Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
nested-Read%3A MS Power Apps.eml

Overview

General Information

Sample name:nested-Read%3A MS Power Apps.eml
Analysis ID:1523497
MD5:6dd4b72f258cc1e735c24681fb93cbf9
SHA1:5ce5b3225a61cfd6977a38b1009ab95d58e71f25
SHA256:9d3e8180a8486495927b83aa8c871629bfbf53437dc12632fefe41a8a79ac8c4
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

  • System is w10x64
  • OUTLOOK.EXE (PID: 6464 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\nested-Read%3A MS Power Apps.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 5404 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "DED99D21-B1E4-4A3A-A135-E0A27BC4274C" "B173A742-9496-4ACA-BB56-88F27147C14E" "6464" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6464, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.aadrm.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.aadrm.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.cortana.ai
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.diagnostics.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.microsoftstream.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.office.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.onedrive.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://api.scheduler.
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://apis.live.net/v5.0/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://app.powerbi.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://augloop.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://augloop.office.com/v2
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://canary.designerapp.
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.entity.
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://clients.config.office.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://clients.config.office.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cortana.ai
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cortana.ai/api
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://cr.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://d.docs.live.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://dataservice.o365filtering.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://designerapp.azurewebsites.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://dev.cortana.ai
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://devnull.onenote.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://directory.services.
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ecs.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://edge.skype.com/rps
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://graph.ppe.windows.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://graph.ppe.windows.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://graph.windows.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://graph.windows.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ic3.teams.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://invites.office.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://lifecycle.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://login.microsoftonline.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://login.microsoftonline.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://login.microsoftonline.com/organizations
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://login.windows.local
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://make.powerautomate.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://management.azure.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://management.azure.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messaging.action.office.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messaging.engagement.office.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://messaging.office.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://mss.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ncus.contentsync.
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ncus.pagecontentsync.
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://officeapps.live.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://officepyservice.office.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://onedrive.live.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://onedrive.live.com/embed?
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://otelrules.azureedge.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://outlook.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://outlook.office.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://outlook.office365.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://outlook.office365.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://outlook.office365.com/connectors
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://pages.store.office.com/review/query
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://powerlift.acompli.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://pushchannel.1drv.ms
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://res.cdn.office.net
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://service.powerapps.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://settings.outlook.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://shell.suite.office.com:1443
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://staging.cortana.ai
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://store.office.de/addinstemplate
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://substrate.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://tasks.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://templatesmetadata.office.net/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://webshell.suite.office.com
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://wus2.contentsync.
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://wus2.pagecontentsync.
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://www.odwebp.svc.ms
Source: B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean1.winEML@3/11@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T1127010048-6464.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\nested-Read%3A MS Power Apps.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "DED99D21-B1E4-4A3A-A135-E0A27BC4274C" "B173A742-9496-4ACA-BB56-88F27147C14E" "6464" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "DED99D21-B1E4-4A3A-A135-E0A27BC4274C" "B173A742-9496-4ACA-BB56-88F27147C14E" "6464" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1523497 Sample: nested-Read%3A MS Power Apps.eml Startdate: 01/10/2024 Architecture: WINDOWS Score: 1 5 OUTLOOK.EXE 52 105 2->5         started        process3 7 ai.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://api.diagnosticssdf.office.com0%URL Reputationsafe
https://login.microsoftonline.com/0%URL Reputationsafe
https://shell.suite.office.com:14430%URL Reputationsafe
https://designerapp.azurewebsites.net0%URL Reputationsafe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize0%URL Reputationsafe
https://autodiscover-s.outlook.com/0%URL Reputationsafe
https://useraudit.o365auditrealtimeingestion.manage.office.com0%URL Reputationsafe
https://outlook.office365.com/connectors0%URL Reputationsafe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://api.addins.omex.office.net/appinfo/query0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/tenantassociationkey0%URL Reputationsafe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://lookup.onenote.com/lookup/geolocation/v10%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/imports0%URL Reputationsafe
https://cloudfiles.onenote.com/upload.aspx0%URL Reputationsafe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://entitlement.diagnosticssdf.office.com0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://canary.designerapp.0%URL Reputationsafe
https://ic3.teams.office.com0%URL Reputationsafe
https://www.yammer.com0%URL Reputationsafe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies0%URL Reputationsafe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive0%URL Reputationsafe
https://cr.office.com0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://portal.office.com/account/?ref=ClientMeControl0%URL Reputationsafe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory0%URL Reputationsafe
https://edge.skype.com/registrar/prod0%URL Reputationsafe
https://graph.ppe.windows.net0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://tasks.office.com0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://edge.skype.com/rps0%URL Reputationsafe
https://globaldisco.crm.dynamics.com0%URL Reputationsafe
https://messaging.engagement.office.com/0%URL Reputationsafe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.diagnosticssdf.office.com/v2/feedback0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/groups0%URL Reputationsafe
https://web.microsoftstream.com/video/0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://graph.windows.net0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://analysis.windows.net/powerbi/api0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://substrate.office.com0%URL Reputationsafe
https://outlook.office365.com/autodiscover/autodiscover.json0%URL Reputationsafe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios0%URL Reputationsafe
https://consent.config.office.com/consentcheckin/v1.0/consents0%URL Reputationsafe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json0%URL Reputationsafe
https://safelinks.protection.outlook.com/api/GetPolicy0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/0%URL Reputationsafe
