Windows Analysis Report
(No subject) (61).eml

Overview

General Information

Sample name: (No subject) (61).eml
Analysis ID: 1500051
MD5: be99f839a9f7be884aca6148fe909da2
SHA1: e6546325a3e827fbd7646c01c46e803a5da072eb
SHA256: 9db3b82853343008944fa8b596364b1116b98c428552fda6b073279cc4fc07cd
Infos:

Detection

HTMLPhisher
Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected BlockedWebSite
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory

Classification

Phishing
barindex
Yara detected BlockedWebSite
Source: Yara match File source: 1.0.pages.csv, type: HTML
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.18:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.18:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.18:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.18:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.18:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.18:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.18:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.18:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.18:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.18:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.44.239.154:443 -> 192.168.2.18:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.18:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.93.21.160:443 -> 192.168.2.18:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.182.143.211:443 -> 192.168.2.18:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.167.249.196:443 -> 192.168.2.18:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.167.249.196:443 -> 192.168.2.18:49763 version: TLS 1.2
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ab?clientId=4186BE91-E256-4574-B32D-E3E73E51588C HTTP/1.1X-OfficeApp-BuildVersion: 16.0.11629.20316Accept-Encoding: gzip, deflateX-OfficeApp-Platform: universalX-OfficeApp-Language: en-CHX-OutlookMobile-Architecture: x64X-OutlookMobile-BuildFlavor: shipX-OutlookMobile-Environment: ProductionX-OfficeApp-MsoVersion: 10.0.19045X-OutlookMobile-HxServiceAccounts: NoneContent-Length: 0Content-Encoding: gzipHost: outlookmobile-office365-tas.msedge.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: */*APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEGllNoC2NeE8qC1/jr3wZi/gAHAzsYDhekwwsGpV7PCGDhup0wOu0I1TfRVFkO5AdsbsvH1ug2mvU231IEVXqN0EeuARU0rO7fu5iu60t5OOaUsnGZ0PFa56TKf7gl2Zf5cJMUOJPhngPF7IOg4yMu+b8izH2E0amOSu9MQnPw+tiajsVEppele/0QUhUI8pLRAtoCaxdKPbzcXE5ucOGhvggfmhMP/ze0yOjvMp4qHGsS6aJwlosGbUI4TZj/d5aQDEB5ExzSwm43/g14m7XpVmNH8Z1HNDgvS9J4UnXjFIEMnxKfXd8RgPr8YUaniPWM8SHQE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1724782736695Host: self.events.data.microsoft.comContent-Length: 8080Connection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 104.47.64.28 104.47.64.28
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.159.71
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rCdCH473Gw42DEk&MD=dhXPOHoK HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /?url=https%3A%2F%2Femp.eduyield.com%2Fel%3Faid%3D2wu0dda0e6c-1865-11ef-80aa-0217a07992df%26rid%3D33766156%26pid%3D771868%26cid%3D497%26dest%3Dgoogle.com.%2F%2F%2F%2Famp%2Fs%2Fbioesolutions.com%2Fdayo2%2Fuinkt%2FY21vbGluYUBzYW50YWNsYXJhY2EuZ292%24%25C3%25A3%25E2%2582%25AC%25E2%2580%259A&data=05%7C02%7Ccmolina%40santaclaraca.gov%7Cc439d18c221146681bbb08dcc3aa8fd7%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638600385360362045%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=5B3d9674B%2BWxyo45cg9topT2ESfmQUifAcHQ8hIzpHw%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /Content/Scripts/safelinksv2.css HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femp.eduyield.com%2Fel%3Faid%3D2wu0dda0e6c-1865-11ef-80aa-0217a07992df%26rid%3D33766156%26pid%3D771868%26cid%3D497%26dest%3Dgoogle.com.