IOC Report
nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml

loading gif

Files

File Path
Type
Category
Malicious
nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml
RFC 822 mail, ASCII text, with very long lines (699), with CRLF line terminators
initial sample
 malicious
C:\Users\user\Downloads\ConsultTrueNorth.zip (copy)
Zip archive data, at least v2.0 to extract, compression method=store
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
data
dropped
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml
XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\B888F789-B398-426F-B9A3-07E0FBE3EC98
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal
SQLite Write-Ahead Log, version 3007000
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4CD5F857-B678-4B72-A25D-99B4F64BD354}.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1724782415077788100_D77AD509-3118-42EB-A3F0-5C44D0888A1E.log
ASCII text, with very long lines (28769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1724782415080408400_D77AD509-3118-42EB-A3F0-5C44D0888A1E.log
data
dropped
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240827T1413340143-2564.etl
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Unicode text, UTF-16, little-endian text, with CRLF line terminators
modified
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:13:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:13:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:13:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:13:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:13:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst
Microsoft Outlook email folder (>=2003)
dropped
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
data
dropped
C:\Users\user\Downloads\ConsultTrueNorth.zip.crdownload
Zip archive data, at least v2.0 to extract, compression method=store
dropped
Chrome Cache Entry: 562
ASCII text, with very long lines (5393)
dropped
Chrome Cache Entry: 563
ASCII text, with very long lines (25926)
downloaded
Chrome Cache Entry: 564
ASCII text, with very long lines (5371)
dropped
Chrome Cache Entry: 565
ASCII text, with very long lines (25661)
dropped
Chrome Cache Entry: 566
ASCII text, with very long lines (65457)
downloaded
Chrome Cache Entry: 567
ASCII text, with very long lines (30298)
downloaded
Chrome Cache Entry: 568
ASCII text, with very long lines (12636)
downloaded
Chrome Cache Entry: 569
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 570
XML 1.0 document, ASCII text, with very long lines (443), with no line terminators
dropped
Chrome Cache Entry: 571
ASCII text, with very long lines (4078)
downloaded
Chrome Cache Entry: 572
ASCII text, with very long lines (42917)
downloaded
Chrome Cache Entry: 575
ASCII text, with very long lines (30298)
dropped
Chrome Cache Entry: 576
ASCII text, with very long lines (58999)
downloaded
Chrome Cache Entry: 581
ASCII text, with very long lines (4442)
dropped
Chrome Cache Entry: 582
ASCII text, with very long lines (42917)
dropped
Chrome Cache Entry: 583
ASCII text, with very long lines (63602)
downloaded
Chrome Cache Entry: 584
ASCII text, with very long lines (15301)
downloaded
Chrome Cache Entry: 585
ASCII text, with very long lines (59234)
downloaded
Chrome Cache Entry: 586
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 587
ASCII text, with very long lines (12139)
dropped
Chrome Cache Entry: 588
ASCII text, with very long lines (30298)
dropped
Chrome Cache Entry: 589
ASCII text, with very long lines (59728)
downloaded
Chrome Cache Entry: 590
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 591
ASCII text, with very long lines (5393)
downloaded
Chrome Cache Entry: 592
ASCII text, with very long lines (9675)
downloaded
Chrome Cache Entry: 593
PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 594
ASCII text, with very long lines (6851)
dropped
Chrome Cache Entry: 595
ASCII text, with very long lines (7232)
dropped
Chrome Cache Entry: 596
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 72x72, components 3
downloaded
Chrome Cache Entry: 597
ASCII text, with very long lines (2203)
downloaded
Chrome Cache Entry: 598
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 599
Web Open Font Format, TrueType, length 27296, version 1.3277
downloaded
Chrome Cache Entry: 600
ASCII text, with very long lines (20301)
downloaded
Chrome Cache Entry: 601
ASCII text, with very long lines (7323)
downloaded
Chrome Cache Entry: 602
ASCII text, with very long lines (14852)
