Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
k00TVl4c.eml

Overview

General Information

Sample name:k00TVl4c.eml
renamed because original name is a hash value
Original sample name:abx_CloudMessage_WzQ5LCAiMTg3ODI3YjMtNjIxNy00ZWMzLWEwMWQtNjEwNDk4NTIxODVhQDliYmFhNGFhLWU3YjgtNDdiMy05ZGY1LTc1ZTJkNjViNWJjYSIsICJBQWtBTGdBQUFBQUFIWVFERWFwbUVjMmJ5QUNxQUMtRVdnMEFIT1FobGc2SXEweWF2Qk00TVl4c.eml
Analysis ID:1525207
MD5:5a3d50ff8729f00eafb65b5120e53b13
SHA1:0b775cc9486590df8994ad52f67a9960cb22004e
SHA256:d1208c034c12c571d3eb764821bb6926a20758bb5e3b52e0cd754f8e166bded9
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

  • System is w10x64
  • OUTLOOK.EXE (PID: 7568 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\k00TVl4c.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7972 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3BB57A76-8FFC-49E2-93B8-6E8E0B040F0E" "4630675F-B973-4CD4-89FB-34ED094E70F6" "7568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7568, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: olk7030.tmp.1.drString found in binary or memory: http://www.videolan.org/x264.html
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.aadrm.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.aadrm.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.cortana.ai
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.diagnostics.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.microsoftstream.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.office.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.onedrive.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://api.scheduler.
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://app.powerbi.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://augloop.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://augloop.office.com/v2
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://canary.designerapp.
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.entity.
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://clients.config.office.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://clients.config.office.net/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cortana.ai
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cortana.ai/api
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://cr.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://d.docs.live.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://designerapp.azurewebsites.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://dev.cortana.ai
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://devnull.onenote.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://directory.services.
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ecs.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://edge.skype.com/rps
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://graph.ppe.windows.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://graph.windows.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://graph.windows.net/
Source: ~WRS{063F99C8-9EA9-44F4-9FA7-6303B1085B4D}.tmp.1.drString found in binary or memory: https://hello.asana.com/api/mailings/opened/5~A9y8xvCLiZWPG42JWRniWhkV5VNb8LibG3RfBUXc6NoFkr3C4e4CpJ
Source: k00TVl4c.emlString found in binary or memory: https://hello.asana.com/api/mailings/opened/5~A=
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ic3.teams.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://invites.office.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://lifecycle.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://login.microsoftonline.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://login.microsoftonline.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://login.microsoftonline.com/organizations
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://login.windows.local
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://make.powerautomate.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://management.azure.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://management.azure.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messaging.action.office.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messaging.engagement.office.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://messaging.office.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://mss.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ncus.contentsync.
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ncus.pagecontentsync.
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://officeapps.live.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://officepyservice.office.net/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://onedrive.live.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://otelrules.azureedge.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://outlook.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://outlook.office.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://outlook.office365.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://outlook.office365.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://outlook.office365.com/connectors
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://pages.store.office.com/review/query
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://powerlift.acompli.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://pushchannel.1drv.ms
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://res.cdn.office.net
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://service.powerapps.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://settings.outlook.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://staging.cortana.ai
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://substrate.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://tasks.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://templatesmetadata.office.net/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://webshell.suite.office.com
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://wus2.contentsync.
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://wus2.pagecontentsync.
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://www.odwebp.svc.ms
Source: 605EE827-A7C5-4B78-A2C1-901E268869CA.1.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean1.winEML@3/12@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241003T1527560260-7568.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\k00TVl4c.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3BB57A76-8FFC-49E2-93B8-6E8E0B040F0E" "4630675F-B973-4CD4-89FB-34ED094E70F6" "7568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3BB57A76-8FFC-49E2-93B8-6E8E0B040F0E" "4630675F-B973-4CD4-89FB-34ED094E70F6" "7568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: k00TVl4c.emlStatic file information: File size 9773667 > 1048576
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformationJump to behavior
Source: k00TVl4c.emlBinary or memory string: 329a5ynyZQRbQhc0o3NcOq4TSE4MzVRbr0FGwCrdr/VXjS6Lw0RLmrRlTVMcIljom+Of3BKtD1uF
Source: k00TVl4c.emlBinary or memory string: 7cIoBinaOsjYub/feDw8J0ti1ZQP3j241l98unDLVZ/f2+2PHGFsEPpOMcSXMk8StinCNLa2w8Pg
Source: k00TVl4c.emlBinary or memory string: CK7ie7/nlmTvHYa7Zvda4xcfTqPP2dWfd2ZQJAGN1v14oIGJY7wNcKRAYqemuZjLesRoti2WKXwx
Source: k00TVl4c.emlBinary or memory string: BkCnYGp/CBVmCigSTC2A/9GjATo1GCmYCwSGhzI7631zrf78+H1veuN97usi+uaJl1X1znGqA9pr
Source: k00TVl4c.emlBinary or memory string: SKMktz2y0o2uXo7+BNsJf7xkB+INNULGFGwseTJlaVJ88fggFyBvWDkqvaUBePN3MZ2HGfST8zgf
Source: k00TVl4c.emlBinary or memory string: OFt4tbkaNVrNEyVxk58kQF2ZenkWVIZhTjLsBCvg5C9wpPsmYYpguAzX73NBBHWvmcIT+TTCLp/G
Source: k00TVl4c.emlBinary or memory string: IylEAVqDKgyciDeifXlCW5nhdqhNhIczGjr/JzO84abZwBVMci0xjO/1ep94MEg380hNq9HJcj9H
Source: k00TVl4c.emlBinary or memory string: 06m4lpGQ4PzPc8A8C1F/KkOZmKC4+KavZqFl3mZCoA1VtubzQ7G2XyBxB/qYcxTIeqXFEKVMCIL+
Source: k00TVl4c.emlBinary or memory string: 5Y1XpgWVMCixDpwcPobPJl/0Omvg1NboSuGTdgKLOOqvU+iFRamT6lT8OSpGALAQeK8J9WiZ4If4
Source: k00TVl4c.emlBinary or memory string: Es2+mXE2PaCscmlnnhBh+AlfB9PkHkiJe+09dd0P4IiCYsqeMuU/kHL+BeQKdji7WKVYTFiMUxZP
Source: k00TVl4c.emlBinary or memory string: NHw4invP4AE6mbWJVidoo4VmCiNUUlqCh1CWu5iV8L4v1QBfn3lVA+fiPPUORwHPQUP+OoZVokWB
Source: k00TVl4c.emlBinary or memory string: Xa7jGH8rJ44pSM9NPrgD7N/QEMUe4ZTzYAFoMp0nkxRmC3S63it396+C5w598k0vtywJdUst4Cem
Source: k00TVl4c.emlBinary or memory string: 9nPbOpOjvmCi9IzGwEqtt8MSHVJ1LCM1pSKjDAkCWiGQXoz6GPd8NsMtts/RG8OgAKtjwkTWu+/C
Source: k00TVl4c.emlBinary or memory string: QVmCI6bmMBowrn4NZ/gl4gjKUajRpkZ/1jdafg7f4Cb/GtvnyS0QgK52hSjxi2J7JBJnP14CkNxS
Source: k00TVl4c.emlBinary or memory string: bo0mFuAYOaKbmnFmK7K3iLwxWPqjfKJTRcPt3Czyyd9pfwmmg3DmxHwLZmEEJzqEMuAOKE9ddv8h
Source: k00TVl4c.emlBinary or memory string: 5T22TrMrV2HZkOVvI4PQ4ri2Sds4abCUOIXzItolr8QAUNgQEmUIXK5MOhOYH8eTSwrkTq4ZJ7JG
Source: k00TVl4c.emlBinary or memory string: TVOKAVPpAvIeiwg9DzW3EWVMCIW7sU7M3YUItIREZg7ss7ltg4IjWqgaKQZLtQpWgLNs612fveu+
Source: k00TVl4c.emlBinary or memory string: Ak3R/wDnTAipx7KDYaafU1TEhpHfhgfSnhZrYO3mpP+WEsEUPRKxSgED2bWBmaOPZTI2mbOef5MA
Source: k00TVl4c.emlBinary or memory string: Su7bHvSLOhdV79/mzLK40uGlpuPc2p3NMgKJhGfShXCYAgI2CkUmWRKPCJ5tgOAYq4r9Q845rLn7
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory1
Process Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1525207 Sample: k00TVl4c.eml Startdate: 03/10/2024 Architecture: WINDOWS Score: 1 5 OUTLOOK.EXE 52 124 2->5         started        process3 7 ai.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://api.diagnosticssdf.office.com0%URL Reputationsafe
https://login.microsoftonline.com/0%URL Reputationsafe
https://shell.suite.office.com:14430%URL Reputationsafe
https://designerapp.azurewebsites.net0%URL Reputationsafe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize0%URL Reputationsafe
https://autodiscover-s.outlook.com/0%URL Reputationsafe
https://useraudit.o365auditrealtimeingestion.manage.office.com0%URL Reputationsafe
https://outlook.office365.com/connectors0%URL Reputationsafe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://api.addins.omex.office.net/appinfo/query0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/tenantassociationkey0%URL Reputationsafe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://lookup.onenote.com/lookup/geolocation/v10%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/imports0%URL Reputationsafe
https://cloudfiles.onenote.com/upload.aspx0%URL Reputationsafe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://entitlement.diagnosticssdf.office.com0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://canary.designerapp.0%URL Reputationsafe
https://ic3.teams.office.com0%URL Reputationsafe
https://www.yammer.com0%URL Reputationsafe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies0%URL Reputationsafe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive0%URL Reputationsafe
https://cr.office.com0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://portal.office.com/account/?ref=ClientMeControl0%URL Reputationsafe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory0%URL Reputationsafe
https://edge.skype.com/registrar/prod0%URL Reputationsafe