%2F%2F%2F%2Famp%2Fs%2Fbioesolutions.com%2Fdayo2%2Fuinkt%2FY21vbGluYUBzYW50YWNsYXJhY2EuZ292%24%25C3%25A3%25E2%2582%25AC%25E2%2580%259A&data=05%7C02%7Ccmolina%40santaclaraca.gov%7Cc439d18c221146681bbb08dcc3aa8fd7%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638600385360362045%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=5B3d9674B%2BWxyo45cg9topT2ESfmQUifAcHQ8hIzpHw%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /Content/Scripts/site.js HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femp.eduyield.com%2Fel%3Faid%3D2wu0dda0e6c-1865-11ef-80aa-0217a07992df%26rid%3D33766156%26pid%3D771868%26cid%3D497%26dest%3Dgoogle.com.%2F%2F%2F%2Famp%2Fs%2Fbioesolutions.com%2Fdayo2%2Fuinkt%2FY21vbGluYUBzYW50YWNsYXJhY2EuZ292%24%25C3%25A3%25E2%2582%25AC%25E2%2580%259A&data=05%7C02%7Ccmolina%40santaclaraca.gov%7Cc439d18c221146681bbb08dcc3aa8fd7%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638600385360362045%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=5B3d9674B%2BWxyo45cg9topT2ESfmQUifAcHQ8hIzpHw%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /Content/images/cross.png HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femp.eduyield.com%2Fel%3Faid%3D2wu0dda0e6c-1865-11ef-80aa-0217a07992df%26rid%3D33766156%26pid%3D771868%26cid%3D497%26dest%3Dgoogle.com.%2F%2F%2F%2Famp%2Fs%2Fbioesolutions.com%2Fdayo2%2Fuinkt%2FY21vbGluYUBzYW50YWNsYXJhY2EuZ292%24%25C3%25A3%25E2%2582%25AC%25E2%2580%259A&data=05%7C02%7Ccmolina%40santaclaraca.gov%7Cc439d18c221146681bbb08dcc3aa8fd7%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638600385360362045%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=5B3d9674B%2BWxyo45cg9topT2ESfmQUifAcHQ8hIzpHw%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /Content/Scripts/site.js HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /Content/images/cross.png HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ab?clientId=4186BE91-E256-4574-B32D-E3E73E51588C HTTP/1.1X-OfficeApp-BuildVersion: 16.0.11629.20316Accept-Encoding: gzip, deflateX-OfficeApp-Platform: universalX-OfficeApp-Language: en-CHX-OutlookMobile-Architecture: x64X-OutlookMobile-BuildFlavor: shipX-OutlookMobile-Environment: ProductionX-OfficeApp-MsoVersion: 10.0.19045X-OutlookMobile-HxServiceAccounts: NoneContent-Length: 0Content-Encoding: gzipHost: outlookmobile-office365-tas.msedge.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /settings/v2.0/office/olx?app=microsoft.windowscommunicationsapps&appVer=16.0.11629.20316&locale=en-CH&os=WINDOWS&osVer=10.0.19045&deviceClass=Windows.Desktop&deviceId=4186BE91-E256-4574-B32D-E3E73E51588C&ring=7 HTTP/1.1Accept: */*User-Agent: microsoft.windowscommunicationsappsAccept-Language: en-CHAccept-Encoding: gzip, deflate, brHost: settings.data.microsoft.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=rCdCH473Gw42DEk&MD=dhXPOHoK HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A410900B03DX-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAZLvXvXHRTyXvrHjUnJH5Qrh4oXIJGuZYQuuswi3QT5ZTKAfmFht5LCQAFaQJ88Lq9XSYA8sI2CA7klIYMOi1IfFYalXrDvqns688IjaoTSj6/8P4ljHYlU%2BDHztF1g2P8UjYzu0c7KbDhK5v1KiRL29/Xu4tU6diIgMRD%2BQlDI7873luzxaKMVx1lwCeF16IZ9M2woOTKsqMbZkpxvblpHZTBcYdU7iqiVlktSsosrWAovIn9G81aZ%2Baa6ujS8r9LDAPAhRXPpzXw%2BeLEwnnpZf7mjZcFfwiBIsMkB5OcgA8FZESF97w9qU19qOv8WafkkCjVz0GQJNKvsp021IbroQZgAAEPVbzBeUov08oognOxMStSOwAVb7vC7PJUF%2Bhyz5AN8TEmojrzG/ISHxawiXlAPRGIengjobekwG2Uk1FyMRSWjsaDonVpmcTJTqifZ%2BNeTGxcodck93%2BnLCeNBamZScnXtH6vGRLqJW%2BgCdIzY2c6qel5FNqXnSNsHagioNfAGiNondmb/2YnDSRTX7bsqERGq69jN0wZtPq3faefejUmP2kl%2BCki%2Bblw5ufG/R1jmR/%2B9Nl8RAdooBjjuTN%2Bm7u1QFIRZPARXNm8O5iRJVyC1blPCkg4gc0vB6Wwdh8C5l8%2BBc/0E%2BqrkvHLSz9YKuWMvNq8FJj4Cm4T66nPIBpTMVHbk0npiKA3sWu9sKwJ5QEPxJwbdkCaKFqLkXtMBM9UgAl7IX2rM6/DB/UOJwOg0YMRxElIAJvk0jtnEFkSQDdv13tz84F7AIeFR3AvUXCCb9FSZEREwzlO3cq7/qxYtvm6lXeLsO%2BkvXQ1XlpOVsw/tujCH676/Q3FJPDqQFRYdxt%2BRMD5YJnYE%2Bd7Lgfag691gUDFZDUK1gGm2h85fIS2pglNNsMg107F9AIv763O8%2By5Lp170LbJon635vuUaCodcB%26p%3DX-Agent-DeviceId: 01000A410900B03DX-BM-CBT: 1724782551User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 4C3818340B074C0783E5863BB529B949X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C
