Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

phish_alert_sp2_2.0.0.0 (14).eml

RFC 822 mail, ASCII text, with very long lines (2221), with CRLF line terminators

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Composite Document File V2 Document, Cannot read section info

dropped

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Microsoft Outlook email folder (>=2003)

dropped

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

ASCII text, with very long lines (65536), with no line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

ASCII text, with no line terminators

modified

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\0E9710D4-6D54-408F-93BA-294E298FEA27

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

SQLite Write-Ahead Log, version 3007000

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{998A016B-2B88-49EF-9235-3DA770E67B92}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A9601DEC-8316-4644-BB8F-D7830ED38A91}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F8AC2A70-E862-4D1B-ACD5-D98B8F7C50AD}.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729606063967139200_CC5ACBCC-25F2-4116-B84E-9B4ED5399B04.log

ASCII text, with very long lines (856), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729606063970611500_CC5ACBCC-25F2-4116-B84E-9B4ED5399B04.log

data

dropped

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241022T1007420971-2596.etl

data

dropped

C:\Users\user\AppData\Local\Temp\msoED63.tmp

GIF image data, version 89a, 15 x 15

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

data

dropped

Chrome Cache Entry: 103

Web Open Font Format (Version 2), TrueType, length 50556, version 1.0

downloaded

Chrome Cache Entry: 104

HTML document, ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 105

ASCII text, with very long lines (65472)

dropped

Chrome Cache Entry: 106

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 107

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 108

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 109

ASCII text, with very long lines (12450)

dropped

Chrome Cache Entry: 110

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 111

Web Open Font Format (Version 2), TrueType, length 33092, version 1.0

downloaded

Chrome Cache Entry: 112

ASCII text, with very long lines (4914), with no line terminators

dropped

Chrome Cache Entry: 113

PNG image data, 1290 x 920, 8-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 114

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 115

ASCII text, with very long lines (4914), with no line terminators

downloaded

Chrome Cache Entry: 116

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 117

ASCII text

downloaded

Chrome Cache Entry: 118

ASCII text, with very long lines (2343)

downloaded

Chrome Cache Entry: 119

Web Open Font Format (Version 2), TrueType, length 28892, version 1.0

downloaded

Chrome Cache Entry: 120

ASCII text, with very long lines (2306), with no line terminators

downloaded

Chrome Cache Entry: 121

ASCII text, with no line terminators

dropped

Chrome Cache Entry: 122

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 123

Web Open Font Format (Version 2), TrueType, length 77160, version 4.459

downloaded

Chrome Cache Entry: 124

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 125

ASCII text

dropped

Chrome Cache Entry: 126

Unicode text, UTF-8 text, with very long lines (65458)

dropped

Chrome Cache Entry: 127

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 128

HTML document, ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 129

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 130

PNG image data, 70 x 64, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 131

ASCII text, with very long lines (2306), with no line terminators

dropped

Chrome Cache Entry: 132

ASCII text, with very long lines (12450)

downloaded

Chrome Cache Entry: 133

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 134

ASCII text, with very long lines (4892), with no line terminators

dropped

Chrome Cache Entry: 135

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 136

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 137

ASCII text, with no line terminators

dropped

Chrome Cache Entry: 138

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 139

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 140

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 141

ASCII text, with very long lines (2343)

dropped

Chrome Cache Entry: 142

Unicode text, UTF-8 text, with very long lines (65464)

downloaded

Chrome Cache Entry: 143

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 144

ASCII text, with very long lines (65447)

dropped

Chrome Cache Entry: 145

Unicode text, UTF-8 text, with very long lines (65464)

dropped

Chrome Cache Entry: 146

HTML document, Unicode text, UTF-8 text, with very long lines (434), with CRLF, CR, LF line terminators

downloaded

Chrome Cache Entry: 147

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 148

ASCII text, with very long lines (4875), with no line terminators

downloaded

Chrome Cache Entry: 149

HTML document, Unicode text, UTF-8 text, with very long lines (457), with CRLF, CR, LF line terminators

downloaded

Chrome Cache Entry: 150

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 151

ASCII text, with very long lines (65472)