https://graph.ppe.windows.net0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://tasks.office.com0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://edge.skype.com/rps0%URL Reputationsafe
https://globaldisco.crm.dynamics.com0%URL Reputationsafe
https://messaging.engagement.office.com/0%URL Reputationsafe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.diagnosticssdf.office.com/v2/feedback0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/groups0%URL Reputationsafe
https://web.microsoftstream.com/video/0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://graph.windows.net0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://analysis.windows.net/powerbi/api0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://substrate.office.com0%URL Reputationsafe
https://outlook.office365.com/autodiscover/autodiscover.json0%URL Reputationsafe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios0%URL Reputationsafe
https://consent.config.office.com/consentcheckin/v1.0/consents0%URL Reputationsafe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json0%URL Reputationsafe
https://safelinks.protection.outlook.com/api/GetPolicy0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/0%URL Reputationsafe
http://weather.service.msn.com/data.aspx0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://officepyservice.office.net/service.functionality0%URL Reputationsafe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks0%URL Reputationsafe
https://templatesmetadata.office.net/0%URL Reputationsafe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios0%URL Reputationsafe
https://messaging.lifecycle.office.com/0%URL Reputationsafe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml0%URL Reputationsafe
https://mss.office.com0%URL Reputationsafe
https://pushchannel.1drv.ms0%URL Reputationsafe
https://management.azure.com0%URL Reputationsafe
https://outlook.office365.com0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://incidents.diagnostics.office.com0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/ios0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://api.addins.omex.office.net/api/addins/search0%URL Reputationsafe
https://insertmedia.bing.office.net/odc/insertmedia0%URL Reputationsafe
https://outlook.office365.com/api/v1.0/me/Activities0%URL Reputationsafe
https://api.office.net0%URL Reputationsafe
https://incidents.diagnosticssdf.office.com0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/android/policies0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://login.microsoftonline.com/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://shell.suite.office.com:1443605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://designerapp.azurewebsites.net605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://autodiscover-s.outlook.com/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://outlook.office365.com/connectors605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://cdn.entity.605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://api.addins.omex.office.net/appinfo/query605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://powerlift.acompli.net605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://rpsticket.partnerservices.getmicrosoftkey.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://lookup.onenote.com/lookup/geolocation/v1605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://cortana.ai605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://api.powerbi.com/v1.0/myorg/imports605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://cloudfiles.onenote.com/upload.aspx605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://entitlement.diagnosticssdf.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://api.aadrm.com/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://ofcrecsvcapi-int.azurewebsites.net/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://canary.designerapp.605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://ic3.teams.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://www.yammer.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
  • URL Reputation: safe
unknown
https://api.microsoftstream.com/api/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
    		unknown
    https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
    • URL Reputation: safe
    		unknown
    http://www.videolan.org/x264.htmlolk7030.tmp.1.drfalse
      		unknown
      https://cr.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
      • URL Reputation: safe
      		unknown
      https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
        		unknown
        https://messagebroker.mobile.m365.svc.cloud.microsoft605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
        • URL Reputation: safe
        		unknown
        https://otelrules.svc.static.microsoft605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          		unknown
          https://portal.office.com/account/?ref=ClientMeControl605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://clients.config.office.net/c2r/v1.0/DeltaAdvisory605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://edge.skype.com/registrar/prod605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://graph.ppe.windows.net605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://res.getmicrosoftkey.com/api/redemptionevents605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://powerlift-frontdesk.acompli.net605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://tasks.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://officeci.azurewebsites.net/api/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://sr.outlook.office.net/ws/speech/recognize/assistant/work605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://api.scheduler.605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
          • URL Reputation: safe
          		unknown
          https://my.microsoftpersonalcontent.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
            		unknown
            https://store.office.cn/addinstemplate605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
            • URL Reputation: safe
            		unknown
            https://api.aadrm.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
            • URL Reputation: safe
            		unknown
            https://edge.skype.com/rps605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
            • URL Reputation: safe
            		unknown
            https://outlook.office.com/autosuggest/api/v1/init?cvid=605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              		unknown
              https://globaldisco.crm.dynamics.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://messaging.engagement.office.com/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://dev0-api.acompli.net/autodetect605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://www.odwebp.svc.ms605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://api.diagnosticssdf.office.com/v2/feedback605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://api.powerbi.com/v1.0/myorg/groups605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://web.microsoftstream.com/video/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://api.addins.store.officeppe.com/addinstemplate605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://graph.windows.net605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://dataservice.o365filtering.com/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://officesetup.getmicrosoftkey.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://analysis.windows.net/powerbi/api605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
              • URL Reputation: safe
              		unknown
              https://hello.asana.com/api/mailings/opened/5~A=k00TVl4c.emlfalse
                		unknown
                https://prod-global-autodetect.acompli.net/autodetect605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                • URL Reputation: safe
                		unknown
                https://substrate.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                • URL Reputation: safe
                		unknown
                https://outlook.office365.com/autodiscover/autodiscover.json605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                • URL Reputation: safe
                		unknown
                https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                • URL Reputation: safe
                		unknown
                https://consent.config.office.com/consentcheckin/v1.0/consents605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                • URL Reputation: safe
                		unknown
                https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                • URL Reputation: safe
                		unknown
                https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                • URL Reputation: safe
                		unknown
                https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                • URL Reputation: safe
                		unknown
                https://d.docs.live.net605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                  		unknown
                  https://safelinks.protection.outlook.com/api/GetPolicy605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://ncus.contentsync.605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    		unknown
                    https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    http://weather.service.msn.com/data.aspx605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://apis.live.net/v5.0/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://officepyservice.office.net/service.functionality605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://templatesmetadata.office.net/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://messaging.lifecycle.office.com/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://mss.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://pushchannel.1drv.ms605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://management.azure.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://outlook.office365.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://wus2.contentsync.605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://incidents.diagnostics.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://clients.config.office.net/user/v1.0/ios605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://make.powerautomate.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://api.addins.omex.office.net/api/addins/search605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://insertmedia.bing.office.net/odc/insertmedia605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://outlook.office365.com/api/v1.0/me/Activities605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://api.office.net605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://incidents.diagnosticssdf.office.com605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://asgsmsproxyapi.azurewebsites.net/605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://clients.config.office.net/user/v1.0/android/policies605EE827-A7C5-4B78-A2C1-901E268869CA.1.drfalse
                    • URL Reputation: safe
                    		unknown

