPsXb7J9esaeXEn7n2kHqmSmSs4uVwFVN2PtMS Z1JuZ+TTSv+aYwG4/Bn5R6YUC42A==; q=dns/txt; t=1730328103; x=1730590903; DKIM-Signature: v=1; s=hs1-1430252; d=nhanow.com; i=@nhanow.com; h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id:list-unsubscribe-post; a=rsa-sha256; c=relaxed/relaxed; bh=JRwjR2vQ3KHBr1Iv6xP5NxtdLsY6PVNjZjIcmCG+YnQ=; b=En9NVAeo9OcSMRVLBsIxxk3XV0eweRgeDC1ijUslthSRudFyD4O6tGRTkuXAQ1 X9ml5R0l0eKTb+55rc828Ic6c0bMs4ESEuqCK04PLhHsI6cwNBW44pooxJeBD4M AGzfPUaO+OlvNSNfghUpAvXG1Qoyz720TVn0ipVIRS+XJPepmQD5ZMF6rrX9G07 Ij1U0XYTMX9hv2osef5Gw2uMzgroRIQ0Ntg+/1H2I9X7Sgq7j+7z2eUWP4cZPhS Ih0mMINbBX/6yS+pepEQn5tHbDE/4Rg8exG/lJrYtOLFXxYc56ADboiQ/Fx6yrZ UU4Uaz4b5mHjSECh6LECYRkxd3cg==; q=dns/txt; t=1730328103; x=1730590903; X-HS-Cid: 1axe5vptqpepci7si2tk7m25l7ll530h63klbf List-Unsubscribe: <mailto:1axc0odusv4j49cizvzswoosxvsciqfxlmtkob-amy+2Eglenn=mylrh.org@bf01x.hubspotemail.net?subject=unsubscribe>, <https://info.nhanow.com/hs/subscription-preferences/v2/unsubscribe-all?data=W2nXS-N30h-H8W34gPnK3LG4DcW3GVDHp25lmVxW2RjBhk382DMkW3SCV4S1Z6Fm8W30Hq-_2YMYDNW38x6H_3Kb2D5W1Sym4b1N5FMrW3grH5b22TlQjW3__D5v1L73wqW1Vg6WZ3KbWL1W2-zQpR23qfj2W3858VN1QllGGW32984w4rGLf3W4pDZv33_SHStW4crcpF3_pxxJW4tnYxg1_tDnYW306Rpy3d9Q4bW385bbr3jqkkjW4mBCgP1Bqvr9W1X1Wy02CT8L7W1N58wN3JGlBFW2Yftpv4cP21vW3yR2LB32nqjvW3SZzrP45WSjSW2CZ8dn3NQ-LLW3yYkfN2PSVXRW4p85q74fKWTBW4ttx4n1X5GfwW3jvp3f346RW_W1ZpcMS3QVZbcW2zxTmg2YdJ3SW36k1Nq34jTnCW2YlZCz3GMs03W2TJDcD3yNtZ8W2KP-xH2nGLPlW3z2TWF30G4cvW3NRWr02FTnGlW3F1Khb2TqbkLW3_zNQl45D3ytW3LFJ0T1_pSb2W2r8XgS4ktYgbW3R4QtK3BMvRlW1Qy95s38jRQ0W4krWV02YwcqD0> Date: Wed, 30 Oct 2024 17:41:43 -0500 From: National Healthcareer Association <nhamarketing@nhanow.com> Reply-To: nhamarketing@nhanow.com To: amy.glenn@mylrh.org Message-ID: <1730327993337.0a96cd49-5652-4a4f-bcea-4109235af679@bf01x.hubspotemail.net> Subject: Please provide your feedback (you could be thanked with $100!) Content-Type: multipart/alternative; boundary="----=_Part_6634543_183318467.1730328103365" X-Report-Abuse-To: abuse@hubspot.com (see https://policy.hubspot.com/abuse-complaints) List-Unsubscribe-Post: List-Unsubscribe=One-Click X-Proofpoint-GUID: ganPoLO8d41tXTCOA4g5FrFrY8jBAOVW X-CLX-Response: 1TFkXExsRCkx6FxkTGREKWUQXb0BgTF1/SU5lXE8RClhYF2xfcm8SW24Zc31 