http://weather.service.msn.com/data.aspx0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://officepyservice.office.net/service.functionality0%URL Reputationsafe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks0%URL Reputationsafe
https://templatesmetadata.office.net/0%URL Reputationsafe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios0%URL Reputationsafe
https://messaging.lifecycle.office.com/0%URL Reputationsafe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml0%URL Reputationsafe
https://mss.office.com0%URL Reputationsafe
https://pushchannel.1drv.ms0%URL Reputationsafe
https://management.azure.com0%URL Reputationsafe
https://outlook.office365.com0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://incidents.diagnostics.office.com0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/ios0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://api.addins.omex.office.net/api/addins/search0%URL Reputationsafe
https://insertmedia.bing.office.net/odc/insertmedia0%URL Reputationsafe
https://outlook.office365.com/api/v1.0/me/Activities0%URL Reputationsafe
https://api.office.net0%URL Reputationsafe
https://incidents.diagnosticssdf.office.com0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/android/policies0%URL Reputationsafe
https://entitlement.diagnostics.office.com0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://login.microsoftonline.com/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://shell.suite.office.com:1443B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://designerapp.azurewebsites.netB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://autodiscover-s.outlook.com/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://useraudit.o365auditrealtimeingestion.manage.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://outlook.office365.com/connectorsB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://cdn.entity.B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://api.addins.omex.office.net/appinfo/queryB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://clients.config.office.net/user/v1.0/tenantassociationkeyB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://powerlift.acompli.netB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://rpsticket.partnerservices.getmicrosoftkey.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://lookup.onenote.com/lookup/geolocation/v1B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://cortana.aiB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://api.powerbi.com/v1.0/myorg/importsB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://cloudfiles.onenote.com/upload.aspxB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://entitlement.diagnosticssdf.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://api.aadrm.com/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://ofcrecsvcapi-int.azurewebsites.net/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://canary.designerapp.B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://ic3.teams.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://www.yammer.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
  • URL Reputation: safe
unknown
https://api.microsoftstream.com/api/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
    		unknown
    https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
    • URL Reputation: safe
    		unknown
    https://cr.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
    • URL Reputation: safe
    		unknown
    https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;hB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
      		unknown
      https://messagebroker.mobile.m365.svc.cloud.microsoftB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
      • URL Reputation: safe
      		unknown
      https://otelrules.svc.static.microsoftB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        		unknown
        https://portal.office.com/account/?ref=ClientMeControlB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://clients.config.office.net/c2r/v1.0/DeltaAdvisoryB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://edge.skype.com/registrar/prodB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://graph.ppe.windows.netB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://res.getmicrosoftkey.com/api/redemptioneventsB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://powerlift-frontdesk.acompli.netB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://tasks.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://officeci.azurewebsites.net/api/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://sr.outlook.office.net/ws/speech/recognize/assistant/workB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://api.scheduler.B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
        • URL Reputation: safe
        		unknown
        https://my.microsoftpersonalcontent.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
          		unknown
          https://store.office.cn/addinstemplateB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
          • URL Reputation: safe
          		unknown
          https://api.aadrm.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
          • URL Reputation: safe
          		unknown
          https://edge.skype.com/rpsB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
          • URL Reputation: safe
          		unknown
          https://outlook.office.com/autosuggest/api/v1/init?cvid=B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            		unknown
            https://globaldisco.crm.dynamics.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://messaging.engagement.office.com/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://dev0-api.acompli.net/autodetectB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://www.odwebp.svc.msB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://api.diagnosticssdf.office.com/v2/feedbackB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://api.powerbi.com/v1.0/myorg/groupsB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://web.microsoftstream.com/video/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://api.addins.store.officeppe.com/addinstemplateB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://graph.windows.netB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://dataservice.o365filtering.com/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://officesetup.getmicrosoftkey.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://analysis.windows.net/powerbi/apiB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://prod-global-autodetect.acompli.net/autodetectB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://substrate.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://outlook.office365.com/autodiscover/autodiscover.jsonB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://consent.config.office.com/consentcheckin/v1.0/consentsB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://learningtools.onenote.com/learningtoolsapi/v2.0/GetvoicesB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
            • URL Reputation: safe
            		unknown
            https://d.docs.live.netB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
              		unknown
              https://safelinks.protection.outlook.com/api/GetPolicyB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
              • URL Reputation: safe
              		unknown
              https://ncus.contentsync.B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
              • URL Reputation: safe
              		unknown
              https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                		unknown
                https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                http://weather.service.msn.com/data.aspxB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://apis.live.net/v5.0/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://officepyservice.office.net/service.functionalityB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://templatesmetadata.office.net/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://messaging.lifecycle.office.com/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://mss.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://pushchannel.1drv.msB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://management.azure.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://outlook.office365.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://wus2.contentsync.B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://incidents.diagnostics.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://clients.config.office.net/user/v1.0/iosB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://make.powerautomate.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://api.addins.omex.office.net/api/addins/searchB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://insertmedia.bing.office.net/odc/insertmediaB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://outlook.office365.com/api/v1.0/me/ActivitiesB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://api.office.netB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://incidents.diagnosticssdf.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://asgsmsproxyapi.azurewebsites.net/B888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://clients.config.office.net/user/v1.0/android/policiesB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://entitlement.diagnostics.office.comB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown
                https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonB888D7D3-2DEB-43DE-A6EB-85F20D22833F.1.drfalse
                • URL Reputation: safe
                		unknown