                    World Map of Contacted IPs

                    ⊘No contacted IP infos

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1525207
                    Start date and time:2024-10-03 21:26:44 +02:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 4m 59s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:6
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:k00TVl4c.eml
                    renamed because original name is a hash value
                    Original Sample Name:abx_CloudMessage_WzQ5LCAiMTg3ODI3YjMtNjIxNy00ZWMzLWEwMWQtNjEwNDk4NTIxODVhQDliYmFhNGFhLWU3YjgtNDdiMy05ZGY1LTc1ZTJkNjViNWJjYSIsICJBQWtBTGdBQUFBQUFIWVFERWFwbUVjMmJ5QUNxQUMtRVdnMEFIT1FobGc2SXEweWF2Qk00TVl4c.eml
                    Detection:CLEAN
                    Classification:clean1.winEML@3/12@0/0
                    Cookbook Comments:
                    • Found application associated with file extension: .eml

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                    • Excluded IPs from analysis (whitelisted): 20.190.159.4, 20.190.159.71, 40.126.31.73, 20.190.159.68, 40.126.31.69, 20.190.159.64, 20.190.159.75, 20.190.159.23, 52.109.89.18, 52.113.194.132, 52.182.143.215
                    • Excluded domains from analysis (whitelisted): onedscolprdcus22.centralus.cloudapp.azure.com, ecs.office.com, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, prod.configsvc1.live.com.akadns.net, weu-azsc-config.officeapps.live.com, s-0005-office.config.skype.com, login.msa.msidentity.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, s-0005.s-msedge.net, config.officeapps.live.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                    • Report size getting too big, too many NtSetInformationFile calls found.
                    • VT rate limit hit for: k00TVl4c.eml

                    Simulations

                    Behavior and APIs

                    ⊘No simulations

                    LLM Input / Output

                    InputOutput
                    URL: Email Model: jbxai
                    {
"brand":["Sage Hospitality Group"],
"contains_trigger_text":true,
"trigger_text":"I see you use Asana today. I had my L&D team build out a quick video showing how we use the platform for our L&D program.",
"prominent_button_name":"phishing report button",
"text_input_field_labels":["unknown"],
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

