Edit tour

Windows Analysis Report
Michelle.eml

Overview

General Information

Sample name:	Michelle.eml
Analysis ID:	1537097
MD5:	b2f54cba8f941e8665991a0d2a5a29d3
SHA1:	d1e7d788c6ca00519ced074d598ced8c52cdb2dd
SHA256:	97f32de8aedf210eaa827f8a55cb1d782b87d51a6a58ceaee0ae02beaf6c2a90
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected potential phishing Email

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores large binary data to the registry

Classification

Process Tree

System is w10x64

OUTLOOK.EXE (PID: 7296 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Michelle.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 7592 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5D65D9C5-9AF3-4381-97E4-E7108CDBB5CA" "2287A218-4331-4E4B-8810-C36F28803482" "7296" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7296, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.office.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://api.scheduler.
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://app.powerbi.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://augloop.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://canary.designerapp.
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.entity.
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://clients.config.office.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cortana.ai
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://cr.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://d.docs.live.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://directory.services.
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ecs.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://graph.windows.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://invites.office.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl.0.dr, 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://login.windows.local
Source: OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl.0.dr	String found in binary or memory: https://login.windows.localK(
Source: OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl.0.dr	String found in binary or memory: https://login.windows.localnull
Source: OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl.0.dr	String found in binary or memory: https://login.windows.localnullT
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://management.azure.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://management.azure.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://mss.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://outlook.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://service.powerapps.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://substrate.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://tasks.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	String found in binary or memory: https://www.yammer.com

Source: classification engine

Classification label: sus21.winEML@3/14@0/0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Michelle.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5D65D9C5-9AF3-4381-97E4-E7108CDBB5CA" "2287A218-4331-4E4B-8810-C36F28803482" "7296" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5D65D9C5-9AF3-4381-97E4-E7108CDBB5CA" "2287A218-4331-4E4B-8810-C36F28803482" "7296" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected potential phishing Email

Source: Email

JoeBoxAI: Detected potential phishing email: The email is repetitive, with the same message repeated multiple times, which is unusual for a legitimate email.

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://api.diagnosticssdf.office.com	0%	URL Reputation	safe
https://login.microsoftonline.com/	0%	URL Reputation	safe
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://api.addins.omex.office.net/appinfo/query	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/tenantassociationkey	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/imports	0%	URL Reputation	safe
https://cloudfiles.onenote.com/upload.aspx	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://entitlement.diagnosticssdf.office.com	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
https://ic3.teams.office.com	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://portal.office.com/account/?ref=ClientMeControl	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://graph.ppe.windows.net	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://globaldisco.crm.dynamics.com	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.diagnosticssdf.office.com/v2/feedback	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://analysis.windows.net/powerbi/api	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
https://outlook.office365.com/autodiscover/autodiscover.json	0%	URL Reputation	safe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://officepyservice.office.net/service.functionality	0%	URL Reputation	safe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	0%	URL Reputation	safe
https://templatesmetadata.office.net/	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://messaging.lifecycle.office.com/	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://mss.office.com	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://management.azure.com	0%	URL Reputation	safe
https://outlook.office365.com	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://incidents.diagnostics.office.com	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://insertmedia.bing.office.net/odc/insertmedia	0%	URL Reputation	safe
https://outlook.office365.com/api/v1.0/me/Activities	0%	URL Reputation	safe
https://api.office.net	0%	URL Reputation	safe
https://incidents.diagnosticssdf.office.com	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/android/policies	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://shell.suite.office.com:1443	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/connectors	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://login.windows.localnull	OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl.0.dr	false		unknown
https://powerlift.acompli.net	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://cortana.ai	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/imports	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://cloudfiles.onenote.com/upload.aspx	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnosticssdf.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://ic3.teams.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.microsoftstream.com/api/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false		unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://cr.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false		unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false		unknown
https://portal.office.com/account/?ref=ClientMeControl	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://graph.ppe.windows.net	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.scheduler.	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false		unknown
https://store.office.cn/addinstemplate	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false		unknown
https://globaldisco.crm.dynamics.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://dataservice.o365filtering.com/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://prod-global-autodetect.acompli.net/autodetect	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://login.windows.localnullT	OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl.0.dr	false		unknown
https://d.docs.live.net	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false		unknown
https://safelinks.protection.outlook.com/api/GetPolicy	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false		unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://apis.live.net/v5.0/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://officepyservice.office.net/service.functionality	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://templatesmetadata.office.net/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://messaging.lifecycle.office.com/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://mss.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://management.azure.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://wus2.contentsync.	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://make.powerautomate.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://api.office.net	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnosticssdf.office.com	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://asgsmsproxyapi.azurewebsites.net/	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	177D8AD1-CC04-4B63-8A28-CC486E415E2F.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537097
Start date and time:	2024-10-18 15:08:52 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Michelle.eml
Detection:	SUS
Classification:	sus21.winEML@3/14@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 52.109.28.47, 2.19.126.151, 2.19.126.160, 93.184.221.240, 52.168.117.170
Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, eur.roaming1.live.com.akadns.net, wu.azureedge.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, officeclient.microsoft.com, wu-b-net.trafficmanager.net, onedscolprdeus13.eastus.cloudapp.azure.com, a1864.dscd.akamai.net, ecs.office.com, self-events-data.trafficmanager.net, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, wu.ec.azureedge.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, uks-azsc-000.roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Michelle.eml