                World Map of Contacted IPs

                ⊘No contacted IP infos

                General Information

                Joe Sandbox version:41.0.0 Charoite
                Analysis ID:1523497
                Start date and time:2024-10-01 17:25:52 +02:00
                Joe Sandbox product:CloudBasic
                Overall analysis duration:0h 4m 39s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                Number of analysed new started processes analysed:5
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample name:nested-Read%3A MS Power Apps.eml
                Detection:CLEAN
                Classification:clean1.winEML@3/11@0/0
                EGA Information:Failed
                HCA Information:
                • Successful, ratio: 100%
                • Number of executed functions: 0
                • Number of non-executed functions: 0
                Cookbook Comments:
                • Found application associated with file extension: .eml

                Warnings

                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                • Excluded IPs from analysis (whitelisted): 20.190.160.22, 40.126.32.72, 40.126.32.133, 40.126.32.68, 40.126.32.134, 40.126.32.74, 40.126.32.140, 20.190.160.14, 52.109.32.97, 52.113.194.132, 51.105.71.136
                • Excluded domains from analysis (whitelisted): ecs.office.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, prod.configsvc1.live.com.akadns.net, onedscolprduks00.uksouth.cloudapp.azure.com, s-0005-office.config.skype.com, login.msa.msidentity.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, login.live.com, s-0005.s-msedge.net, config.officeapps.live.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, ukw-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
                • Report size getting too big, too many NtQueryAttributesFile calls found.
                • Report size getting too big, too many NtQueryValueKey calls found.
                • VT rate limit hit for: nested-Read%3A MS Power Apps.eml

                Simulations

                Behavior and APIs

                ⊘No simulations

                LLM Input / Output

                InputOutput
                URL: Email Model: jbxai
                {
"brand":[],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:data
                Category:dropped
                Size (bytes):231348
                Entropy (8bit):4.381831576694851
                Encrypted:false
                SSDEEP:1536:aeYLv4gswoU7RattT4gs4WNcAz79ysQqt2MJmzqoQDJrcm0FvFyPy41OoDbaVbGR:+Qglg0g4miGu2PqoQFrt0FvhLmkTuEt8
                MD5:A986563A05572863237307DEC7214B5A
                SHA1:229BD22C2EFBAE6E8F2291AF4A0FE3D1945DADEF
                SHA-256:B31B46BCD879A5F20C6B30A06707A47E3CDE20B86110434CA2F44F3C5CD3608F
                SHA-512:BE81BB2C221F86CE9AC6D9A37E9126A663C94DE8BC9E82E6995BD4F8F8761CC744E0EAB472F7EE2155D4915811C4F9728889B2B8ABCA8DB37A6E0EC8452355BB
                Malicious:false
                Reputation:low
                Preview:TH02...... ..(.P........SM01X...,......P............IPM.Activity...........h...............h............H..h.........8{...h.........`E.H..h\alf ...AppD...h8.=.0...@......h$.....K........h........_`.j...hh...@...I..v...h....H...8..j...0....T...............d.........2h...............k,.d..........!h.............. h..xj....X.....#h....8.........$h.`E.....8....."h@.......p.....'h..y...........1h$...<.........0h....4.....j../h....h......jH..h..K.p........-h .............+h........................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\B888D7D3-2DEB-43DE-A6EB-85F20D22833F