dropped
Chrome Cache Entry: 603
ASCII text, with very long lines (4286)
downloaded
Chrome Cache Entry: 604
ASCII text
downloaded
Chrome Cache Entry: 605
ASCII text, with very long lines (12337)
dropped
Chrome Cache Entry: 606
Web Open Font Format, TrueType, length 13668, version 1.3277
downloaded
Chrome Cache Entry: 607
ASCII text, with very long lines (5383)
downloaded
Chrome Cache Entry: 608
Web Open Font Format, TrueType, length 4624, version 1.3277
downloaded
Chrome Cache Entry: 609
ASCII text, with very long lines (7232)
downloaded
Chrome Cache Entry: 610
ASCII text, with very long lines (16126)
downloaded
Chrome Cache Entry: 611
ASCII text, with very long lines (855)
downloaded
Chrome Cache Entry: 612
ASCII text, with very long lines (4204)
downloaded
Chrome Cache Entry: 613
ASCII text, with very long lines (1094)
downloaded
Chrome Cache Entry: 614
ASCII text, with very long lines (12035)
downloaded
Chrome Cache Entry: 615
ASCII text, with very long lines (5436)
dropped
Chrome Cache Entry: 616
Web Open Font Format, TrueType, length 16776, version 1.3277
downloaded
Chrome Cache Entry: 617
ASCII text, with very long lines (7293)
downloaded
Chrome Cache Entry: 618
ASCII text, with very long lines (14852)
downloaded
Chrome Cache Entry: 619
ASCII text, with very long lines (9848)
downloaded
Chrome Cache Entry: 620
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
dropped
Chrome Cache Entry: 621
ASCII text, with very long lines (4670)
dropped
Chrome Cache Entry: 622
Java source, ASCII text
downloaded
Chrome Cache Entry: 623
ASCII text, with very long lines (849)
downloaded
Chrome Cache Entry: 624
Unicode text, UTF-8 text, with very long lines (65471)
downloaded
Chrome Cache Entry: 625
ASCII text, with very long lines (44971)
dropped
Chrome Cache Entry: 626
Unicode text, UTF-8 text, with very long lines (32700)
dropped
Chrome Cache Entry: 627
ASCII text, with very long lines (2510)
downloaded
Chrome Cache Entry: 628
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 629
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 630
Unicode text, UTF-8 text, with very long lines (18796)
downloaded
Chrome Cache Entry: 631
Web Open Font Format, TrueType, length 15684, version 1.3277
downloaded
Chrome Cache Entry: 632
ASCII text, with very long lines (44971)
downloaded
Chrome Cache Entry: 633
Unicode text, UTF-8 text, with very long lines (5270)
dropped
Chrome Cache Entry: 634
ASCII text, with very long lines (45021)
downloaded
Chrome Cache Entry: 635
Unicode text, UTF-8 text, with very long lines (41517)
downloaded
Chrome Cache Entry: 636
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 637
ASCII text, with very long lines (49198)
downloaded
Chrome Cache Entry: 638
ASCII text, with very long lines (12167)
downloaded
Chrome Cache Entry: 639
ASCII text, with very long lines (65461)
dropped
Chrome Cache Entry: 640
Web Open Font Format, TrueType, length 12800, version 1.3277
downloaded
Chrome Cache Entry: 641
ASCII text, with very long lines (6539)
dropped
Chrome Cache Entry: 642
ASCII text, with very long lines (1939)
downloaded
Chrome Cache Entry: 643
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 644
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 645
JSON data
dropped
Chrome Cache Entry: 646
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 647
ASCII text, with very long lines (35504)
dropped
Chrome Cache Entry: 648
ASCII text, with very long lines (42754)
dropped
Chrome Cache Entry: 649
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 650
Web Open Font Format, TrueType, length 15220, version 1.3277
downloaded
Chrome Cache Entry: 651
ASCII text, with very long lines (12139)
downloaded
Chrome Cache Entry: 652
ASCII text, with very long lines (15511)
downloaded
Chrome Cache Entry: 653
ASCII text, with very long lines (7375)
dropped
Chrome Cache Entry: 654
JSON data
dropped
Chrome Cache Entry: 655
Unicode text, UTF-8 text, with very long lines (45471)
downloaded
Chrome Cache Entry: 656
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 657
ASCII text, with very long lines (3923)
dropped
Chrome Cache Entry: 658
ASCII text, with very long lines (13893)
downloaded
Chrome Cache Entry: 659
Web Open Font Format, TrueType, length 17244, version 1.3277
downloaded
Chrome Cache Entry: 660
ASCII text, with very long lines (40143)
dropped
Chrome Cache Entry: 661
ASCII text, with very long lines (6134)
dropped
Chrome Cache Entry: 662
ASCII text, with very long lines (4186)
downloaded