yEQp4Thd6BWVZeWsZRBJiQhEKeEsXbF9ybxJbbhlzfXIRCnlMF25eGxptSEBBeH9AEQpDSBcHHx kRCkNZFwceHxIRCkNJFxoEGhoaEQpZTRdnZnIRCllJFwcbGHEbEBl3BhIecRkbHhwQHh8edwYYG gYaEQpZXhdsbHkRCklGF0ZLQU9GS0ROR09OdUJFWV5PThEKSUcXeE9NEQpDThdNS0R6RWZlEk4e G15yfmllax5NH2xYbFhzEkBoa2V8fREKWFwXHwQaBBkdHQUbGgQbGxoEGxkeBBkZEBseGh8aEQp eWRdPfWxYbhEKTVwXHx8bEQpMWhdpa21NXV0RCkxGF29ra2traxEKQk8XbW8YTU1CYl5rEkQRCk NaFxsfEgQYHh0EGB4EGxsbEQpCXhcbEQpCRhdvUnxBX39sa2waHhEKQkcXY0hBf3J5SVhDHmsRC kJcFxsRCl5OFxsRCkJLF3oFZVl5axlEEmJCEQpCSRd6BWVZeWsZRBJiQhEKQkUXbx9reU1cGBNs ExkRCkJOF3oFZVl5axlEEmJCEQpCTBdsX3JvEltuGXN9chEKQmwXZ3BGW2xDYx1tZm8RCkJAF29 9cn0fW0x/f0dnEQpCWBdhY21YGlB5ckEZchEKWlgXGREKeUMXaGlaTURlYX1aSUMRCllLFxIYHR 8RClpLFxIYHR8RCnBoF2Nhe21lWH9hSRNJEB8cEQpwaBdlGnt8HVNHZx8dWxAaEQpwaBdkXmxlE l9oaFocaxAHHRoRCnBoF2hiE0BkWgFTZBJ5EBwZEQpwaBdoE2dOS0JjWB1TYBAfGREKcGgXbxtm eVpyX3tSS0UQGxoSEQpwaBd6cGRPTU5seHhlXxAaEQpwaBdvQhJFWV1aHhocZBAbHxEKcH0XYnl FE3hyckRGGG8QGhEKcH0XaB5rfxIeHB19WXIQGhEKcH0XYG4aTXAFbEZNR0gQGhEKcH0Xa1hGGn BffV1vWWcQGhEKcH0XZkAYQRNIHhtvYmgQGhEKcH0XYm9PYkF8ZUZbUH0QGhEKcH0XbXJsbWYFb mlQfRMQGhEKcH0XaQUbRUkdR3sdXmwQGhEKcH0XZmZdZEUBS3lQW2sQGhEKcH8XZEFtZm9GZ35t a2UQGxsdEQpwXxdtc3puYRxkQEZEfRAbGR4RCnBfF2dZU2ZoZ3JYGW9yEBsYHBEKcGwXbE5tZWU Sf0JIeU0QEx8RCm1+FxoRClhNF0sRIA== X-Proofpoint-ORIG-GUID: ganPoLO8d41tXTCOA4g5FrFrY8jBAOVW X-CLX-Shades: MLX MIME-Version: 1.0 X-Proofpoint-SPF-Result: pass X-Proofpoint-SPF-Record: v=spf1 ip4:54.174.52.64/31 ip4:54.174.52.116/31 ip4:54.174.52.160 ip4:54.174.52.193 ip4:54.174.52.216 ip4:54.174.52.248/31 ip4:54.174.59.74/31 ip4:108.179.150.176/28 ip4:143.244.89.150/31 ip4:143.244.89.158/31 ip4:143.244.89.162/31 ip4:143.244.90.112/29 ip4:143.244.91.48/30 ip4:143.244.92.168/30 ip4:143.244.94.196/30 ip4:143.244.94.200/30 ip4:158.247.18.2/31 ip4:158.247.18.36/31 ip4:158.247.18.64/27 ip4:158.247.18.96 ip4:158.247.24.88/29 ip4:158.247.24.96/28 -all X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.60.29 definitions=2024-09-06_09,2024-09-06_01,2024-09-02_01 X-Proofpoint-Spam-Details: rule=inbound_policy_notspam policy=inbound_policy score=0 mlxscore=0 malwarescore=0 bulkscore=0 phishscore=0 priorityscore=393 impostorscore=0 suspectscore=0 spamscore=0 adultscore=0 lowpriorityscore=0 mlxlogscore=999 clxscore=91 