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):177088
                Entropy (8bit):5.286737768169504
                Encrypted:false
                SSDEEP:1536:mi2XfRAqcbH41gwEwLe7HW8bM/o/NM5cAZl1p5ihs7EXXCEAD2OdaLI:zCe7HW8bM/o/9XPkiI
                MD5:160855B804861722D7BCA3E2CD5A4EBD
                SHA1:BFB68CA0E1BD9C0EFC259C6D0BB24060284D7353
                SHA-256:DB389AF694366C95DB7680BB910B6F5C5359E2873C6B93D247DA1E61C2E4C83A
                SHA-512:C08D594EAC9E94FC1481863EDC351E2274B375BA411DC993655F002C0634AAA0A7D248D6F54F41E611E0F4589FCAE9E27DB8B4EE31901CA9BA58BC2DBEA7ABB3
                Malicious:false
                Reputation:low
                Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-01T15:27:04">.. Build: 16.0.18112.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:data
                Category:dropped
                Size (bytes):32768
                Entropy (8bit):0.0441108360786895
                Encrypted:false
                SSDEEP:3:GtlxtjlTUSWvHuIM3lxtjlTUSWvHuIp/1R9//8l1lvlll1lllwlvlllglbelDblx:Gtvk9X01PH4l942wU
                MD5:A11A2D81B576B5CCCE2EE5E4DCBB4201
                SHA1:AF2031D107BF1508D61E12BA2A84E6E001A1C9DA
                SHA-256:386AF2582593F1DD801CFE411683883566729D4787090EFD033C7D8110EF8068
                SHA-512:96F32BB6422F3A2B7731193753ED2C3C39F0BE14B47B45C8F672C477EBC7D7C22C1AE0D11D11ABB07AD4E367A0E9466A9B0D1E92F2FE1C45A04DAF53E48792A4
                Malicious:false
                Reputation:low
                Preview:..-.....................aw.L..J.!8..6/..."..tHR...-.....................aw.L..J.!8..6/..."..tHR.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:SQLite Write-Ahead Log, version 3007000
                Category:modified
                Size (bytes):49472
                Entropy (8bit):0.4773813681552012
                Encrypted:false
                SSDEEP:48:5EHQ1VAXUll7DYM2FzO8VFDYM+BO8VFDYML:5j/pll4XxjVGzjVGC
                MD5:0EE82901FE4A96A76A9F5A0DB14087F8
                SHA1:A7935811B94F42BE62121FCFEEB5931713724AB6
                SHA-256:17A4ACADF42267241100CB2BB7FC3ACF4D25DE704AA4FE6033F6FBCCC4570FFC
                SHA-512:960F749DFAF434DF7122DCD156F87E4B033859E217AAAF908C302F854CE2A9FE4EE77956562C1C22EBCF16E53504A2EEAAB45F55C006C1B168F9C8DAF369EBD2
                Malicious:false
                Reputation:low
                Preview:7....-..........!8..6/...;4..B.........!8..6/...~yrV..)SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727796422487648100_CD2CE64C-052D-4DAB-AE0F-FDEE64B7F8F5.log

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:ASCII text, with very long lines (28774), with CRLF line terminators
                Category:dropped
                Size (bytes):20971520
                Entropy (8bit):0.1455427850295506
                Encrypted:false
                SSDEEP:1536:CxXO9Fb6T4Xn8IZ2MRKBApGn/ij6ejmDV9hKLDH2mWBz:PFeen8xPvVU
                MD5:54B4063A8C777368D9BBA15CF622744C
                SHA1:4D010FBED5DBBA8A8C18C8DC0D8B1798A41F4163
                SHA-256:67848C2C492D77A5D924BEC4431E04289894567749C16F28293F1C17255FDCDD
                SHA-512:808B005CEBECA113F7FDCF2705441C56AD2A8D6913F746D64FD01531A024597BD4CDFC4EF9E9BD64C7EB3CDFF4D519CBA123531C8E2CED7BFC55ABDDA16DC4A5
                Malicious:false
                Reputation:low
                Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/01/2024 15:27:02.642.OUTLOOK (0x1940).0x1840.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-10-01T15:27:02.642Z","Contract":"Office.System.Activity","Activity.CV":"TOYszS0Fq02uD/3uZLf49Q.4.9","Activity.Duration":16,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/01/2024 15:27:02.673.OUTLOOK (0x1940).0x1840.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-10-01T15:27:02.673Z","Contract":"Office.System.Activity","Activity.CV":"TOYszS0Fq02uD/3uZLf49Q.4.10","Activity.Duration":16805,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

                C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727796422491024600_CD2CE64C-052D-4DAB-AE0F-FDEE64B7F8F5.log

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:data
                Category:dropped
                Size (bytes):20971520
                Entropy (8bit):0.0
                Encrypted:false
                SSDEEP:3::
                MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                Malicious:false
                Reputation:high, very likely benign file
                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T1127010048-6464.etl

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:data
                Category:dropped
                Size (bytes):90112
                Entropy (8bit):4.510491483814088
                Encrypted:false
                SSDEEP:768:64Hx5+l3L++4DX8l29pNvrbgT7XhOyWQWrWkWX7s2:24g89pNvraX3F
                MD5:948DA4B83AEF5BDAB95BA0D9433557AA
                SHA1:7AF3AA3F0E155C9320DF4D3D2C0A9AB8D7648AE9
                SHA-256:4E1A685D0BA5D3A4C140F9E2B1F0482CBDF8924DCCFC1A6E307D8738AD29E37A
                SHA-512:D04D3C466B489CFB39E6A8FCE5C733B53346EF4AF4A9F6D48439406D5BBAE1C52E92A7B6CAECC33DDFD778CE27378CC0EA06F55B0001A99AEE47114D7A6D8063
                Malicious:false
                Reputation:low
                Preview:............................................................................d...@...@...0.s\....................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................P...............0.s\............v.2._.O.U.T.L.O.O.K.:.1.9.4.0.:.9.f.d.3.3.9.6.f.0.6.c.b.4.8.0.3.9.a.d.b.5.c.f.0.d.0.3.4.f.6.c.a...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.0.1.T.1.1.2.7.0.1.0.0.4.8.-.6.4.6.4...e.t.l...........P.P.@...@....$v\....................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\olk691B.tmp