Chrome Cache Entry: 663
Unicode text, UTF-8 text, with very long lines (18796)
dropped
Chrome Cache Entry: 664
ASCII text, with very long lines (8692)
downloaded
Chrome Cache Entry: 665
ASCII text, with very long lines (42754)
downloaded
Chrome Cache Entry: 666
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 667
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 668
ASCII text, with very long lines (2839)
downloaded
Chrome Cache Entry: 669
ASCII text, with very long lines (14999)
downloaded
Chrome Cache Entry: 670
JSON data
dropped
Chrome Cache Entry: 671
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 672
PNG image data, 171 x 213, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 673
ASCII text, with very long lines (7897)
dropped
Chrome Cache Entry: 674
Unicode text, UTF-8 text, with very long lines (10401)
downloaded
Chrome Cache Entry: 675
ASCII text, with very long lines (13520)
downloaded
Chrome Cache Entry: 676
ASCII text, with very long lines (17566)
downloaded
Chrome Cache Entry: 677
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 678
XML 1.0 document, ASCII text, with very long lines (443), with no line terminators
dropped
Chrome Cache Entry: 679
ASCII text, with very long lines (7235)
downloaded
Chrome Cache Entry: 680
ASCII text, with very long lines (7715)
downloaded
Chrome Cache Entry: 681
ASCII text, with very long lines (25661)
downloaded
Chrome Cache Entry: 682
ASCII text, with very long lines (14999)
dropped
Chrome Cache Entry: 683
HTML document, ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 684
ASCII text, with very long lines (4621)
dropped
Chrome Cache Entry: 685
Web Open Font Format, TrueType, length 13196, version 1.3277
downloaded
Chrome Cache Entry: 686
ASCII text, with very long lines (6090)
downloaded
Chrome Cache Entry: 687
ASCII text, with very long lines (16849)
dropped
Chrome Cache Entry: 688
ASCII text, with very long lines (4670)
downloaded
Chrome Cache Entry: 689
ASCII text, with very long lines (3123)
downloaded
Chrome Cache Entry: 690
ASCII text, with very long lines (6659)
downloaded
Chrome Cache Entry: 691
ASCII text, with very long lines (4551), with no line terminators
downloaded
Chrome Cache Entry: 692
ASCII text, with very long lines (14090)
dropped
Chrome Cache Entry: 693
Unicode text, UTF-8 text, with very long lines (32700)
downloaded
Chrome Cache Entry: 694
ASCII text, with very long lines (2487)
downloaded
Chrome Cache Entry: 695
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
Chrome Cache Entry: 696
ASCII text, with very long lines (52343)
downloaded
Chrome Cache Entry: 697
Unicode text, UTF-8 text, with very long lines (65308), with no line terminators
downloaded
Chrome Cache Entry: 698
ASCII text, with very long lines (3923)
downloaded
Chrome Cache Entry: 699
ASCII text, with very long lines (5610)
downloaded
Chrome Cache Entry: 700
Unicode text, UTF-8 text, with very long lines (10393)
downloaded
Chrome Cache Entry: 701
ASCII text, with very long lines (8399)
downloaded
Chrome Cache Entry: 702
ASCII text, with very long lines (1886)
downloaded
Chrome Cache Entry: 703
Zip archive data, at least v2.0 to extract, compression method=store
downloaded
Chrome Cache Entry: 704
ASCII text, with very long lines (5720)
downloaded
Chrome Cache Entry: 705
ASCII text, with very long lines (911)
downloaded
Chrome Cache Entry: 706
Web Open Font Format, TrueType, length 15504, version 1.3277
downloaded
Chrome Cache Entry: 707
ASCII text, with very long lines (855)
dropped
Chrome Cache Entry: 708
Unicode text, UTF-8 text, with very long lines (65308), with no line terminators
dropped
Chrome Cache Entry: 709
ASCII text, with very long lines (3819)
dropped
Chrome Cache Entry: 710
ASCII text, with very long lines (48338)
dropped
Chrome Cache Entry: 711
Unicode text, UTF-8 text, with very long lines (7518)
dropped
Chrome Cache Entry: 712
ASCII text, with very long lines (12852)
downloaded
Chrome Cache Entry: 713
ASCII text, with very long lines (44683)
downloaded
Chrome Cache Entry: 715
JSON data
dropped
Chrome Cache Entry: 716
ASCII text, with very long lines (10555)
downloaded
Chrome Cache Entry: 717
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 718
ASCII text, with very long lines (3819)
downloaded
Chrome Cache Entry: 719
Java source, ASCII text, with CRLF, LF line terminators
downloaded
Chrome Cache Entry: 720
ASCII text, with very long lines (6851)
downloaded
Chrome Cache Entry: 721
ASCII text, with very long lines (5178)
downloaded