Source: (No subject) (61).eml String found in binary or memory: 2.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.linkedin.com%2F= equals www.linkedin.com (Linkedin)
Source: (No subject) (61).eml String found in binary or memory: 2.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.youtube.com%2F%= equals www.youtube.com (Youtube)
Source: (No subject) (61).eml String found in binary or memory: =3D"https://www.linkedin.com/company/lucent-innovation/" shash=3D"NjG0K/dfe= equals www.linkedin.com (Linkedin)
Source: (No subject) (61).eml String found in binary or memory: ttps://www.youtube.com/@lucentinnovation" shash=3D"Ga4EoraAyGbSAR444dRqH4xo= equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: gcc02.safelinks.protection.outlook.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.25.dr String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 77EC63BDA74BD0D0E0426DC8F80085060.25.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: (No subject) (61).eml String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.aadrm.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.aadrm.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.cortana.ai
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.diagnostics.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.microsoftstream.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.office.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.onedrive.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://api.scheduler.
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://app.powerbi.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://augloop.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://augloop.office.com/v2
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://canary.designerapp.
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.entity.
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: (No subject) (61).eml String found in binary or memory: https://cdn.s=
Source: (No subject) (61).eml String found in binary or memory: https://cdn.sho=
Source: (No subject) (61).eml String found in binary or memory: https://cdn.shopify.com/s/files/1/1905/9639/f=
Source: (No subject) (61).eml String found in binary or memory: https://cdn.shopify.com/s/files/1/1905/9639/files/linkedin_38485de5-6c0=
Source: (No subject) (61).eml String found in binary or memory: https://cdn.shopify.com/s/files/1/1905/9639/files/logo-luce=
Source: (No subject) (61).eml String found in binary or memory: https://cdn.shopify.com/s/files/1/1905/9639/files=
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://clients.config.office.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://clients.config.office.net/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://config.edge.skype.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cortana.ai
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cortana.ai/api
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://cr.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://d.docs.live.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://designerapp.azurewebsites.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://dev.cortana.ai
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://devnull.onenote.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://directory.services.