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):213
                Entropy (8bit):5.222833772279875
                Encrypted:false
                SSDEEP:6:+Q3adJ5AvRfe8q4RMAZgRsDjn/PA22MrBYoKHT8AHwr:V3Ce1DMAW2fPb1u3H4AE
                MD5:2A1CF5A83338CA1F5C3E5DDEE2F52D8C
                SHA1:05D5B522233B66D0BA98FCBE4E1590CDDF7C875B
                SHA-256:09BE39E4771CF2F6F2A0AE360CA0E66FC902BFCFF01EBB01CF599E76CE701B7C
                SHA-512:D50F61BE9169052C4DD28C7AD063C511F11101A04E4974021FA357F31EF53B89162D1FEAF5CB1C1A719BC5C0A030B002607824277ACEE237F5CA00DA4EE6A701
                Malicious:false
                Reputation:low
                Preview:Final-recipient: RFC822; dhruv.saksena@automationanywhere.com..Disposition: automatic-action/MDN-sent-automatically; displayed..X-MSExch-Correlation-Key: Y6L/Djt5pUWOewNmUQY4HA==..X-Display-Name: Dhruv Saksena....

                C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:data
                Category:dropped
                Size (bytes):30
                Entropy (8bit):1.2389205950315936
                Encrypted:false
                SSDEEP:3:HPmJX:+
                MD5:6B63443AA25630486C114C352792F3DF
                SHA1:AA59F5E2CF4B2342EA16FCC0D804873F6248D1EE
                SHA-256:7E23F0864C850B9ED470161FC036DA100C6497FEDB58708CC0F02EB26926F4F1
                SHA-512:A340543D5E54885C91F911A997F1ACCA9E496FCC7F31D8E387F2839A6F9CD5007919D75F23078507DB38A689C5DF033BE72C482C6A201A0142CDE2432FCE2586
                Malicious:false
                Preview:.....j........................

                C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:Microsoft Outlook email folder (>=2003)
                Category:dropped
                Size (bytes):271360
                Entropy (8bit):1.972537064800782
                Encrypted:false
                SSDEEP:1536:5w71HgI4HO1MQTAjUV9dR9qzSS3W53jEpEHP4qQ10PAwr1:5g9BAje91yp9
                MD5:759D13EF8C1BB0409014E633B7813362
                SHA1:733EAB0AD192D6953298FBB0CACA84C7916AC6A1
                SHA-256:D05587E9142BE1972DD8F4DB37D5DF95286747CA3E0CE84600F8C4F9E1D21D08
                SHA-512:66DC207553324977C0B007665B29063F35A54E4C1EFCAF657C12A6B7A2C7095650F83FC567C2BEE333B9DF5738A955E50A5C9868700D25B4CE7AE736CEEE8988
                Malicious:false
                Preview:!BDN.5..SM......\....h..................X................@...........@...@...................................@...........................................................................$.......D...............................6..............................................................................................................................................................................................................................................................................................................).X.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                Download File
                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                File Type:data
                Category:dropped
                Size (bytes):131072
                Entropy (8bit):3.255202982349964
                Encrypted:false
                SSDEEP:1536:vcHO1MQTjjUV1qzDrvYqW53jEpEHP4qQ10PAwr1FdRSDopw:v5jje4vxp9W7w
                MD5:01F59859EAA9E92088CF4B5335DD7ED1
                SHA1:0E6E033D8C55D602308BB50F7E32DFAA3AA86500
                SHA-256:9EF33E651A62A91E57D9DBA3FC9E28D0F5C640E0D9DD4E63E3E3CC8147B5B7DD
                SHA-512:FF2303C99A655A77072F6F9B4864CF9BB1AF33A92097028ED1B654634625467BC2A7789D39C828AA835E9A9C50835BCF41909F9F7559C6FCAC233A6408E43EC0
                Malicious:false
                Preview:..}.C...O.......@...I..Z......................#.!BDN.5..SM......\....h..................X................@...........@...@...................................@...........................................................................$.......D...............................6..............................................................................................................................................................................................................................................................................................................).X.I..Z.........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                Static File Info

                General

                File type:SMTP mail, ASCII text, with very long lines (347), with CRLF line terminators
                Entropy (8bit):6.085390389329675
                TrID:
                • E-Mail message (Var. 1) (20512/2) 100.00%
                File name:nested-Read%3A MS Power Apps.eml
                File size:11'274 bytes
                MD5:6dd4b72f258cc1e735c24681fb93cbf9
                SHA1:5ce5b3225a61cfd6977a38b1009ab95d58e71f25
                SHA256:9d3e8180a8486495927b83aa8c871629bfbf53437dc12632fefe41a8a79ac8c4
                SHA512:8df6d1c0cf68184e4e7cdb0dc1de2ba3f0a8385e43185a40267e953c3e56296858346d7164497a34a080be346ae82064f39a7a55791e565de05603064439511d
                SSDEEP:192:hevCeEBYEq/1euitxjsky6BGob4Qj3tfXHsisk8QS1JVDoYcSRrT:MgBwNeugRs17a4KtfXHsk8QWVDoYjZT
                TLSH:8D322A148E6A082498B2B1D92D35FA8BE3752CD291F3E140355C65E7118F4EF2F83A7B
                File Content Preview:Return-Path: <dhruv.saksena@automationanywhere.com>..Received: from pps.filterd (m0167316.ppops.net [127.0.0.1])...by mx0b-00369301.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 491CpKcA001958...for <danielle.riley@clientprofilehub.com>; Tue, 1 Oct 2024