                    Joe Sandbox View / Context

                    IPs

                    ⊘No context

                    Domains

                    ⊘No context

                    ASNs

                    ⊘No context

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):231348
                    Entropy (8bit):4.393263621093445
                    Encrypted:false
                    SSDEEP:1536:hSYLGEgs7Nwe9MOf5gsRdNcAz79ysQqt2xU3PqoQDKrcm0FvvbJypJZWjZ714/RA:TZgCSwgsmiGu2CqoQGrt0FvkFG6S502
                    MD5:AFB0EA929DE603243F28490B0A2728A9
                    SHA1:6B729A933F059FFF04992CA566D8909833DF3CA9
                    SHA-256:323E3A941E05DCB85F641344CB4DEA6F8873BE336AB9276D255EC30631E68316
                    SHA-512:DB68538AAF6378AF3F17953EEFF3CE579E80E5B57F12BC4F7394B36FC15140709DA07DC171E5A86F6D005DA04DC0DBCD2860E843DCCA7DCE38C658EE791C5A4F
                    Malicious:false
                    Reputation:low
                    Preview:TH02...... ...J........SM01X...,... i.J............IPM.Activity...........h...............h............H..h........E......h........x...H..h\alf ...AppD...h.t..0...h......h].sa...........h........_`.j...h..sa@...I..v...h....H...8..j...0....T...............d.........2h...............k..1...........!h.............. h.0...........#h....8.........$hx.......8....."h............'h..............1h].sa<.........0h....4.....j../h....h......jH..h....p.........-h .............+h%.sa........................ ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\605EE827-A7C5-4B78-A2C1-901E268869CA

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):177088
                    Entropy (8bit):5.286754183301067
                    Encrypted:false
                    SSDEEP:1536:qi2XfRAqcbH41gwEwLe7HW8bM/o/NM5cAZl1p5ihs7EXXCEAD2OdaLI:fCe7HW8bM/o/9XPkiI
                    MD5:87046BE26EA6E3122A72333FBAF77E1B
                    SHA1:CD45426BFD550599B24F4487AF4839FB0E1D9751
                    SHA-256:C7E62257002B09BD568B14D19FB1C4D47EA2920CCFF9A8FB16BDA2C547D8CA89
                    SHA-512:F9B02D5AFEBDAF1D832F6D8B81259733B28C817F77F0A2B96E5707E706D405E9FCF36F745C75B9B90AC8F9E4B6E7BF1D2B56EC45B4DBFD65246D6FCC1215AEEB
                    Malicious:false
                    Reputation:low
                    Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-03T19:27:59">.. Build: 16.0.18112.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):32768
                    Entropy (8bit):0.04595739460260245
                    Encrypted:false
                    SSDEEP:3:GtlxtjlDRMDaplI/3lxtjlDRMDap/l7R9//8l1lvlll1lllwlvlllglbelDbllAC:GtjRMOLIPjRMOR/9X01PH4l942wU
                    MD5:32D5EDB34F88A5E3B6F650119802C516
                    SHA1:DCF44A5F55A4AE6D3C2EBB035B48D8624D1209FF
                    SHA-256:7D4541BABDF784F291C86A8751AD36B209BFB12979931D40322C1C91DCB6F7FE
                    SHA-512:755DB750F4250B6106B1A8D9F95421BA890F98617ECD37C187C6515F204E1C69E5EE1E63134C14B1A95399CADDCC0CD5AF8D20E21B10F7DA74387A20495A2A81
                    Malicious:false
                    Reputation:low
                    Preview:..-...........................f.. ......X,./6v...-...........................f.. ......X,./6v.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:SQLite Write-Ahead Log, version 3007000
                    Category:modified
                    Size (bytes):49472
                    Entropy (8bit):0.4834055981640481
                    Encrypted:false
                    SSDEEP:48:JaR6Q1LUUll7DYMSfvqzO8VFDYM6/xMsuBO8VFDYML:JEtxll4pfv6jVGbK1jVGC
                    MD5:9E1C99337724A7E86C83939638F99217
                    SHA1:9846BAE5A80EDB15CCBD7BBA95912DC90D7D3B4E
                    SHA-256:D6410C0048CE276CEAC82B5C9B0BB098757C7E31BC4590E760B1511844B92698
                    SHA-512:BB96B5B9D04AC455FB217C688BB22239A957895753CF68D4A83A59C6DFF772782D7FC2B784DB297596FCA2FD3267D050C478705745BABF070891461A4EBD2AFA
                    Malicious:false
                    Reputation:low
                    Preview:7....-........... ......\t#....p......... ......,..2...>SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{063F99C8-9EA9-44F4-9FA7-6303B1085B4D}.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):3016
                    Entropy (8bit):2.4995453925393054
                    Encrypted:false
                    SSDEEP:48:PSSpTzxCunpgfV29Na+U7sLfhHOxF6E6j6HAN2:PPTzEW99ksd02h2
                    MD5:43E16E8242FA2CE42FD665EE86E267AC
                    SHA1:39502F70B372B4C3695FE399C5102E1A41F5292D
                    SHA-256:AD6F6E17105B62EBE27CC04F3D01C76171195C1EF2191DD71ACB0071F160A000
                    SHA-512:E940D5C96E583C8FFAF3E0389A17F4B1771E7D6F102C733F5F45500DA905BA753FF7B973AE149A6731E17FDF98CA29BA40B1239DC28BFBF22FDDA6D29F57AD82
                    Malicious:false
                    Reputation:low
                    Preview:....E.M.A.I.L. .S.E.C.U.R.I.T.Y. .W.A.R.N.I.N.G.:. ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................. ...$...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727983677534971200_C3B97693-3A55-45E2-AD05-42CC292A12F8.log