Input	Output
URL: Model: claude-3-5-sonnet-20240620	{ "explanation": [ "The email is repetitive, with the same message repeated multiple times, which is unusual for a legitimate email.", "The sender's email address (pmatthew9810@gmail.com) does not match the name (James Orford) used in the signature.", "The request to confirm a WhatsApp number for 'briefing details' is suspicious and could be an attempt to gather personal information." ], "phishing": true, "confidence": 9 }
Is this email content a phishing attempt? Please respond only in valid JSON format: Email content converted to JSON: { "date": "Fri, 18 Oct 2024 00:15:51 -0700", "subject": "Michelle", "communications": [ " Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details. Kind Regards, James Orford Sent from my iPad." ], "from": "James Orford <pmatthew9810@gmail.com>", "to": "Michelle Phillips <MichelleP@lombardins.com>" }
URL: Email Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Kindly confirm your WhatsApp number here for briefing details.", "prominent_button_name": "unknown", "text_input_field_labels": [ "WhatsApp number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: Email Model: claude-3-haiku-20240307	```json { "brands": [] }
	```json { "brands": [] }

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.464271724633458
Encrypted:	false
SSDEEP:	6:kKhrmr8K33JFN+SkQlPlEGYRMY9z+s3Ql2DUevat:Z+rckPlE99SCQl2DUevat
MD5:	DF4D7177FD3536CB3A3433D2F899BE59
SHA1:	5283138CFB2B6EC9E6DAC0DE7069A51DA781ADA9
SHA-256:	81E2DFD618DB53F1F8C9617AAFDF813A96A840D6C2C1030D3F8D6E1E63F6096C
SHA-512:	20B3BBD22A7256467326EC6497BE492B0E1DB66ABD277BB9F01D9CF938B2787C7C0315DDEFB6DD68BB295F0603AB49DFBDEB0B4898131B0D7BF1049DE8679DF8
Malicious:	false
Reputation:	low
Preview:	p...... ........i..._!..(...............................................POj.@... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.392387151874829
Encrypted:	false
SSDEEP:	1536:H+YLzqgskOwLJD+GqWgs65NcAz79ysQqt2te2MqoQomVrcm0FvyEwLywwYxPE6+F:NWgVaygBmiGu2uqoQ5rt0FvxYDOz33V7
MD5:	6A733B85D0A966444D1259EE3F9AAA3E
SHA1:	4F7E974C70CFDB4405E10A40192B5D0C58230D58
SHA-256:	4C2654871C500D134125D40FA75ABFAC20901E43176CB16EE1B733B33A8EA731
SHA-512:	5FFB4AAB09DE71A0E93F9A7753AA7C01AA4C35C7F8D5DEB605AC3F88F98DB6118E9890260FC704C6CFA8E028E67F07E31BC8480E960154B2BC2B6B0EC75C8863
Malicious:	false
Reputation:	low
Preview:	TH02...... .P.q.^!......SM01X...,...p+c.^!..........IPM.Activity...........h...............h............H..hD........lP....h............H..h\jon ...ppDa...h@...0..........h.w.............h........_`.j...h.t..@...I..v...h....H...8..j...0....T...............d.........2h...............k..............!h.............. h.JpQ..........#h....8.........$h........8....."hH.............'h..............1h.w..<.........0h....4.....j../h....h......jH..h....p...D.....-h ............+hPv......8................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\177D8AD1-CC04-4B63-8A28-CC486E415E2F

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178267
Entropy (8bit):	5.290289008522339
Encrypted:	false
SSDEEP:	1536:+i2XfRAqFbH41gwEwLe7HW8QM/o/NMdcAZl1p5ihs7EXXDEAD2Odago:ICe7HW8QM/o/TXgk9o
MD5:	6E5F5F3E5959AEF80872174D06781A36
SHA1:	31C4AF1630E4E4F98BEE8DC60E4B97C636DA5415
SHA-256:	0E47838A1B3BD21B29DA49074AA308D0ECE2FD16A8C21116488484272D71C8A6
SHA-512:	196579C2079A5A44489CDC06D22A1C63336DB046C21AAF9F83D025D8B1590DA317A3B088D9D2E02328FF41966A5898ACB04D0B1B48F38E940B441E6DFED20911
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-18T13:09:54">.. Build: 16.0.18209.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpF/4llfll:l9F8E0/