Chrome Cache Entry: 722
Web Open Font Format, TrueType, length 12388, version 1.3277
downloaded
Chrome Cache Entry: 723
Web Open Font Format, TrueType, length 17456, version 1.3277
downloaded
Chrome Cache Entry: 724
ASCII text, with very long lines (50318)
downloaded
Chrome Cache Entry: 726
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 728
Web Open Font Format, TrueType, length 16704, version 1.3277
downloaded
Chrome Cache Entry: 729
Unicode text, UTF-8 text, with very long lines (28673)
downloaded
Chrome Cache Entry: 731
HTML document, ASCII text, with very long lines (56857), with CRLF line terminators
downloaded
Chrome Cache Entry: 733
ASCII text, with very long lines (43593)
dropped
Chrome Cache Entry: 734
ASCII text, with very long lines (16849)
downloaded
Chrome Cache Entry: 735
ASCII text, with very long lines (12337)
downloaded
Chrome Cache Entry: 736
ASCII text, with very long lines (24322)
downloaded
Chrome Cache Entry: 737
ASCII text, with very long lines (63602)
dropped
Chrome Cache Entry: 738
Unicode text, UTF-8 text, with very long lines (45743)
downloaded
Chrome Cache Entry: 739
ASCII text, with very long lines (13926)
downloaded
Chrome Cache Entry: 740
ASCII text, with very long lines (27907)
downloaded
Chrome Cache Entry: 741
Web Open Font Format, TrueType, length 15160, version 1.3277
downloaded
Chrome Cache Entry: 742
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 743
ASCII text, with very long lines (10932)
downloaded
Chrome Cache Entry: 744
ASCII text, with very long lines (22018)
downloaded
Chrome Cache Entry: 745
Web Open Font Format, TrueType, length 11900, version 1.3277
downloaded
Chrome Cache Entry: 746
ASCII text, with very long lines (59425)
dropped
Chrome Cache Entry: 747
ASCII text, with very long lines (65301)
downloaded
Chrome Cache Entry: 748
ASCII text, with very long lines (59425)
downloaded
Chrome Cache Entry: 749
ASCII text, with very long lines (4714)
downloaded
Chrome Cache Entry: 750
ASCII text, with very long lines (6813)
downloaded
Chrome Cache Entry: 751
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 752
ASCII text
downloaded
Chrome Cache Entry: 753
PNG image data, 171 x 213, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 754
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 755
ASCII text, with very long lines (25101)
downloaded
Chrome Cache Entry: 756
ASCII text, with very long lines (477)
downloaded
Chrome Cache Entry: 757
JSON data
dropped
Chrome Cache Entry: 758
ASCII text, with very long lines (57563)
downloaded
Chrome Cache Entry: 759
ASCII text, with very long lines (4714)
dropped
Chrome Cache Entry: 760
ASCII text, with very long lines (7071)
downloaded
Chrome Cache Entry: 761
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 762
ASCII text, with very long lines (612)
downloaded
Chrome Cache Entry: 763
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 764
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 765
Unicode text, UTF-8 text, with very long lines (22120)
downloaded
Chrome Cache Entry: 766
JSON data
dropped
Chrome Cache Entry: 767
Unicode text, UTF-8 text, with very long lines (45471)
dropped
Chrome Cache Entry: 768
ASCII text, with very long lines (1363)
downloaded
Chrome Cache Entry: 769
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 770
ASCII text, with very long lines (21550)
downloaded
Chrome Cache Entry: 771
Unicode text, UTF-8 text, with very long lines (18788)
downloaded
Chrome Cache Entry: 772
ASCII text, with very long lines (3109)
dropped
Chrome Cache Entry: 773
Unicode text, UTF-8 text, with very long lines (10401)
dropped
Chrome Cache Entry: 774
Web Open Font Format, TrueType, length 15812, version 1.3277
downloaded
Chrome Cache Entry: 775
Web Open Font Format, TrueType, length 2524, version 4.-22282
downloaded
Chrome Cache Entry: 776
Web Open Font Format, TrueType, length 16356, version 1.3277
downloaded
Chrome Cache Entry: 777
ASCII text, with very long lines (2159)
downloaded
Chrome Cache Entry: 778
ASCII text, with very long lines (11547)
downloaded
Chrome Cache Entry: 779
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 780
ASCII text, with very long lines (11745)
downloaded
Chrome Cache Entry: 781
Unicode text, UTF-8 text, with very long lines (12935)
downloaded
Chrome Cache Entry: 782
ASCII text, with very long lines (11014)
downloaded
Chrome Cache Entry: 783
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 784
ASCII text, with very long lines (7375)
downloaded
Chrome Cache Entry: 785