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2409260000 definitions=main-2410300177 domainage_hfrom=8275 domainage_replyto=8275 Return-Path: 1axbxwrj6tx5uan30v441bfeo1gewpi23mbvt3-amy+2Eglenn=mylrh.org@bf01x.hubspotemail.net X-MS-Exchange-Organization-Network-Message-Id: 0aabee8a-ee9b-417d-d6c7-08dcf93407fe X-MS-Exchange-Organization-AuthSource: PRDHCCEXCH01.lrmcad.lrmcnet.com X-MS-Exchange-Organization-AuthAs: Internal X-MS-Exchange-Organization-AuthMechanism: 10 X-TM-AS-Product-Ver: SMEX-14.0.0.3197-9.1.2019-28764.002 X-TM-AS-Result: No-10--1.151500-8.000000 X-TMASE-MatchedRID: 4lgKwWfF5n9nKRrPo03bGt+1DX+Vmw/rbHJfnwQdKC/9E8LhUjCwr3f1 5FQyVEnhCdsKZv+kMnvaHGpNWFFrlJbYpPhsWuoiTTysOxB1HJ57IXwgnhvfjaxoW/bGvXCzxdL ADED5qdd8xLKCcOW40xXok5X1zyB6bImvEGrHk0Lho/N4UHLwiwHgraKiqXb1P4ocZuwLw4+iOR CerYMqGvQDJolDVo6aRvmZ+9cOrka5kTI8BpRqcih3g1nRJyiyUiKFwzE/7ruaTlsctRJLlg26K ZiyWHIT6n1N9n8I2oBE+zlzrMJYkl154oVx0Y268NQlTV1CgBUYVA70BsYql0WhP7zMuauCTYqM unSsVC8fkbFhcYpcHcg/60C8rocAsNA365dJC+vPWiwmvlcoTxFA30JdQNpcH1358/5xCm/9BGB GSD22SeDcvAdA6M6l0gKOD202XMbIbJpBc69HHttSV/haf4BOeBOFIlIdtGYRI/x/OBPlP4V5N4 QjLJg9jHk5JhbV9ubLtG+hgmZMEVKy0A6DtQlXJLPVz0IFMiyeMzVLMVFcn8iKCB9IhVKnTYusl aLddcQUFRYFvO5FyDtRsRploHPXO3Y9BE9+f5Gd3D+KgWlRa03FCr51zRWHNUiKoTxIZGytks+h Z1eND40MUkuijhxH2dZvYSEvbLerdJ6mxFWCLvU+Dhf/6JjjM3/AY2Y0EhOFoRp02AQHN1iaTq0 o1XZ6Q4FBVwoZXrllwl1XefoCGCTsj2fBdH5+WZisoxFcUYLTF2hY9pzQmJqMxGQ+Gu8Zwbp6WC MdEeOOdD5ofLGfknltLja+RsFNXM7GlSI3LZKjg0lrtKMWytPrwIyJqPLlqrpyOZMW5b35Y4vG5 3pW6GmrhpYZ9NHjngLMrj0CX8tLVLuYlRVqf8jkucmPu3j76aADh29ojIgHvfG6dvIqugpF4ljx avdFYZdTx+lU1T1kelkqDg4oSoX8GVXMxeCBKUjiRM2i7J/JEVloCQ+aEejRpGX3nEk1iB7o+ZZ 6d8ybNkDw+vw4E98d1ju6QxpFyQl0Kv4LoYskgP63xxukHMx0MUf7xzFf1GbQ+v9aGUDPRAtRNT pMK1mYoALv7kDpIHJ+94HtX0+jSoi6A3bzyjamaw4xivo9 X-TM-AS-User-Approved-Sender: No X-TM-AS-User-Blocked-Sender: No X-TMASE-Result: 10--1.151500-8.000000 X-TMASE-Version: SMEX-14.0.0.3197-9.1.2019-28764.002 X-TM-SNTS-SMTP: F6DD994E194F27987C3E53F6DCF3B37198ADCEDCC247D70F1BE4A9077444DFC42000:9 X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXJnq?;1968500;0;This mail has been scanned by Trend Micro ScanMail for Microsoft Exchange; X-MS-Exchange-Organization-SCL: 0 X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.6095706 X-MS-Exchange-Processed-By-BccFoldering: 