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ecs.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://edge.skype.com/registrar/prod
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://edge.skype.com/rps
Source: (No subject) (61).eml String found in binary or memory: https://emp.eduyield.com/el?aid=3D2wu0dda0e6c-1865-11e=
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: (No subject) (61).eml String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2=
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://graph.ppe.windows.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://graph.windows.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://graph.windows.net/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ic3.teams.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://invites.office.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://lifecycle.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://login.microsoftonline.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://login.microsoftonline.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://login.microsoftonline.com/organizations
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://login.windows.local
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://make.powerautomate.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://management.azure.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://management.azure.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messaging.action.office.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messaging.engagement.office.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messaging.lifecycle.office.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://messaging.office.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ncus.contentsync.
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://officeapps.live.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://officepyservice.office.net/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://onedrive.live.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://otelrules.azureedge.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://otelrules.svc.static.microsoft
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://outlook.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://outlook.office.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://outlook.office365.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://outlook.office365.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://outlook.office365.com/connectors
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://powerlift.acompli.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://pushchannel.1drv.ms
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://res.cdn.office.net
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://service.powerapps.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://settings.outlook.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://staging.cortana.ai
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://substrate.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://tasks.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://templatesmetadata.office.net/
Source: (No subject) (61).eml String found in binary or memory: https://twitter.com/l=
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://webshell.suite.office.com
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://wus2.contentsync.
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: hbgnj.pdf.0.dr, hbgnj (002).pdf.0.dr, olk2C5.tmp.0.dr String found in binary or memory: https://www.dynaforms.com
Source: (No subject) (61).eml String found in binary or memory: https://www.linkedin.com/company/lucent-innovation/
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: A74F9330-EF48-47B4-9B70-118016E011F4.15.dr String found in binary or memory: https://www.yammer.com
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.18:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.18:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.18:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.18:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.18:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.18:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.18:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.18:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.18:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.18:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.44.239.154:443 -> 192.168.2.18:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.18:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.93.21.160:443 -> 192.168.2.18:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.182.143.211:443 -> 192.168.2.18:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.167.249.196:443 -> 192.168.2.18:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.167.249.196:443 -> 192.168.2.18:49763 version: TLS 1.2
Source: classification engine Classification label: mal48.phis.winEML@41/52@6/6
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240827T1414170852-6912.etl Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\(No subject) (61).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "415CD50A-3286-4708-9E21-1ACF4964AB02" "ED24CD48-F495-4908-A499-5C520B0A7F1B" "6912" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femp.eduyield.com%2Fel%3Faid%3D2wu0dda0e6c-1865-11ef-80aa-0217a07992df%26rid%3D33766156%26pid%3D771868%26cid%3D497%26dest%3Dgoogle.com.%2F%2F%2F%2Famp%2Fs%2Fbioesolutions.com%2Fdayo2%2Fuinkt%2FY21vbGluYUBzYW50YWNsYXJhY2EuZ292%24%25C3%25A3%25E2%2582%25AC%25E2%2580%259A&data=05%7C02%7Ccmolina%40santaclaraca.gov%7Cc439d18c221146681bbb08dcc3aa8fd7%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638600385360362045%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=5B3d9674B%2BWxyo45cg9topT2ESfmQUifAcHQ8hIzpHw%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1972,i,3396503775361026336,9902616994921859969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe" -ServerName:microsoft.windowslive.mail.AppXfbjsbkxvprcgqg6q4c9jfr0pn3kv9x5s.mca
Source: unknown Process created: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe" -ServerName:microsoft.windowslive.manageaccounts.AppXdbf3yp5apt3t7q877db3gnz5zqpf71zj.mca
Source: unknown Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" /b /id 2972_1168870213 /if pdfshell_prev00247cc8-fc9c-469d-a24b-5c21c15243a2 /CR