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with very long lines (28766), with CRLF line terminators
                    Category:dropped
                    Size (bytes):20971520
                    Entropy (8bit):0.17640344865983779
                    Encrypted:false
                    SSDEEP:1536:Vk/en7HBxTKJkRf1Exv2klbqtmsBjDIZHcGx8AwPtJFti9u3awKj7W4fYPt6bFv5:n7P+kRqk++gH
                    MD5:27B545F04F9D196E57A8D9E35C633B95
                    SHA1:BFA24E51C9C7960DD4B162076BED8DFB7EF191D7
                    SHA-256:8C90EBC223B8DE32DF9B9E6760DF6359D8007506A201C1ABE69450246083949D
                    SHA-512:E4E9140B68ABF80B05C3658901295BC63355AA6A5F0BDA2B4D93F3747F7AD3F1D1E8FC3D8E439307E4BF77ADCAEB05784E5A56E2562E5B164C6E9EACE7E1B683
                    Malicious:false
                    Reputation:low
                    Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/03/2024 19:27:57.651.OUTLOOK (0x1D90).0x1D94.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":16,"Time":"2024-10-03T19:27:57.651Z","Contract":"Office.System.Activity","Activity.CV":"k3a5w1U64kWtBULMKSoS+A.4.9","Activity.Duration":10,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/03/2024 19:27:57.854.OUTLOOK (0x1D90).0x1D94.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-10-03T19:27:57.854Z","Contract":"Office.System.Activity","Activity.CV":"k3a5w1U64kWtBULMKSoS+A.4.10","Activity.Duration":14098,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727983677535684400_C3B97693-3A55-45E2-AD05-42CC292A12F8.log

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):20971520
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:3::
                    MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                    SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                    SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                    SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                    Malicious:false
                    Reputation:high, very likely benign file
                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241003T1527560260-7568.etl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):110592
                    Entropy (8bit):4.512902974808486
                    Encrypted:false
                    SSDEEP:768:leGb4c5Y/U0OMvKPmmoMo4shm1Kp94liY0eAtsGX6jPo/QWzgWGdPlWmWS:lnu4Dc94l5JstXi/t
                    MD5:D399FA790049F57540EBED210C17E58B
                    SHA1:71C1FA054C557DC9C37DDFC162B76BEB8527BE90
                    SHA-256:B44A7A313F89C19C1471C95DB5F400981F623D477C6FEEA6DC89C9894F22B75E
                    SHA-512:EE1A888A3B3BBE2920E865778EBE2CA53D57A1127E7E222D86E3B23E684FC56BDCA044C919E923FBB12A253B6A3FEA988DC7F9B8D3001BA03AAF09254F8CF922
                    Malicious:false
                    Reputation:low
                    Preview:............................................................................d.............AY....................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................................AY............v.2._.O.U.T.L.O.O.K.:.1.d.9.0.:.4.2.2.1.7.d.4.e.6.d.e.e.4.c.4.e.b.a.6.0.0.0.3.2.2.6.c.d.6.2.f.4...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.0.3.T.1.5.2.7.5.6.0.2.6.0.-.7.5.6.8...e.t.l...........P.P...........CY....................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\olk7030.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):7003492
                    Entropy (8bit):7.962324279610175
                    Encrypted:false
                    SSDEEP:196608:ZnB7N6R3APZjQYUkMTGLaVWtE8ouHNAMBL5iujiB:BBh6R3U1QNjmOWtdHNHBdNmB
                    MD5:11C3E5F6B9577C235564832F704BF3EC
                    SHA1:A8C71168EB035876F61573B6C1705AADA61B34D1
                    SHA-256:E25A039866E584FDEDB5AE095230CA8D87288943E4D856F2A86EC075106ED243
                    SHA-512:EAE32956B44EFA06CD9C3E8257BFA218ECB6E22F1E33B7E94E917ECB1B6C4842E243403E70E800D2250E2EEB5723C741AB5DE6BAF694F0AE8DE007E113A9BDA1
                    Malicious:false
                    Preview:..0...0...0...0...0.&.0...0...0...0.M.0...0.a.0...0...0.[.0...0...0.,.0.[.0. .0...0...0...0...0...0..0.".0.:.0.Q.0.[.0..0...0...0..0...0...0.9.0..0..0...0...0.y.0.h.0.,.0.i.0.c.0.o.0...0...0...0...0.q.1...1...1...1...1...1.X.1...1.".1...1.W.1...1...1.D.1...1...1...1.Z.1...1 ..1"=.1$..1%..1'..1*!.1,..1/(.10..12..13..15..17..18..1:..1<..1>..1?B.1AW.1B..1E..1FH.1H%.1J..1KH.1M+.1Ni.1P..1Q..1S..1U..1W..1X..1Z..1\..1]<.1_..1`<.1b..1d..1f..1g..1h..1j..1k..1m..1o..1p..1r..1s..1u..1w..1y..1z[.1|Q.1~B.1.s.1...1...1.J.1...1...1...1...1...1.G.1...1.R.1...1...1.P.1...1...1.r.1...1...1.;.1...1...1...1...1...1...1...1...1...1...1.F.1.~.1.u.1...1...1...1...1..1.^.1.4.1...1...1.2.1...1.C.1..1...1.R.1.".1.W.1.@.1.g.1.;.1.,.1.X.1.\.1...1.N.1.#.1...1..1...1...1...1...1...1...1...2...2...2.%.2.$.2.k.2.l.2...2.3.2...2...2.`.2...2.d.2...2.~.2...2...2.q.2...2...2 ..2"..2$..2&..2(1.2*6.2,/.2-~.2/r.20..22..23..25..27..5<H.5A..5C..5E..5G'.5I8.5J..5L..5N..5P2.5R..5UI.5Z..5\..5_..5b..5e<.5hu.5j..5l..5m..5p

                    C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):30
                    Entropy (8bit):1.2389205950315936
                    Encrypted:false
                    SSDEEP:3:zSIllX:+Ill
                    MD5:1192BC56F04829DF00DC52FB8E848551
                    SHA1:D848FB0F563C89D7C7384D81883A6F419D487650
                    SHA-256:FAAACC1C3121D60BF3C6A88118318848FA2D4A2E1BF7E0131A0D91403F0B882F
                    SHA-512:715EB88A173596F9A779FC18F6D41CB6183D287FC46DB2F59D94377F73595C5D560E918B8CC802E392E01ECF07DC5FA557F50D4CAA6E6887FC69CA9E914B18A4
                    Malicious:false
                    Preview:....Dw........................