15.02.1544.011 ---------- End Email Headers ---------- ---------- Begin Reported Email ---------- WARNING: This email originated from outside of Lakeland Regional. Do not click links or open attachments unless you recognize the sender & are expecting the message. Click the Report Phish button if this email is suspicious. ________________________________ Were giving a limited audience a chance to win a $100 gift card for 10 minutes of feedback. [National Healthcareer Association] <https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5*113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVN95jt7W3lYMRW5BW0B06lZ3p-W8y6Bk87QFSCYW3h19YV1kVRCTW1nG8kd36Lp1jW47N33W3lTjDJN55kDjl8XG89W5qxv4K4vLYpxW6h2X283-d4GLW19Xzz775j92nW7Strp29855C_W2JCB7p69pTlhW4x2BDy8pKX9FW3m85vR64TY_nN6lKSYMRWTCwW3rHknM37G3rmW24qMbF6kpdvqW1GSXzc6SWGDNMY1QcGKsgmfW7jQMgL5n4C-8f6sddjj04__;Kw!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTwetVs2wvw$> Wed like to ask for your help with a survey as were working to better understand what learning solutions are most important to you. This information will help guide the development of future products and services to meet your needs. Our survey will take about 10 minutes to complete. You may pause and return to the survey later if needed. Your responses will be kept strictly confidential and will not be tied to you in any way. To thank you for your time, well enter you in a drawing to win 1 of 5 $100 Amazon gift cards upon completion. Get started now, as eligibility for this survey and gift card drawing will close on Sunday, November 3. Begin the Survey <https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5*113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVN95jt8P3lYMRW7lCdLW6lZ3lfW2SqKMX4qcgGhW3VgLc08gh6rJW3GSbgZ778C43W6MmH483lg3MgW1XWq0S7Vg337W6dBrzL1xXyXfN7QwMFwjzPfqW4Jh0V02mfvrYW4lSxMk7JLm-BW3FfkJK7Rzk2qW61B8Nf6BjTSFW3cVTnS8Xsn6FW524VkG116Jp_W5W-0Tr6_nlNFW7wgXD75zbCH4W81BcBv80Wbt1W8-GnjZ3LyQPvN8N_kcy6gyD1W3xLXcg52rMVBW7N3z1N4RydDlVXhsPt1lcDW2W6zR1Jn1Z0vQQN6SRYMJGlg-gW5N-z9686_CYvf70LFGg04__;Kw!