downloaded

Chrome Cache Entry: 152

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 153

ASCII text

downloaded

Chrome Cache Entry: 154

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 155

Web Open Font Format (Version 2), TrueType, length 34288, version 1.0

downloaded

Chrome Cache Entry: 156

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 157

ASCII text, with no line terminators

dropped

Chrome Cache Entry: 158

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 159

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 160

ASCII text, with very long lines (723)

downloaded

Chrome Cache Entry: 161

ASCII text, with very long lines (14791)

dropped

Chrome Cache Entry: 162

ASCII text, with very long lines (65316), with CRLF line terminators

downloaded

Chrome Cache Entry: 163

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 164

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 165

PNG image data, 70 x 64, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 166

HTML document, ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 167

PNG image data, 1290 x 920, 8-bit colormap, non-interlaced

downloaded

Chrome Cache Entry: 168

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 169

HTML document, ASCII text, with very long lines (815)

downloaded

Chrome Cache Entry: 170

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 171

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 172

ASCII text, with very long lines (65536), with no line terminators

dropped

Chrome Cache Entry: 173

ASCII text, with very long lines (65450)

downloaded

Chrome Cache Entry: 174

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 175

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 176

ASCII text, with very long lines (14791)

downloaded

Chrome Cache Entry: 177

Unicode text, UTF-8 text, with very long lines (65458)

downloaded

Chrome Cache Entry: 178

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 179

ASCII text, with very long lines (65447)

downloaded

Chrome Cache Entry: 180

ASCII text, with very long lines (65450)

dropped

There are 88 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0 (14).eml"

Details

Is windows:	true
Is dropped:	false
PID:	2596
Target ID:	0
Parent PID:	2580
Name:	OUTLOOK.EXE
Class:	outlook
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0 (14).eml"
Size:	34446744
MD5:	91A5292942864110ED734005B7E005C0
Time:	10:07:39
Date:	22/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xc80000
Modulesize:	34492416
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Office Autorun Keys Modification	System Summary
Spawns processes	System Summary	Process Injection

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "CB015B37-437B-46BB-969F-606510033A79" "38FBDA1E-9AB9-456C-AAA8-3723ABD3B63C" "2596" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"

Details

Is windows:	true
Is dropped:	false
PID:	4444
Target ID:	4
Parent PID:	2596
Name:	ai.exe
Class:	office
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "CB015B37-437B-46BB-969F-606510033A79" "38FBDA1E-9AB9-456C-AAA8-3723ABD3B63C" "2596" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Size:	710048
MD5:	EC652BEDD90E089D9406AFED89A8A8BD
Time:	10:07:45
Date:	22/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff740be0000
Modulesize:	737280
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urldefense.com/v3/__https:/url3804.contact.mescius.com/ls/click?upn=u001.Zz0ZgmHzt7GrQzV1Q-2BEREzkHfO342-2BVo3sgrezd73wDbYRerX2Oj-2BHGy3k6C4rP4OX4PZiFMY-2BcI81NVS3dtn3JYhWDxVDvoWH6q1gdY7onvuNjuxaKJ8VQfDHII99lPJjDYQtkhbySsekGzrSg2LaoTt1mD-2FI3845Dd6DED8aE-3DdiM__U23Ps-2F8Rp-2FN8nKT-2BW6dS-2FQlYGLJeZyboJxR0aNrLzI87-2ByxGRE4GXweL-2B3xzjvR-2Bk8rxAnAbY0aH2nupiH7MP74AJa2-2BR2Hn8gly1vtspG464FDk-2BihevWGDCJgQJZ5RS2PVfgwk2RZVD3aFkwT7kQWJgCsBp9tR08EMP8CAOvc12LGgPCx6fFBBzIT1x9BtCP3fo-2FSzB0Sc2v77CFPYXbnzkjoNe5Lf5Zt8dCHpTz9Z10zN754byKoC-2BK8rEqXV__;!!I_DbfM1H!HVX024oR8T1JSxi9EDV6-PP95dcKwbX8c2rBQX8VRDkbjCdYZ5SOeFFgnvqODVW-71XEgOI__89gYDqUf4GQbbPobGZqNQ$