                    C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:Microsoft Outlook email folder (>=2003)
                    Category:dropped
                    Size (bytes):8397824
                    Entropy (8bit):7.393250392595238
                    Encrypted:false
                    SSDEEP:196608:+BCgfADHZ3mFQ2bGcZZ7GmWwv7wCGeJ0S3i+DXixCkr1jZU:0VfAynZ7JWwm0S+DXiXr1d
                    MD5:F13794B2E05B37B0DC49A17E261A8DE5
                    SHA1:248D61A877997AD7EBDAE577336EF59727DD2FAF
                    SHA-256:97F28BA3AF0D9464F9FCB4B28F694E07C863579B0899E1F75DC59C96365B4506
                    SHA-512:859DA1B831BCA93203B3DAF9C1A8204EF3B537E56AEF3D9AB49B229DF8EEB55BC2BD0FF2DB5A9FE686C6BC71F47FB47228BFBF201ADDAA4CFBC36F6B70840E02
                    Malicious:false
                    Preview:!BDN.sG.SM......\...&o..................[................@...........@...@...................................@...........................................................................$.......D|.....................z.........r.....~........fr.................................................................................................................................................................................................................................................................................,..........g@.A.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):7340032
                    Entropy (8bit):7.935423818606503
                    Encrypted:false
                    SSDEEP:196608:NDfHNfUIVe3L70VXh4OJDfHNfUIVe3L70VXh4O:5tUIVe3MVXhBVtUIVe3MVXhB
                    MD5:798C4F0F21CD41B34998D1F52BF4863D
                    SHA1:E9D8F21F4739F9C0AAF1D5685EE9D44B5B7C2637
                    SHA-256:6287FEBE257B299A34D3247D0BF9D276BC48521369B5E6D6A4BB0371B9EC53E7
                    SHA-512:00FAF16835B510A1FA8B8B037075694473428DDBB09045AEDDDAA13024EF1F349918DB0B8B7AACF64B04604C31134F67B8A4000549F9EDBB94C517660FC2E06E
                    Malicious:false
                    Preview:...<C...A...........M.UX......................#.!BDN.sG.SM......\...&o..................[................@...........@...@...................................@...........................................................................$.......D|.....................z.........r.....~........fr.................................................................................................................................................................................................................................................................................,..........g@.A.M.UX.........B............#................. ... ... ... ... ... ...................................................................................................................................................................................................................................................................................................................................................................

                    Static File Info

                    General

                    File type:ASCII text, with CRLF line terminators
                    Entropy (8bit):6.016159441631834
                    TrID:
                      File name:k00TVl4c.eml
                      File size:9'773'667 bytes
                      MD5:5a3d50ff8729f00eafb65b5120e53b13
                      SHA1:0b775cc9486590df8994ad52f67a9960cb22004e
                      SHA256:d1208c034c12c571d3eb764821bb6926a20758bb5e3b52e0cd754f8e166bded9
                      SHA512:459e71973039a688d14038645c6e0b3097df682236258fe44f6a303c4779e17f7ec167ecda7c5f4fbfcde2247df24b5c93b70226785c1ff651a73c39b47c526d
                      SSDEEP:49152:swDqU/QFOjcPPlkJrS8tvS55TT51K5S0VSMZoo56tW7rGqs4141Pmym8jvU6XAwC:P
                      TLSH:CAA612770A8BBBD70A1D5F94A1D4B6046CA961CB878A51B2998C42E331FB430FF59DF0
                      File Content Preview:authentication-results: spf=pass (sender IP is 209.85.208.196).. smtp.mailfrom=asana.com; dkim=pass (signature was verified).. header.d=asana.com;dmarc=pass action=none header.from=asana.com;compauth=pass.. reason=100..date: Thu, 03 Oct 2024 14:07:12 -040

                      Static Mail

                      General

                      Subject:Lauren: how we operationalize L&D
                      From:Don Deschene <dondeschene@asana.com>
                      To:lauren.dorbin@sagehospitalitygroup.com
                      Cc:
                      BCC:
                      Date:Thu, 03 Oct 2024 14:07:12 -0400
                      Communications:
                      • EMAIL SECURITY WARNING: This message originated from outside of Sage Hospitality Group. Please DO NOT reply to, open attachments from, or click on URLs from unknown and untrusted sources. Use the phishing report button or forward to phishing@sagehospitalitygroup.com Hey Lauren, how are you? I see you use Asana today. I had my L&D team build out a quick video showing how we use the platform for our L&D program. Please let me know if you have any questions or requests.Thanks,Don EMAIL SECURITY WARNING: This message originated from outside of Sage Hospitality Group. Please DO NOT reply to, open attachments from, or click on URLs from unknown and untrusted sources. Use the phishing report button or forward to phishing@sagehospitalitygroup.com Hey Lauren, how are you? I see you use Asana today. I had my L&D team build out a quick video showing how we use the platform for our L&D program. Please let me know if you have any questions or requests.Thanks,Don EMAIL SECURITY WARNING: This message originated from outside of Sage Hospitality Group. Please DO NOT reply to, open attachments from, or click on URLs from unknown and untrusted sources. Use the phishing report button or forward to phishing@sagehospitalitygroup.com EMAIL SECURITY WARNING: Hey Lauren, how are you? I see you use Asana today. I had my L&D team build out a quick video showing how we use the platform for our L&D program. Please let me know if you have any questions or requests.Thanks,Don Hey Lauren, how are you? I see you use Asana today. I had my L&D team build out a quick video showing how we use the platform for our L&D program. Please let me know if you have any questions or requests.Thanks,Don I see you use Asana today. I had my L&D team build out a quick video showing how we use the platform for our L&D program. Please let me know if you have any questions or requests. Thanks, Don
                      Attachments:
                      • Asana for L&D.mp4