                Static Mail

                General

                Subject:Read: MS Power Apps
                From:Dhruv Saksena <dhruv.saksena@automationanywhere.com>
                To:Danielle Riley <danielle.riley@clientprofilehub.com>
                Cc:
                BCC:
                Date:Tue, 01 Oct 2024 14:37:55 +0000
                Communications:
                • Your message To: Dhruv Saksena Subject: MS Power Apps Sent: Friday, August 23, 2024 3:35:59 PM (UTC-05:00) Eastern Time (US & Canada) was read on Tuesday, October 1, 2024 10:37:22 AM (UTC-05:00) Eastern Time (US & Canada).
                Attachments:

                Headers

                Key Value
                Return-Path<dhruv.saksena@automationanywhere.com>
                Receivedfrom TYZPR06MB7117.apcprd06.prod.outlook.com ([fe80::9352:18d4:97b0:c523]) by TYZPR06MB7117.apcprd06.prod.outlook.com ([fe80::9352:18d4:97b0:c523%3]) with mapi id 15.20.8005.024; Tue, 1 Oct 2024 14:37:55 +0000
                ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ZDNxtqqgLgD4tAW5FN0YzhvsHMKauxMeNCY83JNimyet68nj8WHm49SCFaGtAK4GvXVRFDJy0meGgcOc4qWeq9pQvDXcekiQwyNSneaxU9Q6Tals5vK62mEv32qPxbjCT9PqoHjcwvh1Tlky093gEWiFXA7bpGFhTc5nbPVDQOHLkO2BNufOMy/ssLdW3+nAAeBuXHY22DH7VpP8Pvx7uPP29kAT1UQqViFyvReuyj7WHPnac5I65s971r2+4b/nYouXOTnrILb1QyGcrieyZbz+q551JRqwpNnWcb7kLjy/RO3ZzTZYvCnxgIqFf5P49iZ4p9/pjjH/hytxzpVyHg==
                ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=rgcL2lDMMq29/0bRcbfXJeTIn0yuJgHZpSHeprpnk/o=; b=qjSwzhE+yaDhMqQR+v87jB2k9yoFCLDVJq3wBoFpxtl/YoZcwZ3iLbJXcBsGOPh77noM/fkswZRzNAHPyKZFvi0pcAgIdFzHfqASfZjrne3z12Bsg20DPoUoanwY0iRLaMo/5a/mNdJCkWHhMY4iM+NOPqcH0mcwol6ud+BgwNYMp/k5Uv7yLiNGVUXZEdeEA3BpccdTGhCYYIfE1exLQfB5Sb3y1S8BbsrYvsbg275tojtn6xduuRMeUht9mVV7YXLakJpD29i617T3YOA2rOMpRX26oQnZPNTEDLB6pGgLe47+XJzIzX0mbpbbfBhwZ51w1YljnJ+4RMu1uD2GdA==
                ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=automationanywhere.com; dmarc=pass action=none header.from=automationanywhere.com; dkim=pass header.d=automationanywhere.com; arc=none
                DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=automationanywhere.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rgcL2lDMMq29/0bRcbfXJeTIn0yuJgHZpSHeprpnk/o=; b=YVW0ajpXE5JkFotb+Y5q31hZhVkaGPK45jGMVvUCXGFyOqZ93j9MspYue9bQe9Ewv/xVv6pLor1TcZojFKvkma+2ZOCFMlx004Slz+bTJZBdoMX7plXw0PUJXsEPow1FKv27IQ+IE3WQ7/CA2ju72wWgD9WQEC/ePqaC+U66kY4=
                FromDhruv Saksena <dhruv.saksena@automationanywhere.com>
                ToDanielle Riley <danielle.riley@clientprofilehub.com>
                SubjectRead: MS Power Apps
                Thread-TopicMS Power Apps
                Thread-IndexAdr1k6xupAUWncf7QeG4GyWzQd2ckgee8DKw
                DateTue, 01 Oct 2024 14:37:55 +0000
                Message-ID<TYZPR06MB7117BD934617B1E508D33D8E82772@TYZPR06MB7117.apcprd06.prod.outlook.com>
                In-Reply-To<MA0P287MB02028AC799441ACCFEB02D99FF882@MA0P287MB0202.INDP287.PROD.OUTLOOK.COM>
                Accept-Languageen-US
                Content-Languageen-US
                X-MS-Has-Attach
                X-MS-TNEF-Correlator
                x-ms-publictraffictypeEmail
                x-ms-traffictypediagnosticTYZPR06MB7117:EE_|SEZPR06MB5045:EE_