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13673511612852962
Encrypted:	false
SSDEEP:	3:7FEG2l+rMrQ/FllkpMRgSWbNFl/sl+ltlslVlllfllbM:7+/lVEg9bNFlEs1EP/Y
MD5:	2011950EEF8EF20D20C65AAC828872A5
SHA1:	536D606B1DAE944B7903F279327A2818273F7A75
SHA-256:	EBA66FB84004985CCDC96A50910D4BB524B6ADD957D1B4747FBA441F59ADC6DB
SHA-512:	BAB46E1755756B1E81156139FCCB0D809F34A09160E20B71B09853D2239E0D98AA131F9ACD43B569AA4632C3D0EEAFC9F70242BAAA0DF6E14302670DA8497AC2
Malicious:	false
Reputation:	low
Preview:	.... .c......).)....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0445382698033491
Encrypted:	false
SSDEEP:	3:G4l2XByZNcMjlICl2XByZNcMj/mlL9//Xlvlll1lllwlvlllglbXdbllAlldl+l:G4l2iNcoNl2iNciSL9XXPH4l942U
MD5:	C3E1F091C2EEEE7248F218C91EE52664
SHA1:	F52E398967FFF271A6DC5F442FC8707918BBA3AE
SHA-256:	15757A00E5CCEE3D98168EABDB59EFDEF2DBDFF638EA4DF52BE1CF062DD62D77
SHA-512:	F7FC1AEF2875EC023753F0EC4E400B961C44FE836A6758DB1B5EBFEEB5B98F91CEB193268337C17897936BE068D531F96C95D17A4B37E5D20B63D94645754663
Malicious:	false
Reputation:	low
Preview:	..-......................@...-o..9.s......W2...8..-......................@...-o..9.s......W2...8........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	45352
Entropy (8bit):	0.3934745605085469
Encrypted:	false
SSDEEP:	24:K8lqNDQ3zRDMNp5Ull7DBtDi4kZERDMPSkzqt8VtbDBtDi4kZERDMQ:dlqNDQ1gNp5Ull7DYMgqkzO8VFDYMgQ
MD5:	CE5CF3E4412A0281A9AC8F6B88F5DA50
SHA1:	4699D206B18C79C12ADE1F03C193573059DA1DB2
SHA-256:	96D28C4666F67D5A648143999001D80651BD29EC8D80B1DE56379D38776D014F
SHA-512:	363FFAD198BB8759C81AE302F78C03693490AEF73E4BB901C955FB74D0391B27BCD98B74B0C5EB3E19C334C21E8C743CFFCA2F90D4171BE285712D0701602A2E
Malicious:	false
Reputation:	low
Preview:	7....-...........9.s....Hw=....a.........9.s........e...SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729256992086725700_06CC28A1-8FD1-481B-92F3-7CE4D64AFDA3.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (858), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0071086307977221526
Encrypted:	false
SSDEEP:	384:Y8fWgcHTe7LTvc5jd3yBEWI0gK55oa2k/16TBHU:pf3kTwDKjwBTaCoaF9KB0
MD5:	02FFBB7831FD7D36D0FC9DFC40B72802
SHA1:	379EF44C5EED68F862BCE3221DC4B3C5BDC2E09D
SHA-256:	018BBE0F207EF3EC7934138171BC7646904C7658D35B588123C76B38DD6704E9
SHA-512:	DF53B3AEF0C0E1E249BA245BCA5C3A39942C3BF5F4D689739C04291D87FAC717123DBC37D4884D2C4BDA31167BF071AE9BCAD59384F86D411F141375D25D17E9
Malicious:	false
Reputation:	low
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/18/2024 13:09:52.142.OUTLOOK (0x1C80).0x1C84.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-10-18T13:09:52.142Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"70A5A784-0EF9-4609-8B30-8211985503EB","Data.PreviousSessionInitTime":"2024-10-18T13:09:32.286Z","Data.PreviousSessionUninitTime":"2024-10-18T13:09:35.677Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...10/18/2024 13:09:52.204.OUTLOOK (0x1C80).0x1D58.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":23

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729256992088472400_06CC28A1-8FD1-481B-92F3-7CE4D64AFDA3.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	4.693659303520656
Encrypted:	false
SSDEEP:	3072:I4wcVGyNxMzpV/EjLRNkXLYV53ryH1e8+m9:PMzpV/EjLRNGYV53ryH1e8+E
MD5:	8671323ECFFCE35AFC180062C0DF5C74
SHA1:	0600BAD3B350DAD587F3A33438970214E8BC4C88
SHA-256:	ADB8AA7DBC8C21F129CFF336951A635979D6173498E298F24654EA49A38BFBCA
SHA-512:	7070ABAEE21B590069B43AF35498C6B270006E981973A128C4192F84EF04FB6066C78EB5BE1843D11822A66884DF45DD9BBC8D54C20EC5BA1B961C5C686A06B6
Malicious:	false