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTwesf6lHVU$> [Facebook] <https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5*113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVN95jt8b3lYMRW69sMD-6lZ3pMW3RVCCB2M-fmZW4PCgDm62GF3-N6mF8lkf4VnHW4gNpVL9dFxFFW5pXSMc6hmbt8W4RqRB14Ys7grW4zvZzH2bBbsdW9l9nF87L0m1xVf6VKf346B1GW3W8BcB3QzkY2N3tMv6MKVYKMW70y4fb990pWBW80gMlk8fzcSyW3zjfzl8wmxpRW1YGw7d50_Sq9W8q17Bg1mhdbWW1SgTj67JdytyW6r5rL-7kPhbZW3fsS033FmhVGF7_5cwxJ_Csf1p6cM404__;Kw!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTwe7oZqbdA$> [LinkedIn] <https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5*113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVN95jt8b3lYMRW69sMD-6lZ3p6VZLHcf42xN3XW30TCx55npJqsVXm4sg3BbZqVW4DR5Vs1dnP4pW3WbvQ_64T7xsW1612Q95DrrH6W60mD9D1NCylrW14qrkF6Jm8J6W8-YhFj4QP1WQW62ryQh5hlj3ZV-0N7Z8nKMW0W4gZPP79hJnyHW8zl8DF2wz36bVyGn8p41rMnYW593xY66mHnF5W27c1Bm8Rf_nZW5kqg8c5f4-xYN6wqPWfqHJPbV9HWFd7hXgY1W6JyGs88xD8_yf52NqSl04__;Kw!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTweZh5mccw$> [X] <https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5*113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVN95jt7W3lYMRW5BW0B06lZ3lpW2TXD5b15DSkTW933_ck4vMbJRW7g-_w62DltcXN3Zq8Z3m_fxFVcPJC57_Sv2BW5t2xVY6gFbJMW74yv9_90_pgtN3rdg2FBMlmCW4PQM3g4SHygrW3RVLJZ8t58S2W3w0Xt52nwQgHVCF3bQ58wqDwW8nSlc087MspkW7DL4C-569NShW4Nn29w5r-J8gW6pRVCw2-DTNsW8hHzgW3QZPPpW1gH6zJ6MhJrsf8_nDfT04__;Kw!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTweQcnpalo$> [Instagram] <https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5*113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVN95jt8b3lYMRW69sMD-6lZ3lVW41GTMQ5dGYnYN3Z0wJsf8bpXW4bhQR39j6HD0W20zGFR7PSQ6gW3vwTfd5RwgPKW62T0rw7gHHdnW1ZfFv66s41myW6q_lR47xDdcFW3rqX_w9cBlLtVdY5sN7sXMgSW327z6P51MnXXW14wSN53f9TgXW5bQQcF5Ty3jHM4kcf0d4flCW7f2Cd6297LdDW302Y_Q2t4WzNW1Pg0vq1_ljJdV3N24D8vKXFbW7XXZ7z26kMRWW21WszW716ltXf8Dc6Y404__;Kw!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTwe2RW9tgU$> [YouTube] <https://urldefense.com/v3/__https://info.nhanow.com/e3t/Ctc/T5*113/c94v804/VVrx3G2HJQPPN2XkPzyl1F6YW4qM5Xr5mPRvVN95jt8v3lYMRW6N1vHY6lZ3lpN8Nw6fn6TwKlN7MZBV2n1zD2W23j_q48ByBZFW4ssJ8S8swF2mW2NHSTm4PJ5D3W7B5qKM3k7qwYW6LvZMb5T1VXwV5YxwJ2680ylW4k6BPl3R2PhzN8K2SQdQsphVW6kV7Jx34Q1NGW5RgTlj8zzZyyW2Qk3-Y6hWZJDW1h0Wbl7twRVJW8HGS7Z92zWlxW1FpTs23Qw4FzW3hyT-f5qnDMhN4_ZchsNTZwsW4zS8FM31XT93W3w_pXF6bqR39N65gRgW7JhqLW739lKD5z8VvFd9jCM004__;Kw!