Details

Is windows:	true
Is dropped:	false
PID:	1284
Target ID:	5
Parent PID:	2596
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://urldefense.com/v3/__https:/url3804.contact.mescius.com/ls/click?upn=u001.Zz0ZgmHzt7GrQzV1Q-2BEREzkHfO342-2BVo3sgrezd73wDbYRerX2Oj-2BHGy3k6C4rP4OX4PZiFMY-2BcI81NVS3dtn3JYhWDxVDvoWH6q1gdY7onvuNjuxaKJ8VQfDHII99lPJjDYQtkhbySsekGzrSg2LaoTt1mD-2FI3845Dd6DED8aE-3DdiM__U23Ps-2F8Rp-2FN8nKT-2BW6dS-2FQlYGLJeZyboJxR0aNrLzI87-2ByxGRE4GXweL-2B3xzjvR-2Bk8rxAnAbY0aH2nupiH7MP74AJa2-2BR2Hn8gly1vtspG464FDk-2BihevWGDCJgQJZ5RS2PVfgwk2RZVD3aFkwT7kQWJgCsBp9tR08EMP8CAOvc12LGgPCx6fFBBzIT1x9BtCP3fo-2FSzB0Sc2v77CFPYXbnzkjoNe5Lf5Zt8dCHpTz9Z10zN754byKoC-2BK8rEqXV__;!!I_DbfM1H!HVX024oR8T1JSxi9EDV6-PP95dcKwbX8c2rBQX8VRDkbjCdYZ5SOeFFgnvqODVW-71XEgOI__89gYDqUf4GQbbPobGZqNQ$
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:08:31
Date:	22/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1900,i,3493826802203577992,9511492656753416214,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6744
Target ID:	6
Parent PID:	1284
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1900,i,3493826802203577992,9511492656753416214,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:08:32
Date:	22/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://developer.mescius.com/?utm_medium=Release&utm_source=Email&utm_campaign=ARJS-v5-1-Release-Email

https://shell.suite.office.com:1443

unknown

https://stats.g.doubleclick.net/g/collect

unknown

https://designerapp.azurewebsites.net

unknown

https://autodiscover-s.outlook.com/

unknown

https://stackoverflow.com/questions/60357083/does-not-use-passive-listeners-to-improve-scrolling-per

unknown

https://useraudit.o365auditrealtimeingestion.manage.office.com

unknown

https://outlook.office365.com/connectors

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr

unknown

https://cdn.entity.

unknown

https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/

unknown

https://rpsticket.partnerservices.getmicrosoftkey.com

unknown

https://lookup.onenote.com/lookup/geolocation/v1

unknown

https://ampcid.google.com/v1/publisher:getClientId

unknown

https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile

unknown

https://api.aadrm.com/

unknown

https://canary.designerapp.

unknown

https://github.com/twbs/bootstrap/graphs/contributors)

unknown

https://www.yammer.com

unknown

https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies

unknown

https://api.microsoftstream.com/api/

unknown

https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive

unknown

https://cr.office.com

unknown

https://messagebroker.mobile.m365.svc.cloud.microsoft

unknown

https://otelrules.svc.static.microsoft

unknown

https://stats.g.doubleclick.net/j/collect

unknown

https://wyn.mescius.com/

unknown

https://embed.tawk.to/_s/v4/app/6717572db23/js/twk-chunk-common.js

104.22.45.142

https://www.linkedin.com/company/mesciusinc

unknown

https://edge.skype.com/registrar/prod

unknown

https://cdn.mescius.io/sites/shared/fonts/ionicons/ionicons.woff2?v=4.5.4

13.107.253.45

https://res.getmicrosoftkey.com/api/redemptionevents

unknown

https://tasks.office.com

unknown

https://officeci.azurewebsites.net/api/

unknown

https://my.microsoftpersonalcontent.com

unknown

https://cdn.mescius.com/usk/css/generated/f5e1c0c1-73a6-4850-8597-57fde5d37e22.css?version=638497491359200000