ASCII text, with very long lines (4825)
downloaded
Chrome Cache Entry: 786
ASCII text, with very long lines (4442)
downloaded
Chrome Cache Entry: 787
Web Open Font Format, TrueType, length 17852, version 1.3277
downloaded
Chrome Cache Entry: 788
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 789
JSON data
downloaded
Chrome Cache Entry: 790
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 791
C source, ASCII text, with very long lines (11334)
dropped
Chrome Cache Entry: 792
PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 793
ASCII text, with very long lines (10362)
dropped
Chrome Cache Entry: 794
ASCII text, with very long lines (5371)
downloaded
Chrome Cache Entry: 795
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 796
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 72x72, components 3
dropped
Chrome Cache Entry: 797
Unicode text, UTF-8 text, with very long lines (10101)
downloaded
Chrome Cache Entry: 798
ASCII text, with very long lines (6639)
downloaded
Chrome Cache Entry: 799
ASCII text
downloaded
Chrome Cache Entry: 800
ASCII text, with very long lines (2014)
downloaded
Chrome Cache Entry: 801
ASCII text, with very long lines (56954)
downloaded
Chrome Cache Entry: 802
ASCII text, with very long lines (1416)
downloaded
Chrome Cache Entry: 803
ASCII text, with very long lines (59728)
dropped
Chrome Cache Entry: 804
ASCII text, with very long lines (45422)
downloaded
Chrome Cache Entry: 805
C source, ASCII text, with very long lines (11334)
downloaded
Chrome Cache Entry: 806
ASCII text, with very long lines (5159)
downloaded
Chrome Cache Entry: 807
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 808
Web Open Font Format, TrueType, length 14960, version 1.3277
downloaded
Chrome Cache Entry: 809
ASCII text, with very long lines (4142)
downloaded
Chrome Cache Entry: 810
ASCII text, with very long lines (3702)
downloaded
Chrome Cache Entry: 811
ASCII text, with very long lines (56034)
downloaded
Chrome Cache Entry: 812
ASCII text, with very long lines (35504)
downloaded
Chrome Cache Entry: 813
ASCII text, with very long lines (5873)
downloaded
Chrome Cache Entry: 814
Unicode text, UTF-8 text, with very long lines (23196)
downloaded
Chrome Cache Entry: 815
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 816
ASCII text, with very long lines (36586)
dropped
Chrome Cache Entry: 817
ASCII text, with very long lines (45422)
dropped
Chrome Cache Entry: 818
ASCII text, with very long lines (19653)
downloaded
Chrome Cache Entry: 819
ASCII text, with very long lines (6539)
downloaded
Chrome Cache Entry: 820
ASCII text, with very long lines (2510)
dropped
Chrome Cache Entry: 821
ASCII text, with very long lines (7235)
dropped
Chrome Cache Entry: 822
ASCII text, with very long lines (5436)
downloaded
Chrome Cache Entry: 823
ASCII text, with very long lines (2249)
downloaded
Chrome Cache Entry: 824
ASCII text, with very long lines (2653)
downloaded
Chrome Cache Entry: 825
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 826
MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
downloaded
Chrome Cache Entry: 827
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 828
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 829
ASCII text, with very long lines (4621)
downloaded
Chrome Cache Entry: 830
Unicode text, UTF-8 text, with very long lines (12564)
downloaded
Chrome Cache Entry: 831
ASCII text, with very long lines (3858)
downloaded
Chrome Cache Entry: 832
Unicode text, UTF-8 text, with very long lines (7518)
downloaded
Chrome Cache Entry: 833
ASCII text, with very long lines (3109)
downloaded
Chrome Cache Entry: 834
ASCII text, with very long lines (17002)
downloaded
Chrome Cache Entry: 835
ASCII text, with very long lines (14090)
downloaded
Chrome Cache Entry: 836
ASCII text, with very long lines (30298)
downloaded
Chrome Cache Entry: 837
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 838
Unicode text, UTF-8 text, with very long lines (5270)
downloaded
Chrome Cache Entry: 839
ASCII text, with very long lines (11553)
downloaded
Chrome Cache Entry: 840
ASCII text, with very long lines (48338)
downloaded
Chrome Cache Entry: 841
ASCII text, with very long lines (2626)
downloaded
Chrome Cache Entry: 842
Web Open Font Format, TrueType, length 14704, version 1.3277
downloaded
Chrome Cache Entry: 843
ASCII text, with very long lines (7897)
downloaded
Chrome Cache Entry: 844
ASCII text, with very long lines (17333)
downloaded
Chrome Cache Entry: 845