                x-ms-office365-filtering-correlation-idff758f5d-0c1a-4298-402f-08dce226a325
                x-ms-exchange-senderadcheck1
                x-ms-exchange-antispam-relay0
                x-microsoft-antispamBCL:0;ARA:13230040|376014|1800799024|366016|38070700018;
                x-microsoft-antispam-message-infoCk7otClcodk4cNcIefnk9aSaxYCkuFtFFUJWbc/DUI9pDbjy3GYbHQp8vGrK9ffWecGzfNMiExraGRIfSfpqJS7I0YMHNM/jLU4KSwwxOmc/TiMwJp80xrGhkOpx1ciU+ya71eiLY9b6ijYDY/9X86gDwYCq4zW/mo61R5I9okyYFIPi8pqE2eXATtWLL4DzenZkmKl7RRGn4MljgEv0lDS9Wb6xD20xXizrA3ikVLUEnMvhfLvnItu0d0dgaem1+sba2ZOSh8B5CoIkpFpFxxmKcH9x62ThWKyrJPlOIOzj1u64CUC2q/t/U5NoyLHTkkF+l9EiEna2BrktLDnS2j7fZC0c+sOLX/zPZZtuAPFscWWatsPoFDhf+C9rsB/SMZ+IOpX+3i6ZMwXh4QR6K+nZldKCIc64/Sc0kPsiZK1WqMMj9+dVWIg/vbdkL0l8mMwToCscHymw3e83S8BP172F/BqG2TgJTeXZ9HwCYV91Dm0Y2Lwac+SG8QbKT0A803l262YyOgoygZQ9eEkdV28i25Q4ik/l1H6Yl25k/RK9YOr337EiWFiotNRjJ4zXJRVuD1KT2WfqD53KJUPGVuTLueHyAm3uzsloAudH2FLAxpwd3VN6WPzmRKc+MDTUIB/eeK75FNLLi2QYIqzc0O4j3ZoXAH+Isl5+pWbgSflqUGyL1+WIBYGA4h63dQQQA3YsSvYrU0XvZ0Q5O+1tFFXnG/2y9rUWcVJahlkkFppsQPQ8X7xyUX+8CWFNYahBAKJQYB+OvqGOr8Ch+WuswNmG2+E/QNDUh9Rqd2r0JckXp3atykcV2qiBXqlqBYHByhHrLZFhz7DLMCzLN68m69/57SGcj+LwKHzB9rXzokVPuDse5F625icbgD4ulmmCvEG8Oz6gOuJO9D6unI5/z6qGYqxe+2NETXz37zd5JOvT2IaS/lgcAtRjUgGuZnTvtRcStkqESgLbbZhlqhW7XpniOljNMSnZXoD0vyQvFqOZ5yx4r6pSFZo+tO4MNwSoH6i4+dVxthHhdvCVb7eMcAvRbOAn92WSdfd5vCKrzlaDG2gDxMlws/W4yPaIZpQO
                x-forefront-antispam-reportCIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:TYZPR06MB7117.apcprd06.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016)(38070700018);DIR:OUT;SFP:1102;
                x-ms-exchange-antispam-messagedata-chunkcount1
                x-ms-exchange-antispam-messagedata-0m7W5tRdbs/k6fFpKyjFLEq4UrodupRLO6hOFSq6DfP1RX3jbnCAaSxc772tB59qgJT+tWGxferBCmy5t54TwurGRKLzRMlMgVqRydVUC+cy9au9P8+0YmUMxosdLWSq87uqojfqD+CH/FYwBW/ezO1GT0itax4QXQ5cDhxzi940njC0v5BnPxOn50A0IdpvBlxPdi7Ewov4lUt9R4GiTTLdrPQYjmSfijjxcYxo+w5y7pE+033tJvouvhu7Y88QrOrGxkx/zGUwfY9ysokXUwA1tO8JhZR/8qhQGbcDYqTX7hCTRnBK7ptAIWMRBIA+eQ/xtu9Ttoylz3Zwg8sSDa9LmLgGTGe0/FvMU9D0uHErjzjbpS9r2aKp+5eTIfOjOERZzEHk7A5FQP/5WWjGcu/ZqazcLiPkgvi99ClC3S48nPzhaiXglN0X1edKs1nra3pep3rD3zsEqZwA4OW4ih+Ii4qj3Ee1iSjfz8lugizDcWvb4KVn4szZMCw7N3yMYEejYYl6zJ9M7hNzuFFaZAI/0MHmedSxsXOXi02kqLL+GPX/ZsLn1us1DBijzcCp3qqSfAcVlHulcuO4mQavTg4r7JITsjXrsGekVcIMjJDs7C/GECefIxW6KCrjrJFz0Q7Tfq7rDuGHn0ice01j1o6n/rGME3/lbCEoUJ0mqJ2LardMJDrHfOT0p3evhVncAjxCzNM08+/1FVWrbfzsDo67C2OcgN2P/A8gK6jXlBMDwISJhiPwxNCENyKzez8ByhYk2c3KWCVnMp/Fw8TNY5WmWqgzpl43J+2Wc20/aZDJLrWTHgF14dj5e3l/++Lh56zlVCCXpAgqvFjTu3H8nI2GzckU23gXg7HSked9qeAf1QH6HC3mz53lsrdHJ0YrrGLkXdXGCHxGr57/VHJVmr+gNI+0AZNd9GrEC7qDwj5twXlB8xwMwdUNEv88i9Eol9Kt7PTb37fscNHhM2nzR04kPCkvsTNY7lYESmKnwwdV/BBTJWRIOWnPe7QgVAtMOgKFkodtccaufaRvrxRMjHy0Ag/iQlKa0k2ELdb51izn0K/tTMk9Iku7J6ZpiSQNgqnKKsRwOSC8ydqdYLn+zs9pJvfRlcw9ss774dxIzWYDwIAKIypcj6qWCEHPtB7UZXBmyxXcMLw4w+gr76bJrngG8eRrAvj1uxUMlWhqaKJPRTpeJcm1FQbnKWCACRDcfJTvSQ0+dZbQUoFVQA5WSX5AcOCIxLKBiDxoeJ+dXf+YoMkpijWAoSrMHT9Oia+BzlujeNRFR1Ynozd/m6Sq1tAgmaTGcCUdDWEjoPBCiVFzfIPLzcNtMRSjvLNKabH907a0bR0ItXTCnc/wE9cZ9sBs6TmdXuxyObOJ2Gp0yCEnVTqtcw2rCQhpgErzLF6snPeYA0q/m5QNNkgSM1vLsGn7sUBZpHe18QcZxJficTXbqfsMWlTHwYuDMe4oic3pGSG5fYu/Cxa1GYKVR8HJfoYe4QADhxSKKWxz9STlWP4JD1hDq2/PLy3spiBkizeTAVrb+f0nY4Q2uxpSh8gMnRquc5u4kxivTGqC1Z1yU/9DWDOW8AX6/KUo6JkbDR8O9fPr645Wy6zwy2i91vMsDx66RQaNyaFm7zhLbzW9QvUk=