Preview:	............................................................................b...........@.i._!..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................`..............@.i._!..........v.2._.O.U.T.L.O.O.K.:.1.c.8.0.:.9.7.7.f.b.c.0.4.6.b.c.c.4.7.d.d.b.9.f.b.d.c.6.4.0.9.5.b.4.3.5.c...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.1.8.T.0.9.0.9.5.1.0.7.2.0.-.7.2.9.6...e.t.l.............P.P...........l._!..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:XZnrt:
MD5:	EA1A9317D202DBDA7A77402DAEFDA22A
SHA1:	7559A18D43DD097020811BBE1C4B3758649C48B8
SHA-256:	DB212F875170CAB0F8F2DBC0505A32D9973C5B3F8B696EA14B967C79F4159829
SHA-512:	2706F3A4B54DBFA8FED4FA38F6FDA3AFD2F2BC10E282068A6490061C119A7DC422680BDB8D31E500E0FE43CCEED102A75F22A5F9C7A50B1EF700183D274AF3BD
Malicious:	false
Preview:	....`.........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6698610431126559
Encrypted:	false
SSDEEP:	12:rl3baFACqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheCT:rbmnq1Py961T
MD5:	E978D1DF38E4F711991161A05DC5DA0E
SHA1:	E68184821E2B1B1AC796FA7F8A0E469A0C885DAC
SHA-256:	7D6A5107427B71237DCDB6AB98729FA53C6690F1443A90B664A48D4A60120429
SHA-512:	9B5E8A9961D4FF3EDA3E1677DE455D4AB6DE0425DD396BBC426E15F212C6B25DF45A40D87A0BFFDF6A4787F4D8C93F7B1D2674F2E25B02771B0E812295A3144F
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	2.935782727348851
Encrypted:	false
SSDEEP:	1536:BnTisg982d7a1hvaQDIqNqgZNYuRMHFRCgPa+y5N3BlAeKlW53jEpEHPVQ10BAwL:J5g9n7aHf7YZ6Ia+Wapjsapj
MD5:	E0A0D707B1DA7344CFABA70CA2D4315E
SHA1:	D2D853294F17FAE5D94F126601A84EA2EEE5E92A
SHA-256:	2E5C7C80C4AA6494302EBE63D4E29463C8621DCD42ED88594627C8B79DCE679B
SHA-512:	8463A248E36882BFBFC4E7CEA9A317955BD2B8055E82A5DD1312F17EB01B2180BD7FA007043161AF49E965D2462D311C551D4DE26081C2E8632D55BE7A476DC3
Malicious:	true
Preview:	!BDN.dZ.SM......\...............H.......a................@...........@...@...................................@...........................................................................$.......D......@Y..............C...............G...................................................................................................................................................................................................................................................................................................rC.d."......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.3507946609559438
Encrypted:	false
SSDEEP:	768:Z3amEpAHRHPVQ10BAwr1suU10673n62D4e:Z3jEpEHPVQ10BAwr1suT0n
MD5:	49232CC6EEB56586190E96DDE2563452
SHA1:	5DB1A3ADA090A4899BBE3E66066C558C148EE7E2
SHA-256:	9CC434FEBB7B466FA87666E4EDC19C16E2940E1ED708501F6EA71DF2B3C20C45
SHA-512:	F35174D7FFBC31533C531D2B311344C357ACBCF99601937144F4CCA8C0B918FA2B8C2BF677FE996E8814EE2341A8E119330C3C71AB60FB4D86EB881850AC6A8C
Malicious:	true
Preview:	$F.n0...m.............H._!.......D............#.............................................................................................................................................................................................?.........................................................................................................................................................................................................................................................................................................................c&.D........M.0...n.............H._!.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
Entropy (8bit):	6.080394709158285
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	Michelle.eml
File size:	22'720 bytes