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 846
Web Open Font Format, TrueType, length 17616, version 1.3277
downloaded
Chrome Cache Entry: 847
ASCII text, with very long lines (2764)
downloaded
Chrome Cache Entry: 848
ASCII text, with very long lines (688)
downloaded
Chrome Cache Entry: 849
ASCII text, with very long lines (2839)
dropped
Chrome Cache Entry: 850
Java source, ASCII text, with very long lines (23464)
downloaded
Chrome Cache Entry: 851
ASCII text, with very long lines (64938)
downloaded
Chrome Cache Entry: 852
ASCII text, with very long lines (17088)
downloaded
Chrome Cache Entry: 853
JSON data
downloaded
Chrome Cache Entry: 854
ASCII text, with very long lines (4605)
downloaded
Chrome Cache Entry: 855
ASCII text, with very long lines (12800)
dropped
Chrome Cache Entry: 856
ASCII text, with very long lines (5957)
downloaded
Chrome Cache Entry: 857
JSON data
downloaded
Chrome Cache Entry: 858
ASCII text, with very long lines (6813)
dropped
Chrome Cache Entry: 859
ASCII text, with very long lines (3467)
downloaded
Chrome Cache Entry: 860
Java source, ASCII text
dropped
Chrome Cache Entry: 861
Web Open Font Format, TrueType, length 15620, version 1.3277
downloaded
Chrome Cache Entry: 862
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 863
ASCII text, with very long lines (4142)
dropped
Chrome Cache Entry: 864
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 867
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 869
ASCII text, with very long lines (62741)
downloaded
Chrome Cache Entry: 870
ASCII text, with very long lines (12800)
downloaded
Chrome Cache Entry: 871
ASCII text, with very long lines (9848)
dropped
Chrome Cache Entry: 872
ASCII text, with very long lines (43593)
downloaded
Chrome Cache Entry: 873
ASCII text, with very long lines (10933)
downloaded
Chrome Cache Entry: 874
ASCII text, with very long lines (911)
dropped
Chrome Cache Entry: 875
ASCII text, with very long lines (17002)
dropped
Chrome Cache Entry: 876
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 877
ASCII text, with very long lines (40143)
downloaded
Chrome Cache Entry: 878
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 879
Unicode text, UTF-8 text, with very long lines (10960)
downloaded
Chrome Cache Entry: 880
ASCII text, with very long lines (6134)
downloaded
Chrome Cache Entry: 881
HTML document, Unicode text, UTF-8 text, with very long lines (1136)
downloaded
Chrome Cache Entry: 882
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 883
Web Open Font Format, TrueType, length 16000, version 1.3277
downloaded
Chrome Cache Entry: 884
ASCII text, with very long lines (10936)
downloaded
Chrome Cache Entry: 885
ASCII text, with very long lines (4979)
downloaded
Chrome Cache Entry: 886
ASCII text, with very long lines (10362)
downloaded
Chrome Cache Entry: 887
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 888
ASCII text, with very long lines (2283)
downloaded
Chrome Cache Entry: 889
ASCII text, with very long lines (9456)
downloaded
Chrome Cache Entry: 890
ASCII text, with very long lines (4551), with no line terminators
dropped
Chrome Cache Entry: 891
ASCII text, with very long lines (36586)
downloaded
Chrome Cache Entry: 892
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 893
ASCII text
downloaded
Chrome Cache Entry: 894
Unicode text, UTF-8 text, with very long lines (45449)
downloaded
Chrome Cache Entry: 895
Unicode text, UTF-8 text, with very long lines (22120)
dropped
Chrome Cache Entry: 896
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 897
ASCII text, with very long lines (65461)
downloaded
There are 334 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1956,i,4171209000397206722,2059583826206299065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
malicious
C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml"
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4CC444FA-4817-4491-9D2F-98276EAE2933" "E21FBA3F-8218-4F2B-8FD4-DC2A9C419541" "2564" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"

URLs

Name
IP
Malicious
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1
https://shell.suite.office.com:1443
unknown
https://designerapp.azurewebsites.net
unknown
https://autodiscover-s.outlook.com/
unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
unknown
https://outlook.office365.com/connectors
unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
unknown
https://netorgft13995914-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx
13.107.136.10
https://cdn.entity.
unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
unknown
https://rpsticket.partnerservices.getmicrosoftkey.com
unknown
https://lookup.onenote.com/lookup/geolocation/v1
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
unknown
https://outlook.office.com/apc/trans.gif?c92ddc14e5febb484d24848711b63f85
52.98.242.242
about:blank
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
unknown
https://api.aadrm.com/
unknown
https://canary.designerapp.
unknown
http://www.opensource.org/licenses/mit-license.php
unknown
https://tr-ooc-atm.office.com/apc/trans.gif?c14aed779e84dcfefcd608fc5d5363bd
52.98.152.178
https://www.yammer.com
unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
unknown
https://imosevero.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPWRIZFFiVU09JnVpZD1VU0VSMTkwODIwMjRVMDAwODE5MTY=N01
unknown
https://api.microsoftstream.com/api/
unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
unknown
https://northcentralus1-medias.svc.ms
unknown
https://cr.office.com
unknown
https://onedrive.live.com/?gologin=1
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft
unknown
https://otelrules.svc.static.microsoft
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
unknown
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
unknown
https://edge.skype.com/registrar/prod
unknown
https://res.getmicrosoftkey.com/api/redemptionevents
unknown
https://tasks.office.com
unknown
https://officeci.azurewebsites.net/api/
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
unknown
https://my.microsoftpersonalcontent.com
unknown
https://store.office.cn/addinstemplate
unknown
https://edge.skype.com/rps
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
unknown
https://messaging.engagement.office.com/
unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
unknown
https://www.odwebp.svc.ms
unknown
https://api.powerbi.com/v1.0/myorg/groups
unknown
https://web.microsoftstream.com/video/
unknown
https://api.addins.store.officeppe.com/addinstemplate
unknown
https://graph.windows.net
unknown
https://www.google.com/favicon.ico
172.217.18.4
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
unknown
https://consent.config.office.com/consentcheckin/v1.0/consents
unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
unknown
https://d.docs.live.net
unknown
https://safelinks.protection.outlook.com/api/GetPolicy
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
unknown
https://ncus.contentsync.
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
unknown
http://weather.service.msn.com/data.aspx
unknown
https://tr-ooc-atm.office.com/apc/trans.gif?97d59ca9a9f67daf4a7703d29ba141a8
52.98.152.178
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
unknown
https://pushchannel.1drv.ms
unknown
https://wus2.contentsync.
unknown
https://outlook.office.com/search
unknown
https://www.office.com/login?ru=%2Flaunch%2F$
unknown
https://clients.config.office.net/user/v1.0/ios
unknown
https://shellppe.msocdn.com
unknown
https://api.addins.omex.office.net/api/addins/search
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
unknown
https://outlook.office365.com/api/v1.0/me/Activities
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
unknown
https://clients.config.office.net/user/v1.0/android/policies
unknown
https://entitlement.diagnostics.office.com
unknown
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_api/v2.1/graphql
13.107.136.10
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
unknown
https://outlook.office.com/
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
unknown
https://storage.live.com/clientlogs/uploadlocation
unknown
https://imosevero.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPWRIZFFiVU09JnVpZD1VU0VSMTkwODIwMjRVMDAwODE5MTY=N0123N[EMail]
94.46.22.222
https://reactjs.org/link/react-polyfills
unknown
https://login.microsoftonline.com
unknown
https://substrate.office.com/search/api/v1/SearchHistory
unknown
https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK
13.107.136.10
https://shellprod.msocdn.com
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
unknown
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
unknown
https://centralus1-mediad.svc.ms
unknown
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
unknown
https://service.powerapps.com
unknown
https://graph.windows.net/
unknown
https://devnull.onenote.com
unknown
https://messaging.office.com/
unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ooc-g2.tm-4.office.com
52.98.242.242
dual-spo-0005.spo-msedge.net
13.107.136.10
google.com
142.250.185.206
mira-ooc.tm-4.office.com
52.98.152.178
www.google.com
172.217.18.4
FRA-efz.ms-acdc.office.com
52.98.179.146
imosevero.com
94.46.22.222
3e48341a82ff9cd91e0c9adb91a71e2f.fp.measure.office.com
unknown
netorgft13995914-my.sharepoint.com
unknown
netorgft13995914.sharepoint.com
unknown
r4.res.office365.com
unknown
outlook.office.com
unknown
southcentralus0-0.pushnp.svc.ms
unknown
southcentralus1-mediap.svc.ms
unknown
tr-ooc-atm.office.com
unknown
m365cdn.nel.measure.office.net
unknown
spo.nel.measure.office.net
unknown
upload.fp.measure.office.com
unknown
config.fp.measure.office.com
unknown
There are 9 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
142.250.185.206
google.com
United States
13.107.136.10
dual-spo-0005.spo-msedge.net
United States
192.168.2.8
unknown
unknown
192.168.2.18
unknown
unknown
52.98.152.178
mira-ooc.tm-4.office.com
United States
40.99.150.50
unknown
United States
52.98.179.146
FRA-efz.ms-acdc.office.com
United States
172.217.18.4
www.google.com
United States
52.98.242.242
ooc-g2.tm-4.office.com
United States
142.250.185.132
unknown
United States
239.255.255.250
unknown
Reserved
94.46.22.222
imosevero.com
Portugal
There are 2 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
CantBootResolution
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
ProfileBeingOpened
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
SessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
BootDiagnosticsLogFile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