                Content-Typemultipart/report; boundary="_000_TYZPR06MB7117BD934617B1E508D33D8E82772TYZPR06MB7117apcp_"; report-type="disposition-notification"
                X-OriginatorOrgautomationanywhere.com
                X-MS-Exchange-CrossTenant-AuthAsInternal
                X-MS-Exchange-CrossTenant-AuthSourceTYZPR06MB7117.apcprd06.prod.outlook.com
                X-MS-Exchange-CrossTenant-Network-Message-Idff758f5d-0c1a-4298-402f-08dce226a325
                X-MS-Exchange-CrossTenant-originalarrivaltime01 Oct 2024 14:37:55.3177 (UTC)
                X-MS-Exchange-CrossTenant-fromentityheaderHosted
                X-MS-Exchange-CrossTenant-idf03022ed-34ea-4c8f-91cb-9abee0a20907
                X-MS-Exchange-CrossTenant-mailboxtypeHOSTED
                X-MS-Exchange-CrossTenant-userprincipalname38iz4mj82d65iWcs9zoqVhGYLfbNzz0Zgz+4wFiiyqgCDDvciH+/CA5B/CHDD8VtwrhybxcXe3k8VQf8Gc9OHfZgGdLS7s6ePL49Ij05Hn4q+mRlsj24KwnnYhX3uNGW
                X-MS-Exchange-Transport-CrossTenantHeadersStampedSEZPR06MB5045
                X-Proofpoint-GUIDeu5zzbEQeRLor0R7WmPzCLcLoLAfZqEn
                X-Authority-Analysisv=2.4 cv=FPFJxPos c=1 sm=1 tr=0 ts=66fc0949 cx=c_pps a=U8QHk/hU/nNFLhjBfMABKw==:117 a=Ol13hO9ccFRV9qXi2t6ftBPywas=:19 a=xqWC_Br6kY4A:10 a=DAUX931o1VcA:10 a=nMnXZQZhvCYA:10 a=-6-xon7TUAkA:10 a=veuYbCNMi-WDGHigHiAA:9 a=CjuIK1q_8ugA:10 a=AvdQY7BSU_Z1VMk5rfAA:9 a=frz4AuCg-hUA:10 a=_W_S_7VecoQA:10 a=dcq4k8CdAAAA:8 a=hdQ99KjVEMKcd-3v_Y8A:9 a=WJQ6CsgMIj4A:10 a=jkBdN16LWm_cLpI3kwC9:22
                X-Proofpoint-ORIG-GUIDeu5zzbEQeRLor0R7WmPzCLcLoLAfZqEn
                X-Proofpoint-Virus-Versionvendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1051,Hydra:6.0.680,FMLib:17.12.62.30 definitions=2024-10-01_11,2024-09-30_01,2024-09-30_01
                X-Proofpoint-Spam-Reasonorgsafe
                MIME-Version1.0

                File Icon

                Icon Hash:46070c0a8e0c67d6

                Network Behavior

                ⊘No network behavior found

                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:1
                Start time:11:26:58
                Start date:01/10/2024
                Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                Wow64 process (32bit):true
                Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\nested-Read%3A MS Power Apps.eml"
                Imagebase:0xd00000
                File size:34'446'744 bytes
                MD5 hash:91A5292942864110ED734005B7E005C0
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:false

                General

                Target ID:2
                Start time:11:27:03
                Start date:01/10/2024
                Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "DED99D21-B1E4-4A3A-A135-E0A27BC4274C" "B173A742-9496-4ACA-BB56-88F27147C14E" "6464" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                Imagebase:0x7ff7aafb0000
                File size:710'048 bytes
                MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:false

                Disassembly

                ⊘No disassembly