18.245.60.39

https://store.office.cn/addinstemplate

unknown

https://urldefense.com/v3/__https://url3804.contact.=

unknown

https://edge.skype.com/rps

unknown

https://messaging.engagement.office.com/

unknown

https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech

unknown

https://developer.mescius.com/activereportsjs/download?=

unknown

https://www.odwebp.svc.ms

unknown

https://api.powerbi.com/v1.0/myorg/groups

unknown

https://web.microsoftstream.com/video/

unknown

https://api.addins.store.officeppe.com/addinstemplate

unknown

https://schema.org

unknown

https://graph.windows.net

unknown

https://www.youtube.com/

unknown

https://cdn.mescius.io/umb/media/xtilame0/2023-mescius-plain-jumbotron-bkg.svg

13.107.253.45

https://login.windows.localnullD

unknown

https://cdn.mescius.com/sb/all-css-bundle.css.v3

18.245.60.39

https://consent.config.office.com/consentcheckin/v1.0/consents

unknown

https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices

unknown

https://embed.tawk.to/_s/v4/app/6717572db23/js/twk-object-values-polyfill.js

unknown

https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json

unknown

https://d.docs.live.net

unknown

https://safelinks.protection.outlook.com/api/GetPolicy

unknown

https://ncus.contentsync.

unknown

https://platform.vine.co/static/scripts/embed.js

unknown

https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/

unknown

http://weather.service.msn.com/data.aspx

unknown

https://content.hotjar.io/?site_id=1725729&gzip=1

18.202.194.156

https://urldefense.com/v3/__https:/url3804.contact.mescius.com/ls/click?upn=u001.Zz0ZgmHzt7GrQzV1Q-2BEREzkHfO342-2BVo3sgrezd73wDbYRerX2Oj-2BHGy3k6C4rP4OX4PZiFMY-2BcI81NVS3dtn3JYhWDxVDvoWH6q1gdY7onvuNjuxaKJ8VQfDHII99lPJjDYQtkhbySsekGzrSg2LaoTt1mD-2FI3845Dd6DED8aE-3DdiM__U23Ps-2F8Rp-2FN8nKT-2BW6dS-2FQlYGLJeZyboJxR0aNrLzI87-2ByxGRE4GXweL-2B3xzjvR-2Bk8rxAnAbY0aH2nupiH7MP74AJa2-2BR2Hn8gly1vtspG464FDk-2BihevWGDCJgQJZ5RS2PVfgwk2RZVD3aFkwT7kQWJgCsBp9tR08EMP8CAOvc12LGgPCx6fFBBzIT1x9BtCP3fo-2FSzB0Sc2v77CFPYXbnzkjoNe5Lf5Zt8dCHpTz9Z10zN754byKoC-2BK8rEqXV__;!!I_DbfM1H!HVX024oR8T1JSxi9EDV6-PP95dcKwbX8c2rBQX8VRDkbjCdYZ5SOeFFgnvqODVW-71XEgOI__89gYDqUf4GQbbPobGZqNQ$

52.204.90.22

https://urldefense.com/v3/__https://url3804.contact.mescius.=

unknown

https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios

unknown

https://developer.mescius.com/activereportsjs/docs/v5.1/ReportAuthorGuide/report-configuration/Repor

unknown

https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml

unknown

https://mss.office.com

unknown

https://pushchannel.1drv.ms

unknown

https://wus2.contentsync.

unknown

https://clients.config.office.net/user/v1.0/ios

unknown

https://twitter.com/MESCIUS_inc/

unknown

https://api.addins.omex.office.net/api/addins/search

unknown

https://cdn.mescius.com/usk/css/generated/f5e1c0c1-73a6-4850-8597-57fde5d37e22.css?version=638497491