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTweV1K2eF0$> National Healthcareer Association, 11161 Overbrook Rd., Leawood, KS 66211, United States Unsubscribe<https://urldefense.com/v3/__https://info.nhanow.com/hs/preferences-center/en/direct?data=W2nXS-N30h-G8W49xxvS2FRj-FW1X9QR63GVChpW3M13Xd2TBkWsW1_dcQr30JfNkW3dzzl243HD_-W1XdfdT1_c32zW4fpPB-3gtNVVW1YZZ5_2My30QW2PPC304cRrVfW2vXCrj1VvfcRW43R5RL2WrM3GW4kpRNk2y4bhSW2sB3Q73QSyrvW25flsh4cwV1FW23h7gR1LhlZWW1XnDsP1Qg7W6W2Yp0hS3LNjvGW32nmdG4kdfY1W34f5Z92MQ9GMW4ft8cp2WdWX_W2PMWj11ZpgnYW3gy6sr4mGP0sW41W2X73h_lt0W3j4mMm3gcHLvW32pbt92HPqkRW2TkJMX3XVS-HW3jpmN73d3ZgRW3SBYfs30zyfZW2TgPJS1LCP5zW2-KHdg38cPnXW3LV_pr2RRrlhW4mBdPN3R38gJW3_R3q649S3D6W1_rV9s3VXJQtW2p98nG49wC_TW1Lhn194hPn0xW2-qSN31S3X8KW1_l-ql2t7wl5W253HwB2TGZc5W45HPvZ3d7kR6W2Rlcw-3QS5XjW2-kXkH4m8J_XW2nD9Yj4csxfYW38rr7n1Zc9DKf2Pn4tL04&utm_source=hs_email&utm_medium=email&utm_content=331656950&_hsenc=p2ANqtz-8oEbK9lmdoBU-_jiAjEks75C0xN36GnJKXFHS_oeGgqU9j6QucpohB7alKzdFhr3XkeZzl9KX3MM1p8nOUNVdo2ja8jA&_hsmi=331656950__;!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTweiLBJOOU$> Manage preferences<https://urldefense.com/v3/__https://info.nhanow.com/hs/preferences-center/en/page?data=W2nXS-N30h-G8W49xxvS2FRj-FW1X9QR63GVChpW3M13Xd2TBkWsW1_dcQr30JfNkW3dzzl243HD_-W1XdfdT1_c32zW4fpPB-3gtNVVW1YZZ5_2My30QW2PPC304cRrVfW2vXCrj1VvfcRW43R5RL2WrM3GW4kpRNk2y4bhSW2sB3Q73QSyrvW25flsh4cwV1FW23h7gR1LhlZWW1XnDsP1Qg7W6W2Yp0hS3LNjvGW32nmdG4kdfY1W34f5Z92MQ9GMW4ft8cp2WdWX_W2PMWj11ZpgnYW3gy6sr4mGP0sW41W2X73h_lt0W3j4mMm3gcHLvW32pbt92HPqkRW2TkJMX3XVS-HW3jpmN73d3ZgRW3SBYfs30zyfZW2TgPJS1LCP5zW2-KHdg38cPnXW3LV_pr2RRrlhW4mBdPN3R38gJW3_R3q649S3D6W1_rV9s3VXJQtW2p98nG49wC_TW1Lhn194hPn0xW2-qSN31S3X8KW1_l-ql2t7wl5W253HwB2TGZc5W45HPvZ3d7kR6W2Rlcw-3QS5XjW2-kXkH4m8J_XW2nD9Yj4csxfYW38rr7n1Zc9DKf2Pn4tL04&utm_source=hs_email&utm_medium=email&utm_content=331656950&_hsenc=p2ANqtz-8oEbK9lmdoBU-_jiAjEks75C0xN36GnJKXFHS_oeGgqU9j6QucpohB7alKzdFhr3XkeZzl9KX3MM1p8nOUNVdo2ja8jA&_hsmi=331656950__;!!KAwXmIspl3H4!rDnuT1fd_SP0Ri9mDXEjyooi8RUqgvfM4JwLf_CM-LLDNe7I06cuPZs8CY1TC2d3QGkt54pYfwRRbTwef2GMFyE$> ---------- End Reported Email ----------
                                            Attachments:
                                            • Headers.txt