MD5:	b2f54cba8f941e8665991a0d2a5a29d3
SHA1:	d1e7d788c6ca00519ced074d598ced8c52cdb2dd
SHA256:	97f32de8aedf210eaa827f8a55cb1d782b87d51a6a58ceaee0ae02beaf6c2a90
SHA512:	cb8f7655491792d35f7ee192594bece2f08e420c69d89db3f64d5e89219a2e2afc8a3794bca60212e964b73032ce580fe23f29e3b661c7c47925e011a37d3f32
SSDEEP:	384:DuGEICBnYlqG9IRMOeXzxJBm0zDG3pSyegZUAz3Jt4O:xEKlqGKRMOeXzxe0zaZSyd3MO
TLSH:	AAA24A115261142BE7909195BD205C125271FA81B4BFE4D07E6FA6BE27CF43EBE32C4B
File Content Preview:	Received: from PA1P192MB2299.EURP192.PROD.OUTLOOK.COM.. (2603:10a6:102:45c::7) by PR3P192MB0779.EURP192.PROD.OUTLOOK.COM with.. HTTPS; Fri, 18 Oct 2024 10:09:11 +0000..Received: from AS9PR05CA0015.eurprd05.prod.outlook.com.. (2603:10a6:20b:488::14) by PA1

Static Mail

General

Subject:	Michelle
From:	James Orford <pmatthew9810@gmail.com>
To:	Michelle Phillips <MichelleP@lombardins.com>
Cc:
BCC:
Date:	Fri, 18 Oct 2024 00:15:51 -0700
Communications:	Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details.Kind Regards,James OrfordSent from my iPad. Hello Michelle Are you in the office today? Keep me posted if you're available. I need you to carry out a quick task for me. Kindly re-confirm your WhatsApp number here for briefing details. Kind Regards, James Orford Sent from my iPad.
Attachments:

Headers

Key	Value
Received	by mail-ej1-f50.google.com with SMTP id a640c23a62f3a-a991fedbd04so113836966b.3 for <michellep@lombardins.com>; Fri, 18 Oct 2024 00:16:04 -0700 (PDT)
Authentication-Results	spf=softfail (sender IP is 34.250.90.89) smtp.mailfrom=gmail.com; dkim=pass (signature was verified) header.d=5ppzzkx51y4vkiyoc990.c.eu1.defend.egress.com;dmarc=fail action=none header.from=gmail.com
Received-Spf	SoftFail (protection.outlook.com: domain of transitioning gmail.com discourages use of 41.74.197.102 as permitted sender)
Arc-Seal	i=1; s=201903; d=dkim.mimecast.com; t=1729246141; a=rsa-sha256; cv=none; b=prm5OsiUJ7hJF1haZxoQRDNYAOs0C3r/O07Y0vM+NEhPL3W84MCznknA+1H6mU09HKdKTg qQUWroew+fFdCA2IWcdSxkzqWNon5VLbmbn8nkHwbUhRRds0wIPGPo+sdjtX1dj0TGe3ju czDPXxQUo/6jvUak5juEIw8L+avFTcKdKpRBBbM+vIIlrMVH/Ns3K1UvcIoQ6ETk/caiDL pwt+BUNcnkZpveKPi8zko3JVafqJn4abZ3hyFUwF7SOlZoS5XCfS6AVLVGRYH0LVaAcD5L ByJ0sY7FY0aPin1REofrpXnID4AI9NyT5cxM3fzsH09T5r6jZ10Tiy1dA9Oedw==
Arc-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=dkim.mimecast.com; s=201903; t=1729246141; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: dkim-signature; bh=JYDFpNebxWiK+Cov73nNkkwfL2TzcEFH+4ElxbT3bjc=; b=InJuzpcIp7cSBVeg9gxVPy1I7JuekdhVWX7NRLTnOjKTXg/xJ2VBOSUTnIR5vmTA96f97S dRhIZ6yj6fzpQ6Qso5+3PJxQyISxebvqnbwxHYUNxG4rvZGEVuT6Y5qDJTYW/APYDcmVFg 2x/vIZD9AdsYPWpynXwLeWtXB3zBFpnlvdPTsNqIv/wCDVDjheSUXcgKRPsSTbH67aj9hY wGeE5JvVOxLDywhN3jnRpHC5H/6xtEr9yfxGRK5ur/pDicClk/vOPPrUKWq4DxRzRs2NKc icIVony3EpQFnL2BDfDOOS/NYpgy5GViXtYqra3YmfXbs1VAvN0b8bLPQ8QFoA==
Arc-Authentication-Results	i=1; relay.mimecast.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=XwQdDfI2; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (relay.mimecast.com: domain of pmatthew9810@gmail.com designates 209.85.218.50 as permitted sender) smtp.mailfrom=pmatthew9810@gmail.com
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1729235762; x=1729840562; darn=lombardins.com; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=zA2bgUmBwdT3Mpna7N1ZbPwI83+TwpS4gI+S4hfNcQE=; b=XwQdDfI2TsbB/eTdC3wRr8anjKu5fr3lfLIHgDYHkctoiB5NueAEZcf13FhFTAcdf6 MbKIZKLSbwiEOUpEH5UwF0pv1QEJbTj36m9AhfmFwNtVptXWDanfeEdUXmeuHCUuV5Le gW7EpZmeszVqr49CpYTJ/un3/AXaNeZJqPVJaleSLhftuNNake2YFbG023YqZE3zwaWm DtyAOd+KmG2csQk4l3dT9xoqlVztUzgPpf37GY0kUk9mjzonJj6rprqqmb+NxtUExk1S PkbrNmj4CdMiBShWmcuaqTKn2xKQZUDuHr+0Fetfzr0L8bW6mRC/z5dTACEpobdQI7nh 2ANw==