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\FPE3LZSO\hbgnj.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2352 --field-trial-handle=1556,i,13234393440631177627,15431578782892992612,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "415CD50A-3286-4708-9E21-1ACF4964AB02" "ED24CD48-F495-4908-A499-5C520B0A7F1B" "6912" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femp.eduyield.com%2Fel%3Faid%3D2wu0dda0e6c-1865-11ef-80aa-0217a07992df%26rid%3D33766156%26pid%3D771868%26cid%3D497%26dest%3Dgoogle.com.%2F%2F%2F%2Famp%2Fs%2Fbioesolutions.com%2Fdayo2%2Fuinkt%2FY21vbGluYUBzYW50YWNsYXJhY2EuZ292%24%25C3%25A3%25E2%2582%25AC%25E2%2580%259A&data=05%7C02%7Ccmolina%40santaclaraca.gov%7Cc439d18c221146681bbb08dcc3aa8fd7%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638600385360362045%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=5B3d9674B%2BWxyo45cg9topT2ESfmQUifAcHQ8hIzpHw%3D&reserved=0 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\FPE3LZSO\hbgnj.pdf" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1972,i,3396503775361026336,9902616994921859969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2352 --field-trial-handle=1556,i,13234393440631177627,15431578782892992612,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: c2r64.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: microsoft.applications.telemetry.windows.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msoimm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mso40uiimm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mso30imm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mso20imm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: office.ui.xaml.core.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: office.ui.xaml.word.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vccorlib140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vcruntime140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msvcp140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vccorlib140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msvcp140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vcruntime140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vccorlib140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vcruntime140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msvcp140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vcruntime140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msvcp140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vcruntime140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msvcp140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vcruntime140_1_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vcruntime140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msvcp140_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: vcruntime140_1_app.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mso98imm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mso98imm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mso50imm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: hxoutlook.model.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.storage.applicationdata.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: hxcomm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.applicationmodel.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.globalization.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: bcp47mrm.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.staterepositorycore.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.networking.connectivity.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.networking.hostname.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.energy.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: rometadata.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.system.diagnostics.telemetry.platformtelemetryclient.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: hxoutlook.view.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: office.ui.xaml.hxshared.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: hxoutlook.viewmodel.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: clipc.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: hxoutlook.resources.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.ui.xaml.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.ui.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: inputhost.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mrmcorer.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.staterepositoryclient.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.shell.servicehostbuilder.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: uiamanager.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.ui.core.textinput.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.ui.immersive.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: profext.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: office.ui.xaml.hx.mail.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: threadpoolwinrt.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.graphics.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: twinapi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: office.ui.xaml.hxcalendar.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.system.remotedesktop.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.ui.xaml.controls.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.system.profile.systemid.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: directmanipulation.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.system.profile.retailinfo.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: winrttracing.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: photometadatahandler.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: ploptin.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: webservices.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: userdataaccountapis.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: userdataplatformhelperutil.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: windows.accountscontrol.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: accountsrt.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Section loaded: aphostclient.dll Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: apphelp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: hxoutlook.model.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: microsoft.applications.telemetry.windows.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: mso20imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: mso30imm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: vccorlib140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: vcruntime140_1_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: vcruntime140_1_app.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.ui.xaml.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: coremessaging.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: bcp47langs.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: iertutil.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: dcomp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: twinapi.appcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: wintypes.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.staterepositorycore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.ui.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windowmanagementapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: textinputframework.