                      Headers

                      Key Value
                      authentication-resultsspf=pass (sender IP is 209.85.208.196) smtp.mailfrom=asana.com; dkim=pass (signature was verified) header.d=asana.com;dmarc=pass action=none header.from=asana.com;compauth=pass reason=100
                      dateThu, 03 Oct 2024 14:07:12 -0400
                      dkim-signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=asana.com; s=google; t=1727978845; x=1728583645; darn=sagehospitalitygroup.com; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=pjnjciFq8xBMWBXq2LsYA4nLfilHbajlyslxBvva7oo=; b=mKHXPSwZEzw9bBDiyRre3bjF+XRdqDutO2F49bRBv7L+wfIuPcRuaPZy+US8w+rtpH DhakbblYCgC+7D4p2dxLZ65jZPfHBHz+2OAJXidnhU5QT2wxfyZ41/4sXbogydq+aChM JayPTM/8JRB7vISGWeh/dCbfOahyOHP4j3iC1/oK8FP55S7yY/WvPddCVCRGhGzR7xU2 /LQpzn5/bbMS9cCysaTfKRnHKuGoXPGpRRkAF30i0uLelMXBXq2zampUXDaEpa3mMK2Z lZifcikHUMFh9jkyWT/IS7o1+A67mHbxCDut1aT/IhLbCNlKgWPe9cloQJ9bPTeHmOB+ FwnA==
                      fromDon Deschene <dondeschene@asana.com>
                      message-id <CA+3wvQ-S1q-p_y5qoKOCjzFFAyvgSZUk78FUc1byCAJgeY+UDg@mail.gmail.com>
                      mime-version1.0
                      receivedfrom PH7PR08MB8356.namprd08.prod.outlook.com (::1) by BL3PR08MB7297.namprd08.prod.outlook.com with HTTPS; Thu, 3 Oct 2024 18:07:36 +0000, from CH2PR19CA0029.namprd19.prod.outlook.com (2603:10b6:610:4d::39) by PH7PR08MB8356.namprd08.prod.outlook.com (2603:10b6:510:15b::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8026.16; Thu, 3 Oct 2024 18:07:28 +0000, from CH3PEPF00000015.namprd21.prod.outlook.com (2603:10b6:610:4d:cafe::b) by CH2PR19CA0029.outlook.office365.com (2603:10b6:610:4d::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8026.18 via Frontend Transport; Thu, 3 Oct 2024 18:07:27 +0000, from mail-lj1-f196.google.com (209.85.208.196) by CH3PEPF00000015.mail.protection.outlook.com (10.167.244.120) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8048.2 via Frontend Transport; Thu, 3 Oct 2024 18:07:27 +0000, by mail-lj1-f196.google.com with SMTP id 38308e7fff4ca-2fadc95ccfcso15509341fa.1 for <lauren.dorbin@sagehospitalitygroup.com>; Thu, 03 Oct 2024 11:07:27 -0700 (PDT)
                      received-spfPass (protection.outlook.com: domain of asana.com designates 209.85.208.196 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.208.196; helo=mail-lj1-f196.google.com; pr=C
                      return-pathdondeschene@asana.com
                      subjectLauren: how we operationalize L&D
                      tolauren.dorbin@sagehospitalitygroup.com
                      x-eopattributedmessage0
                      x-eoptenantattributedmessage9bbaa4aa-e7b8-47b3-9df5-75e2d65b5bca:0
                      x-forefront-antispam-reportCIP:209.85.208.196;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-lj1-f196.google.com;PTR:mail-lj1-f196.google.com;CAT:NONE;SFS:(13230040)(12012899012)(69100299015)(43022699015)(5073199012);DIR:INB;
                      x-gm-message-stateAOJu0YxlRGpC0kZXcplEXaKNcMrMGDnO5ti9SgBP5YzV8vEcaRfhJyt5 eNYI/TeGse46FERefMhRJwhz7Z7s4Rv/8xi+Af2qcc31YSzVzlZjAK/Y6/r1n75XfhJd9d6/fR+ uIHqrc45oYWzVUmcRQxyxuGl0+l+NHDTWC/c6+XwdI3aNvRQxmoJxRA==
                      x-google-dkim-signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1727978845; x=1728583645; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=pjnjciFq8xBMWBXq2LsYA4nLfilHbajlyslxBvva7oo=; b=aBZhnVDzdI3PCb4gYfQz8hAiY/YYfz+Z8+gIkr8S8je5dNxHYpR/HBag2CgOH0BjgV fPIsqJ9/EIvwfmGomLIgqqms5UtDH9MX91fb+GjHWf07HhBXz9hgzSEUfyivRgpbN8cL unHqvFJ4nct0oFHQ3Og0iInbu0cij2TygnBUukL4q4DldydSYpvkZKPmQJfvLp/OaTE8 0mfsj53sKEGQb4Km1gk4zBUbU9EddUs8kRckfaReHYUbT3Hn67h9DLA9R7XczMyiNJy8 4cFomyS3T4m9vvheJA9appEmKk02G3k0SrqUAMSbhOj4HgywMJ+cb0qxVGw5YQLGUqXq O8sg==
                      x-google-smtp-sourceAGHT+IG4bi2HMWD33wAwyw3L9s5VT2Y40F5h6oKyV1FEdLGcPjXPIdJawKWdvY2dKuzSELW3Yc4xzq/iL7hqunCb+mw=
                      x-microsoft-antispam BCL:0;ARA:13230040|12012899012|69100299015|43022699015|5073199012;
                      x-microsoft-antispam-mailbox-deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                      