unknown

https://github.com/ashleydw/lightbox

unknown

https://outlook.office365.com/api/v1.0/me/Activities

unknown

https://embed.tawk.to/_s/v4/app/6717572db23/js/twk-main.js

104.22.45.142

https://clients.config.office.net/user/v1.0/android/policies

unknown

https://developer.mescius.com/my-account/my-licenses

unknown

https://entitlement.diagnostics.office.com

unknown

https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json

unknown

https://outlook.office.com/

unknown

https://storage.live.com/clientlogs/uploadlocation

unknown

https://urldefense.=

unknown

https://login.microsoftonline.com

unknown

https://substrate.office.com/search/api/v1/SearchHistory

unknown

http://developer.mescius.com/blogs

unknown

https://login.windows.localnullros

unknown

https://clients.config.office.net/c2r/v1.0/InteractiveInstallation

unknown

https://service.powerapps.com

unknown

https://graph.windows.net/

unknown

https://devnull.onenote.com

unknown

https://messaging.office.com/

unknown

https://cdn.mescius.io/umb/media/q1pdzqto/icon-mescius-006-demos.svg

13.107.253.45

https://cdn.mescius.io/sites/shared/fonts/fontawesome/fonts/fontawesome-webfont.woff2?v=4.7.0

13.107.253.45

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing

unknown

https://skyapi.live.net/Activity/

unknown

https://cdn.mescius.io/umb/media/pujnxfci/mescuis-logo-horiz.svg

13.107.253.45

http://kenwheeler.github.io/slick

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

pacman-content-live.live.eks.hotjar.com

18.202.194.156

urldefense.com

52.204.90.22

developer.mescius.com

20.122.209.197

s-part-0017.t-0009.fb-t-msedge.net

13.107.253.45

stats.g.doubleclick.net

74.125.206.155

embed.tawk.to

104.22.45.142

analytics-alv.google.com

216.239.36.181

googleads.g.doubleclick.net

142.250.184.226

script.hotjar.com

13.33.187.109

d5up5fugcs56e.cloudfront.net

18.245.60.39

www.google.com

142.250.186.68

td.doubleclick.net

142.250.186.98

s-part-0032.t-0009.t-msedge.net

13.107.246.60

wsky-live.live.eks.hotjar.com

54.194.89.66

static-cdn.hotjar.com

18.66.102.53

cdn.mescius.com

unknown

content.hotjar.io

unknown

static.hotjar.com

unknown

analytics.google.com

unknown

ws.hotjar.com

unknown

url3804.contact.mescius.com

unknown

cdn.mescius.io

unknown

There are 12 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

142.250.186.68

www.google.com

United States

18.66.102.53

static-cdn.hotjar.com

United States

54.194.89.66

wsky-live.live.eks.hotjar.com

United States

18.66.102.11

unknown

United States

104.22.45.142

embed.tawk.to

United States

142.250.185.100

unknown

United States

192.168.2.4

unknown

13.107.246.60

s-part-0032.t-0009.t-msedge.net

United States

74.125.206.155

stats.g.doubleclick.net

United States

18.245.60.39

d5up5fugcs56e.cloudfront.net

United States

52.204.90.22

urldefense.com

United States

142.250.184.226

googleads.g.doubleclick.net

United States

104.22.44.142

unknown

United States

142.250.186.98

td.doubleclick.net

United States

18.245.60.124

unknown

United States

216.239.36.181

analytics-alv.google.com

United States

13.107.253.45

s-part-0017.t-0009.fb-t-msedge.net

United States

216.58.206.66

unknown

United States

54.72.94.65

unknown

United States

239.255.255.250

unknown

Reserved

20.122.209.197

developer.mescius.com

United States

13.33.187.74

unknown

United States

142.250.186.100

unknown

United States

18.202.194.156

pacman-content-live.live.eks.hotjar.com

United States

13.33.187.109

script.hotjar.com

United States

There are 15 hidden IPs, click here to show them.