                                            Headers

                                            Key Value
                                            Receivedfrom PRDPWCEXCH03.lrmcad.lrmcnet.com ([172.23.129.67]) by
                                            15.2.1544.11 via Mailbox Transport; Thu, 31 Oct 2024 0635:05 -0400
                                            15.2.1544.11; Thu, 31 Oct 2024 0635:04 -0400
                                            15.02.1544.011; Thu, 31 Oct 2024 0635:03 -0400
                                            Content-Typeapplication/ms-tnef; name="winmail.dat"
                                            Content-Transfer-Encodingbinary
                                            FromAmy Glenn <Amy.Glenn@myLRH.org>
                                            ToIT Tech Sec <ITTEchSec@myLRH.org>
                                            SubjectPotential Phish: Please provide your feedback (you could be thanked
                                            Thread-TopicPotential Phish: Please provide your feedback (you could be
                                            Thread-IndexAQHbKxzlFEHNO/N0yUuiWeiXHFmBb7Kgqt0c
                                            DateThu, 31 Oct 2024 06:35:03 -0400
                                            Message-ID<43259242063644da99ff4be24af85f3f@myLRH.org>
                                            References<1730327993337.0a96cd49-5652-4a4f-bcea-4109235af679@bf01x.hubspotemail.net>
                                            In-Reply-To<1730327993337.0a96cd49-5652-4a4f-bcea-4109235af679@bf01x.hubspotemail.net>
                                            Accept-Languageen-US
                                            Content-Languageen-US
                                            X-MS-Has-Attachyes
                                            X-MS-Exchange-Organization-SCL0
                                            X-MS-TNEF-Correlator<43259242063644da99ff4be24af85f3f@myLRH.org>
                                            MIME-Version1.0
                                            X-MS-Exchange-Organization-MessageDirectionalityOriginating
                                            X-MS-Exchange-Organization-AuthSourcePRDPWCEXCH03.lrmcad.lrmcnet.com
                                            X-MS-Exchange-Organization-AuthAsInternal
                                            X-MS-Exchange-Organization-AuthMechanism04
                                            X-Originating-IP[10.255.228.21]
                                            X-MS-Exchange-Organization-Network-Message-Id0d6b72d5-e702-4828-14b0-08dcf997ae54
                                            Return-PathAmy.Glenn@myLRH.org
                                            X-TM-AS-Product-VerSMEX-14.0.0.3197-9.1.2019-28764.006
                                            X-TM-AS-ResultNo-10--14.723800-8.000000
                                            X-TMASE-MatchedRIDUEe6CCDNlZxxazowmPdgEDPYPpis8lSONhnZmTNx2yDr+s9HBJx1HaPD
                                            X-TM-AS-User-Approved-SenderNo
                                            X-TM-AS-User-Blocked-SenderNo
                                            X-TMASE-Result10--14.723800-8.000000
                                            X-TMASE-VersionSMEX-14.0.0.3197-9.1.2019-28764.006
                                            X-TM-SNTS-SMTP2C064242F08C7237EC12CAB193ECCB2A202A1B573F1FF0E9B55152EAF502B0A82000:9
                                            X-MS-Exchange-Organization-AVStamp-MailboxSMEXJnq?;1968700;0;This mail has
                                            X-MS-Exchange-Transport-EndToEndLatency00:00:01.4230967
                                            X-MS-Exchange-Processed-By-BccFoldering15.02.1544.011
                                            dateThu, 31 Oct 2024 11:35:03 +0100

                                            File Icon

                                            Icon Hash:c4e1928eacb280a2

                                            Network Behavior

                                            ⊘No network behavior found

                                            Statistics

                                            CPU Usage

                                            Click to jump to process

                                            Memory Usage

                                            Click to jump to process

                                            High Level Behavior Distribution

                                            Click to dive into process behavior distribution

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            General

                                            Target ID:0
                                            Start time:06:53:54
                                            Start date:31/10/2024
                                            Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            Wow64 process (32bit):true
                                            Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Potential Phish Please provide your feedback (you could be thanked with $100!).msg"
                                            Imagebase:0xf20000
                                            File size:34'446'744 bytes
                                            MD5 hash:91A5292942864110ED734005B7E005C0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:false

                                            General

                                            Target ID:6
                                            Start time:06:54:09
                                            Start date:31/10/2024
                                            Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "409E7DC6-D584-49D9-9D03-1BBB00223894" "602D875E-325A-442C-B931-6E8CD179B770" "7328" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                                            Imagebase:0x7ff72e4f0000
                                            File size:710'048 bytes
                                            MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:false

                                            General

                                            Target ID:11
                                            Start time:06:54:31
                                            Start date:31/10/2024
                                            Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                            Wow64 process (32bit):true
                                            Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding
                                            Imagebase:0xf20000
                                            File size:34'446'744 bytes
                                            MD5 hash:91A5292942864110ED734005B7E005C0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            Disassembly

                                            ⊘No disassembly