OutlookBootFlag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
8;(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
SessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
ProfileBeingOpened
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Settings
Accounts
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\1e\417C44EB
@%SystemRoot%\system32\mlang.dll,-4612
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\1e\417C44EB
@%SystemRoot%\system32\mlang.dll,-4608
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Licensing
EligibleForExtendedGrace
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Wizards
PageSize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\MailSettings
Template
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
WMACUpdated
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Options
DefaultKerningLigatures
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
BootDiagnosticsLogFile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
CantBootResolution
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Settings\Data
global_AccountSignaturesDialogOpen
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
`f(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\ColleagueImport.ColleagueImportAddin
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\Microsoft.VbaAddinForOutlook.1
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
of(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
f(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OscAddin.Connect
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
f(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\UCAddin.LyncAddin.1
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
.g(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\UmOutlookAddin.FormRegionAddin
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
.g(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
>g(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
>g(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
>g(
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Settings\Data
global_AccountsNeedResyncingWithOwnershipV5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Settings\Data
global_AccountsNeedResyncingWithOwnershipV4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Settings\Data
global_AccountsNeedResyncingWithOwnershipV3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Settings\Data
global_AccountsNeedResyncingWithOwnership
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar
WorkDay
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Shared Tools\Proofing Tools\1.0\Custom Dictionaries
UpdateComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Volatile
MsaDevice
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet
UseRWHlinkNavigation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet
UseRWOSHlinkNavigation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046
000b046b
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9207f3e0a3b11019908b08002b2a56c2
11023d05
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Logging
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage
OutlookMAPI2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet
msoridShouldUseReauthRequestProxy
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
SessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\outlook
EcsRequestPending
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109A10090400000000000F01FEC\Usage
OutlookMAPI2Intl_1033
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046
00030429
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
{ED475418-B0D6-11D2-8C3B-00104B2A6676}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
LastChangeVer
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Exchange\Forms Registry
CacheSyncCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
{ED475418-B0D6-11D2-8C3B-00104B2A6676}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
LastChangeVer
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\ColleagueImport.ColleagueImportAddin
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Display Types\Balloons
HWND64ForOrphanedNotIcon
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
ColleagueImport.ColleagueImportAddin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\OneNote.OutlookAddin
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
OneNote.OutlookAddin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\OscAddin.Connect
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
OscAddin.Connect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
FilePath
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
StartDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\UCAddin.LyncAddin.1
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0
EndDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
UCAddin.LyncAddin.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\UmOutlookAddin.FormRegionAddin
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
UmOutlookAddin.FormRegionAddin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\UserInfo
CountQuickSteps
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
{ED475418-B0D6-11D2-8C3B-00104B2A6676}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
LastChangeVer
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook
Expires
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook
ETag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2564
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
LastChangeVer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018C00B8F8B0D2B
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
DeviceTicket
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Search\Catalog
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Search\Catalog
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Settings
Accounts
There are 121 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1
about:blank
https://google.com/404/