Authentication-Results-Original	relay.mimecast.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=XwQdDfI2; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (relay.mimecast.com: domain of pmatthew9810@gmail.com designates 209.85.218.50 as permitted sender) smtp.mailfrom=pmatthew9810@gmail.com
X-Mc-Unique	0XfTFAk4O9SBISo-D1zNlA-1
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729235762; x=1729840562; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=zA2bgUmBwdT3Mpna7N1ZbPwI83+TwpS4gI+S4hfNcQE=; b=HyKapI+ksEH4Dsw6dA9vJflNdJIOdXq7RFkuSqZIAQoYbZR7MKWmLz0Bfy7yEJhQYe sXh/7cx2k2AsduXjXaOF/FMySjwpIMqh1w730kJIhKkevxbTdCR3O6msYMvZz6BbxA5p lFMImeAoyTWRSWMtzpwdFjm8q5mpFc+VeqN3u1ZPnluIZVx/jfIhTUlA5wTukyg5qV7o QyJgj73NRCB8cBL+cgneiCMo4qdfJz/Q/fC8q3xFvyfeE0r/gNsJGGFhXoRmGSLzBwyr +vXrtsZZudLCfTbsIbjTnq9q4gZen6b7nVBKU8ZkgRxPZL02U/NVfGtAsSzWpaXvZbCW A5mQ==
X-Gm-Message-State	AOJu0YxDOlfUx0P5QfBHjeujUF/uldIaHK04P8xtVZs7NqYYq99xfoGN tFhW2eYBbqz36UhB9rGEFxBV/WaEqU5QRLF+0/VrH8gTbS8a8xB1ja9U+KL1Dggj8MuBc/anqDc zeDmjqZlzI1Mm/kGZq5ZjTdjm15HkWyDtBK8ICkcOjIk=
X-Google-Smtp-Source	AGHT+IFLn0dQYKu7hry5gNIi3RMbDYnhl86dCINC8COD6XCM6Lh8QqzAWnkvhs+fSzb7suG0DOy20YspLSNT9jtV7HI=
X-Received	by 2002:a05:6402:1f01:b0:5c9:55aa:4285 with SMTP id 4fb4d7f45d1cf-5ca0af7eae2mr1139404a12.34.1729235762225; Fri, 18 Oct 2024 00:16:02 -0700 (PDT)
From	James Orford <pmatthew9810@gmail.com>
Date	Fri, 18 Oct 2024 00:15:51 -0700
Message-Id	<CALcJ5majXUkK-OOJhsfkZNNCL7Qe8_FUahTqp+GzjUOB4Y-aXg@mail.gmail.com>
Subject	Michelle
To	Michelle Phillips <MichelleP@lombardins.com>
X-Mimecast-Spam-Score	9
X-Mimecast-Impersonation-Protect	Policy= Impersonation Protection;Similar Internal Domain=false;Similar Monitored External Domain=false;Custom External Domain=false;Mimecast External Domain=false;Newly Observed Domain=false;Internal User Name=true;Custom Display Name List=false;Reply-to Address Mismatch=false;Targeted Threat Dictionary=false;Mimecast Threat Dictionary=false;Custom Threat Dictionary=false
Return-Path	pmatthew9810@gmail.com
X-Eopattributedmessage	1
X-Ms-Traffictypediagnostic	DB1PEPF000509F1:EE_\|DU0P192MB1548:EE_\|AM3PEPF00009BA2:EE_\|PA1P192MB2299:EE_\|PR3P192MB0779:EE_
X-Ms-Office365-Filtering-Correlation-Id	6f590d0b-ba50-4e5e-ec5b-08dcef5ce857
X-Egress-Defend-Direction	inbound
X-Egress-Defend-Domain	lombardins.com
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|7093399012\|8096899003
X-Microsoft-Antispam-Message-Info-Original	jjZ2rFJ3mt/edCdqyZSzgWuVr/k39Ow9YiWC3dPYJtI/6WvXY62Sw3fEK0c7InZeKNG48j+/7oyp/CoMdMPfHQ38/8Oro9j3XCzkjoxalG1lZZAhrZuc8V1ytLbCoL94z2alYQsbjpJFxglg5wVtDXrKmatj6npUwff8blZIzW61mcRlH1hgkeiVH/g+sS4fliso6ClOLNC6R5VJuttJ1LLyEv0IBeAz+/inYrgLZqWduy2cI/ypcAHHuUc6scI2IvflWqDVkINsRvIoUhQoSR6+QPviJAZX7EKashy7/veCNynnXtMV7SlzxctEcWqZOgm190f2R+lolcgs1taWlmEns3/YO9yEmw+IgWT0nf7BBYcDPih/zqcDALs5sb9q+yq5j5pfMLgB9HChBWktKbWoRXtg3QbEsYBLvLfP6oPLbgREzdYByGzzqM86Kh+VQvMCmIN8vkNNHYguOzn1T+OUa6RqSIQC6n1ZDIEH71kwBKhZTF2uDiDQCn7u1+t8XroSKrWdOQG3kyDnys9fPj0/hdX4wyFKdxeXUrfBE4tl1+7W0/xGsU4gtq02diokiotimi/nRqmkx6fnlrbCJ1UfYO4xpK3cJr/wGa54kZh1CSpL9Lvrsk9JCsFMC8yPkr/9k0oK0DD/Q4JPcz3pOmKetsPps/m4APMftkhyi9KXMiuQqwJD9auzNQE2A458LJjnaEYrdG1oQ2p0weiUunpKjm0kipX6YNFFHb2qMxngUQwaC5NIMabXQkLX82R598G1VrjXbAnByaAHuorXj6nGq+c/kAHqdZTFRYKZaT3/GOfhWcSqCZG68Z0oq4js6v/3OVSV2J5Hu1i0o6Ay2bfzTz+jg3GMVD/AiwX8kTeKIP/3PI7OndW2BKb/tsi6E928Hh+Q6qjTVnckCt0unMP2x0CUXEiNSjAmBdhAGtiv5JFShRuX2l5WLIXiTP480ldXTfrcnpwVWFYxPiHe9MmskUzq2ye402M0s81E9c0xgz4ZED00w12LUv0bGTbStfrvjby1LQ+sx0gsQ0g9+QLuC7ugKV0Q+28mhgEJidUkzCywqSq+erAbA7Qde4AnEx4dBjFMG85Cm+04EjYEcaZw15/p+0EcJMlZwj9bnx7nWtxqNGwmC9RMElWnY2idVokR4BPtIIIJvM0GV+ZcJUiUcTClnApeQu9Z6+DPnjEWKjQN4YcionXDfITt691kUcoIaS0fIWMPiFADAao4zDSC1h3uEygcxjcAeb5sVGIHUTc2kNQefWAkNdK4jp1IU+e0oy9GR5yw3oGDkrNN/LIQzC8azGu1wXsk1a2NYZ+00kMLHWTiaQVKcIOlUbQQ2BuEv/nJnO0fSF4ol49YQ205D0XMj40DNNy70S6bSEvSGhGvUmgGv6YFGXLDVsQ06YExH22/MiROalaFp2jkbiZowEWW9q8namEwwn8T4yTA5NPBZlKWtO3oPTK/fCTFWUNcg9zmK9EVm5QFYOBtI7eqWzEq6GsVld5KQTXskaWTg4wApni2BBBpKHHJIVSo28oUG+8UtQqsCEycWrBNTL3AN2mBatGcHjR8KpbAkQ703pFRKnc0ehEBxc1VYxoF9ECHXn56OMgMnlppw+4voZR2vCET/LBUzNG6Z6CJY0W1VocdSM9Uzxvx9/8pCa6WyOjCvSZx5aB4AfGffF9HwOEg553oDgHodFCF35x1BaKt65FzY9sDx0Yxm5dkkKgKF7UXvvxnkqXGPTuQHX6uoePkiotDklo4U33LfL2IkGatbfFVY7Uxj45TJqF/ElTwLY52qd5MK756w4u86J2tONUuCBT03Eo2BznNNkgJa0bAGzrRzuC7x/Pfa4syYRN1MDc1MkJSHCh+AvXi3LAkTjas9Bl6I7Ad25v4uZtzPEES5/WMdR+VnDwztq7vLMwI1YhdZqo4Ez7KE9G6xT3Fa0A97uAu1/QBMh1FrCdboqbytyDgTkvSwVEKLdt72x3iGWseAg+LY0KCtiSZLTo4ZHJgRyc5JsEmpnfT41xylA4=
X-Forefront-Antispam-Report-Untrusted	CIP:41.74.197.102;CTRY:ZA;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:za-smtp-inbound-delivery-1.mimecast.co.za;PTR:za-smtp-delivery-1.mimecast.co.za;CAT:NONE;SFS:(13230040)(7093399012)(8096899003);DIR:INB
X-Ms-Exchange-Transport-Crosstenantheadersstamped	PA1P192MB2299
X-Organizationheaderspreserved	DU0P192MB1548.EURP192.PROD.OUTLOOK.COM
X-Ajax-Scl	1
X-Egress-Defend-Scl	1
X-Egress-Defend-Crid	671233c4382c810199d4944d
References	<6cbe555b-d627-49da-b2f0-651c09a1f3f8@5ppzzkx51y4vkiyoc990.c.eu1.defend.egress.com>
X-Processed-By-Ajax	true
X-Processed-By-Egress-Defend	true
X-Sentry-Times-Processed-Count	1
X-Ms-Exchange-Organization-Expirationstarttime	18 Oct 2024 10:09:09.3873 (UTC)
X-Ms-Exchange-Organization-Expirationstarttimereason	OriginalSubmit
X-Ms-Exchange-Organization-Expirationinterval	1:00:00:00.0000000
X-Ms-Exchange-Organization-Expirationintervalreason	OriginalSubmit
X-Ms-Exchange-Organization-Network-Message-Id	6f590d0b-ba50-4e5e-ec5b-08dcef5ce857
X-Ms-Exchange-Organization-Messagedirectionality	Originating
X-Ms-Exchange-Organization-Scl	-1
X-Crosspremisesheaderspromoted	AM3PEPF00009BA2.eurprd04.prod.outlook.com
X-Crosspremisesheadersfiltered	AM3PEPF00009BA2.eurprd04.prod.outlook.com
X-Ms-Exchange-Transport-Crosstenantheadersstripped	AM3PEPF00009BA2.eurprd04.prod.outlook.com
X-Ms-Publictraffictype	Email
X-Ms-Exchange-Organization-Authsource	DB1PEPF000509F1.eurprd03.prod.outlook.com
X-Ms-Exchange-Organization-Authas	Anonymous
X-Originatororg	5ppzzkx51y4vkiyoc990.c.eu1.defend.egress.com
X-Ms-Office365-Filtering-Correlation-Id-Prvs	7a04408a-a8bf-47fe-77e6-08dcef5ce4f1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|35042699022\|82310400026\|7093399012\|8096899003
X-Forefront-Antispam-Report	CIP:34.250.90.89;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:smtp.eu1.defend.egress.com;PTR:smtp.eu1.defend.egress.com;CAT:NONE;SFS:(13230040)(35042699022)(82310400026)(7093399012)(8096899003);DIR:INB
X-Ms-Exchange-Crosstenant-Originalarrivaltime	18 Oct 2024 10:09:09.2467 (UTC)
X-Ms-Exchange-Crosstenant-Network-Message-Id	6f590d0b-ba50-4e5e-ec5b-08dcef5ce857
X-Ms-Exchange-Crosstenant-Id	45081ac3-367f-4bae-aca6-1a87fc2371ff
X-Ms-Exchange-Crosstenant-Originalattributedtenantconnectingip	TenantId=45081ac3-367f-4bae-aca6-1a87fc2371ff;Ip=[34.250.90.89];Helo=[smtp.eu1.defend.egress.com]
X-Ms-Exchange-Crosstenant-Authsource	DB1PEPF000509F1.eurprd03.prod.outlook.com
X-Ms-Exchange-Crosstenant-Authas	Anonymous
X-Ms-Exchange-Crosstenant-Fromentityheader	HybridOnPrem
X-Ms-Exchange-Transport-Endtoendlatency	00:00:02.3672107