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: inputhost.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: propsys.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: ntmarta.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: uxtheme.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: urlmon.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: srvcli.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: netutils.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: dxgi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: office.ui.xaml.hxaccounts.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: d3d11.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.storage.applicationdata.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: d3d10warp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: dxcore.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: d2d1.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: hxcomm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: cryptsp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: dwrite.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.applicationmodel.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: textshaping.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.globalization.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: bcp47mrm.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: profapi.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.networking.connectivity.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.networking.hostname.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.energy.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: rmclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.storage.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: wldp.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: rometadata.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.system.diagnostics.telemetry.platformtelemetryclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: mrmcorer.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.staterepositoryclient.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: execmodelproxy.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: uiamanager.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.ui.core.textinput.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.ui.immersive.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: dataexchange.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: cryptbase.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.accountscontrol.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: xmllite.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.security.authentication.web.core.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: vaultcli.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.ui.xaml.controls.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: directmanipulation.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: userenv.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: profext.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: winrttracing.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: hxoutlook.resources.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: msftedit.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: globinputhost.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windowscodecs.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: windows.graphics.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: wuceffects.dll
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Section loaded: threadpoolwinrt.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32 Jump to behavior
Source: Google Drive.lnk.13.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.13.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.13.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.13.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.13.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.13.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Window found: window name: SysTabControl32 Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe File opened: C:\Windows\SYSTEM32\msftedit.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Window detected: Number of UI elements: 16
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File Volume queried: C:\Windows\SysWOW64 FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information queried: ProcessInformation Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsym.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1500051 Sample: (No subject) (61).eml Startdate: 27/08/2024 Architecture: WINDOWS Score: 48 42 Yara detected BlockedWebSite 2->42 8 OUTLOOK.EXE 514 153 2->8         started        10 HxOutlook.exe 62 18 2->10         started        12 HxAccounts.exe 2->12         started        14 Acrobat.exe 2->14         started        process3 process4 16 chrome.exe 9 8->16         started        19 Acrobat.exe 8->19         started        21 ai.exe 8->21         started        dnsIp5 30 192.168.2.16 unknown unknown 16->30 32 192.168.2.18, 137, 138, 443 unknown unknown 16->32 34 2 other IPs or domains 16->34 23 chrome.exe 16->23         started        26 AcroCEF.exe 19->26         started        process6 dnsIp7 36 gcc02.safelinks.eop-tm2.outlook.com 104.47.64.28, 443, 49720, 49721 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->36 38 www.google.com 142.250.185.132, 443, 49728, 49744 GOOGLEUS United States 23->38 40 gcc02.safelinks.protection.outlook.com 23->40 28 AcroCEF.exe 26->28         started        process8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.185.132
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
104.47.64.28
 gcc02.safelinks.eop-tm2.outlook.com United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Private

IP
192.168.2.16
192.168.2.18
192.168.2.4

Contacted Domains

Name IP Active
gcc02.safelinks.eop-tm2.outlook.com 104.47.64.28 true
www.google.com 142.250.185.132 true
gcc02.safelinks.protection.outlook.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femp.eduyield.com%2Fel%3Faid%3D2wu0dda0e6c-1865-11ef-80aa-0217a07992df%26rid%3D33766156%26pid%3D771868%26cid%3D497%26dest%3Dgoogle.com.%2F%2F%2F%2Famp%2Fs%2Fbioesolutions.com%2Fdayo2%2Fuinkt%2FY21vbGluYUBzYW50YWNsYXJhY2EuZ292%24%25C3%25A3%25E2%2582%25AC%25E2%2580%259A&data=05%7C02%7Ccmolina%40santaclaraca.gov%7Cc439d18c221146681bbb08dcc3aa8fd7%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638600385360362045%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C40000%7C%7C%7C&sdata=5B3d9674B%2BWxyo45cg9topT2ESfmQUifAcHQ8hIzpHw%3D&reserved=0 false
    		unknown
    https://gcc02.safelinks.protection.outlook.com/Content/Scripts/safelinksv2.css false
    • Avira URL Cloud: safe
    		 unknown
    https://gcc02.safelinks.protection.outlook.com/Content/Scripts/site.js false
    • Avira URL Cloud: safe
    		 unknown