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046

000b046b

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\3517490d76624c419a828607e2a54604

001f6000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046

000b049c

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046

001f0433

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046

000b0465

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9207f3e0a3b11019908b08002b2a56c2

11023d05

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046

00030429

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676

{ED475418-B0D6-11D2-8C3B-00104B2A6676}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676

LastChangeVer

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676

{ED475418-B0D6-11D2-8C3B-00104B2A6676}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676

LastChangeVer

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676

{ED475418-B0D6-11D2-8C3B-00104B2A6676}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676

LastChangeVer

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676

LastChangeVer

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession

CantBootResolution

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession

ProfileBeingOpened

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession

SessionId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession

BootDiagnosticsLogFile

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics

OutlookBootFlag

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

)8(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData

SessionId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData

ProfileBeingOpened

HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB

@%SystemRoot%\system32\mlang.dll,-4612

HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB

@%SystemRoot%\system32\mlang.dll,-4608

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Wizards

PageSize

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\MailSettings

Template

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options

WMACUpdated

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Options

DefaultKerningLigatures

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\outlook

BuildNumber

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook

Expires

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.1

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.2

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.3

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.4

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.5

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.6

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.7

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.8

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.9

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.10

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.11

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.12

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.13

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.14

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.15

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.16

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.17

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.18

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.19

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.20

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.21

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.22

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.23

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.24

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.25

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.26

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.27

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

1.28

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

VersionId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook

ETag

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook

DeferredConfigs

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook

ConfigIds

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData

ClockTimeSeconds

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData

TickCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData

BootDiagnosticsLogFile

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData

CantBootResolution

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

rv(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Display Types\Balloons

HWND64ForOrphanedNotIcon

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\ColleagueImport.ColleagueImportAddin

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\Microsoft.VbaAddinForOutlook.1

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

"v(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

1v(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OscAddin.Connect

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

!v(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\UCAddin.LyncAddin.1

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

0v(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\UmOutlookAddin.FormRegionAddin

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

0v(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

0v(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

0v(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems

`v(

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Search

IndexAvailableBody

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\UserInfo

SharingMachineID

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingLastSyncTimeOutlook

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingLastWriteTimeOutlook

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier

a4922304f05a0caf296a5dab7d32866b

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier

a1907cf74a0e723ae4d6d10c2be13b22

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier

5f7af7540aa81b0933473148ec658dad

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier

76e17cf74d1871db022de719ec047c24

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier

a534c6b591e8e4482771367da0dfc1a5

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier

6b5ad615dd992da766ae34dec0713a44

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property

001800111044FBE7

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Volatile

MsaDevice

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet

UseRWHlinkNavigation

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet

UseRWOSHlinkNavigation

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\Trusted Documents

LastPurgeTime

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Logging

NULL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage

OutlookMAPI2

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-CH

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-GB

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-CH

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-GB

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common

SessionId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109A10090400000000000F01FEC\Usage

OutlookMAPI2Intl_1033

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Exchange\Forms Registry

CacheSyncCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0

FilePath

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0

StartDate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=8192&uilcid=1033&build=16.0.16827&crev=3\0

EndDate

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData

ChunkCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook

Expires

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\ColleagueImport.ColleagueImportAddin

LoadCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes

ColleagueImport.ColleagueImportAddin

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\OneNote.OutlookAddin

LoadCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-CH

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-GB

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-CH

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

en-GB

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes

OneNote.OutlookAddin

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\OscAddin.Connect

LoadCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes

OscAddin.Connect

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\UCAddin.LyncAddin.1

LoadCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes

UCAddin.LyncAddin.1

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\UmOutlookAddin.FormRegionAddin

LoadCount

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes

UmOutlookAddin.FormRegionAddin

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2596

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\UserInfo

CountQuickSteps

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingConfigurableSettings

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming

RoamingConfigurableSettings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}

DeviceTicket

HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}

DeviceId

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Search\Catalog

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

There are 182 hidden registries, click here to show them.

DOM / HTML

URL

Malicious

https://developer.mescius.com/?utm_medium=Release&utm_source=Email&utm_campaign=ARJS-v5-1-Release-Email

https://developer.mescius.com/pricing

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
phish_alert_sp2_2.0.0.0 (14).eml

Files

Processes

URLs

Domains

IPs

Registry

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportphish_alert_sp2_2.0.0.0 (14).eml

Files

Processes

URLs

Domains

IPs

Registry

DOM / HTML

IOC Report
phish_alert_sp2_2.0.0.0 (14).eml