X-Ms-Exchange-Processed-By-Bccfoldering	15.20.8069.009
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)
X-Microsoft-Antispam-Message-Info	ihZnyD4uK+2VULTGx8qAni4l/N4JFCiAr0mfYZKEMaWA5W8thZzh8vsCVejBOghZGCKX8lJE3KT8Zu++2KpjfELNJtyRtgvdGmytsuWG4+EGQtO18anzAIBgFU8Z1Om5g2vxgg/AvmBUMrCbW/kT+kGQc7cs5KACGmh8GwPCtTLct6wUo8XasODtdR/Wn58n/n4sBgbmK3Trz6D8JzevIZDmNOv0ocGnXmk//fCbPXhroRpmStrGGCSBy59PesHTRRQBJeUKIMc51BKPHtD3BnhonYWMmoPxvHWtFLSWPHuOSaRuShRBnSiVQ2HLdgK86QhnjVR5kdgo4tHgrR+/95e+x0EtdLSm0TfiNT3K+ISx5POxXVORpALlNrT7qOKjdNVzOh5iKMzuR4IafzXd7EnYgRGjP6e8NytvRzxpuusT1u3wvUauySwNd26I5/e8uHq4F8GaPP6vcvN4PJBDaPDejGdeWZmQpamGE/LsApe9/bPYHTSEQbcz6ot6NIWPYpQZRUxynU+GEXEq1yhPUGz75h78Q2SedtfUPZy1BrtqlCwn5TxvVHUnoWQ+NxbjmX2RCyjn5HO24o3cFUdbwMjs+MQSTE5x2JwmD1leTGcXPdl/bu6tnB394Kn2vNe6hSFQ1u2WqGtkczPtfhVOO97G8O1HdmAy493hwMyhLhVZys+lwGx0ufsjI8UUBEUFWnqopPg5FWUpc4fCCWBRjsvgNf6NjlAjO35ME37dYvmgwHWQIl++WxGTNNBkRPTv9FsIVGqVv17j4QnE0YQafXASSIHSzQ4iiLpK6RDRWkCDvKtOc3CG4GQO5yRsg+eRE5Fw+Jscu5Yj418E3hPolrTBCUEtLrwUBOu0A57s6jf1fK8VeT0mZV0Txv1X6k79BrOf7X9NDRzPXdOIcgloxvPSfcg/Blu6hbQ1qnYEuNaSnqs3z9xnbf/vTagBIfW9N4n+JBNv4qCfBqQ9dvzo8zqYqW8jMXizPar0m+YIC6eaBN6Dur+1i7Mj5+MRz5hhZ77fPWpqyYv7C5obuc0QYExlhiZ3UvrEZtPwvKBLexYw8Wv91UPc+7M46764JxkuQP3F2mdTZNJk5b98ABFZAdGmCkRdXrCOAR35iy0Qf7Dg2Iq/baf4HTUqJ3QgfjdFEq1sgmPGKeuj3l7JqlCcYnLCyhPYP/eoE4jj5N7BPv5Z5oPRjK/siUS//Jf+7imXTgTCVS41R0R56RQjUwUfHfKjyXr9ox6gkJDvqF7gSBq4nZokoxuDF4YeYGA5px7Nvh5S6DrNPgcfB1mVXufQPLbQ5/ivxN1twfHS6oKh4AmAgiru3gikyEEreuQMrtj22aL3q1GzXv9gZYkLn44rBE1LNV23/zUXyhVuOxw6XxykbQX/KOtg/W/F98P0CC3+AEXPm+3Kl0MRlKNS/3mL8fQFYwnp/BzUHrD2+vRFoDp6vgU6T+6mr7JRykKoK8sM8e3W8Bu1rYtefFSQ/3HXwgq/YqvWcb+7phpZC0SEFU67mUIGOfnwgdjcmJ+U6KAipbIM4PBfA4cNBXVzvpafPmMRdKeecrjKAzE7oBbytNdtz9qhg6cutL/Np3TayaFaf2k7wCQ0Zl1Vv9sWvz8oWqJ0pA1xInN5wp7Jf9hQ8s7k+4r9G2FpTrreyTqnXYBm6g77W1YiaGkAx3WP2VeRX/g7jeHonqBCdEz8EyLrn0UJM0S1GoYmZ83W8xlZ4Swechga/hAZ1tGQgJGOTYbj/i7nxGoNjsFtsUiqRQwFrGrOJG6EHvIaRKjE30umF1LNPeMwaVHBOGq7hh7ZHu6XPxxoQ2dXLkD3PgkxSJrTYvcMDUI6NP9paLMXQDL0arAmQxzYfXsaz54wx3gcg561KiIMJtkr+H7T95okEELByV+ppV2LfR3fv/oPRC8f0htYorQxDnMPG+0QBnranH6noDzCGrDba7Ww5lfC6W7QI466J9x+GKOyuyOIAA3CtoaN18M2mp9LFCiI44ChMl5tYgLmv6iLRpR1IltKSzWg1bZ4Gvbw9M5H1fO2PXHCv5QCadGYkbV1rGrtLE/W5ajQEauJ7M2bTIRzJumsLLIiPdixfg2INJ5jHhF1IWHpxsd27oxKXf6GyNr9aWi6ToSXNNTTrcuzYaCpOY8RNk+E+3OsLzGsmuIy1JfVg9YN0XnUWVI1wPyUdJ3V8WZBEEayj8J+q0rpHYZC8WKcRslM1yD5EdGy/wyNOJbQw4JUvyiYNdA8NGFCp17LHL3eydMRholKe76PQ43e9TzVBqp+ZDI=
Content-Type	multipart/mixed; boundary="----sinikael-?=_1-17292462445140.6554189848784928"
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Target ID:	0
Start time:	09:09:48
Start date:	18/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Michelle.eml"
Imagebase:	0x580000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:09:54
Start date:	18/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5D65D9C5-9AF3-4381-97E4-E7108CDBB5CA" "2287A218-4331-4E4B-8810-C36F28803482" "7296" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff7786c0000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Michelle.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\177D8AD1-CC04-4B63-8A28-CC486E415E2F

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729256992086725700_06CC28A1-8FD1-481B-92F3-7CE4D64AFDA3.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729256992088472400_06CC28A1-8FD1-481B-92F3-7CE4D64AFDA3.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241018T0909510720-7296.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Static File Info

General

Static Mail

General

Headers

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
Michelle.eml