x-microsoft-antispam-message-info4YO0h5ZrRBAbXdXAJg+kVBfWgnXsPVTys7bXL768TZb39yGKA9g28K+51YcPyzyDRjbxIS/i+BgXb3nLEZ+cmXf9hKiqO8kUdQXAQgO1ZO1aRrGMufQwLRnsYVC3AHH1ZwG+gSqz1qqVfMkRJ10ZdrTfyl0G1voMQj4YepGw81DA+C9YEE35oKWfRMtCypqCQgGmmVabxoPuHVFWOu5lrdnJf8GMp13Q3H8FKgH01XeP0pwou44zVlwLBHKY8ITZCJ1NqrTC7JgB005uKHAgMRgXRKcSgshG1GJV+rVt5hYmeCQsQsUU96PLrB1kU7R2O1zgZ1wy70nmQiILnqFpNTSuXI99zj73nCMnY4TyziMTIH2cAPqVH0pU2AlX8z51ZwIXP6kGXhMCcWcFx8viFWvaj0giCJSOyg+KaahCNIDjNARHiuBNWKqGEgTKHeacr4ZkuaH/HdC1hkZ2203vv0cmNw1c1l1AySzwx5kw5BbGnzj6vF/xyPvNgg/+UU3agHS1WBt+7usA0aB3kgDVSErVlVv5Ti49ODIJ7SgUJVt+focKiK0AbnbJMbNXkbL7Wp61xkGkoL9sIJ8J+Qj86/jEU5t7DwHkuRrehaGu08E0clYjughKsoxa55EowQENErDopRqkqyO9IalGAL1FmhgdhWvhvbB9DIV90KxQuQ+VRrxEkQy9KG1JZ7LDI3q95zluZeTyd9/P6Cu7PUESzSF1RZbCS3RX2D6tw0p5w7jtLHN8kGPgG6EiJVXabECyOby9OFGr1BxKgUYZDlgU2LjOSGxRnuKOTI3yqhJtAyhgVaaIht86mbn57erjHrbSo4FV5VCj9yV6Zs59D4rPj2UMdESJ1YwxYzDz35jSAkLYHBO5Ps68MRJFExc0T702oiK6n8zDF+kmY44TmY9FO4jrhq+Qbx09USLLO6ai4Saj1umz5g1qz3RgzAq2FM47LVJCoURNuVRlxm/nTDASiIYl3QEfXRoQDOJWzLeTy+L/1prS9O3WK9/BlDRkF2mv49P4vqkn6JHpuhdyK5q4McXHtB8BrBfI3QefCnYtCmnY8/HXb6G+7Gzl6TAQlk8XPTsXGlZVeqMURXBVQT+Va+DRSLePxi9fFv4Pipw+2qCUZpSQhI3ubO/wj7e3ZpvojWHU4YH7GrNHaIcqkpc1A7WUx3AJvdvFyXmWLp49MsWdkhV7pfT66WSior3VB9QCFeUZB4+m2/5dDRzpZUXiOQCVARBO3wi3n/zBpq70bn+FoDvh7pKdSDQvY72murSwM565B9o0j6ND06DqyzSVez7pd9pCAKIo7t6cGMtveO2t/Di2QpnKqQEUEVQosJbn58GV0h9zrzQ3ENSgMLePY6+xfwC02+E2lMJ6DspwIXNRWX2JyanNnTen0Bo9Hm/Ca6/h4SPw+0YajZ/mNquEdZDjJIoQ3+gziOGAGbdM3GpDeVb5g23LhDbNlWX0hm5yuYSCAirCL2cjQDmJt1HvMEaZtfH9X8n19d98RtdWtsXuN7sLacCoEoXUAOolGJhJXW79ybvTzkK/29YsWjLm4Kjyz6wh2h4Ywley9L/me2x7eXSNFkJP/C/h42d1GjWENpvr6iwlnl0AZX5Q94Yg6pCGrChsQO3AAL47CnsbesLV47HG1e8mIidCK19rYbIc/PyWNcW5l1MfZd/zLoIs2vwVCeaSnlESyYIZJt4a8s3Ov7F8hj3ifLPh4m8ebxDvA0p8rhg4ilYDzkxIfjsykh3lZ2ar/dODz3ZwkgJdtdOhMODu91NdfpATRuXRRGOXXUp5Gat255McgqMNlBF9eCVeF6F8hwSS6nc6Xv6F8eEKRNbWD8erz5d/dcfc8I7GLFzjsIztuz7or7s3172UvJYJ1O74uEizZdVmyfGjjinDaZu9DW43C6onRDuqYq5BShvHx76lCbsUBoRJ3FDiDw==
                      x-ms-exchange-crosstenant-authasAnonymous
                      x-ms-exchange-crosstenant-authsource CH3PEPF00000015.namprd21.prod.outlook.com
                      x-ms-exchange-crosstenant-fromentityheaderInternet
                      x-ms-exchange-crosstenant-id9bbaa4aa-e7b8-47b3-9df5-75e2d65b5bca
                      x-ms-exchange-crosstenant-network-message-id dadbd20e-3e10-4b59-adba-08dce3d63d77
                      x-ms-exchange-crosstenant-originalarrivaltime03 Oct 2024 18:07:27.3527 (UTC)
                      x-ms-exchange-organization-authasAnonymous
                      x-ms-exchange-organization-authsource CH3PEPF00000015.namprd21.prod.outlook.com
                      x-ms-exchange-organization-expirationinterval1:00:00:00.0000000
                      x-ms-exchange-organization-expirationintervalreasonOriginalSubmit
                      x-ms-exchange-organization-expirationstarttime 03 Oct 2024 18:07:27.3527 (UTC)
                      x-ms-exchange-organization-expirationstarttimereasonOriginalSubmit
                      x-ms-exchange-organization-messagedirectionalityIncoming
                      x-ms-exchange-organization-network-message-id dadbd20e-3e10-4b59-adba-08dce3d63d77
                      x-ms-exchange-organization-scl1
                      x-ms-exchange-processed-by-bccfoldering15.20.8026.016
                      x-ms-exchange-transport-crosstenantheadersstampedPH7PR08MB8356
                      x-ms-exchange-transport-endtoendlatency00:00:09.1356286
                      x-ms-office365-filtering-correlation-iddadbd20e-3e10-4b59-adba-08dce3d63d77
                      x-ms-publictraffictypeEmail
                      x-ms-traffictypediagnostic CH3PEPF00000015:EE_|PH7PR08MB8356:EE_|BL3PR08MB7297:EE_
                      x-receivedby 2002:a2e:751:0:b0:2fa:dce8:7387 with SMTP id 38308e7fff4ca-2fae107f75bmr39065121fa.32.1727978843657; Thu, 03 Oct 2024 11:07:23 -0700 (PDT)
                      Content-Typemultipart/mixed; boundary="===============3079193903460920391=="

                      File Icon

                      Icon Hash:46070c0a8e0c67d6

                      Network Behavior

                      ⊘No network behavior found

                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:1
                      Start time:15:27:54
                      Start date:03/10/2024
                      Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                      Wow64 process (32bit):true
                      Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\k00TVl4c.eml"
                      Imagebase:0x710000
                      File size:34'446'744 bytes
                      MD5 hash:91A5292942864110ED734005B7E005C0
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false

                      General

                      Target ID:3
                      Start time:15:28:00
                      Start date:03/10/2024
                      Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "3BB57A76-8FFC-49E2-93B8-6E8E0B040F0E" "4630675F-B973-4CD4-89FB-34ED094E70F6" "7568" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                      Imagebase:0x7ff700c20000
                      File size:710'048 bytes
                      MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Reputation:high
                      Has exited:false

                      Disassembly

                      ⊘No disassembly