IOC Report
[EXTERNAL] Re_ Quotes.eml

loading gif

Files

File Path
Type
Category
Malicious
[EXTERNAL] Re_ Quotes.eml
RFC 822 mail, ASCII text, with very long lines (347), with CRLF line terminators
initial sample
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs
Composite Document File V2 Document, Cannot read section info
dropped
 malicious
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst
Microsoft Outlook email folder (>=2003)
dropped
 malicious
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
data
dropped
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml
XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf
TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
modified
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin
ASCII text, with very long lines (65536), with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db
SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm
data
dropped
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal
SQLite Write-Ahead Log, version 3007000
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2D84364F.dat
PNG image data, 118 x 59, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4B113C04.dat
PNG image data, 79 x 59, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\57E1933D.dat
PNG image data, 2811 x 214, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\61A89A06.dat
PNG image data, 118 x 59, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\87B2ED2C.dat
PNG image data, 88 x 36, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8A2DA435.dat
PNG image data, 193 x 59, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B813C81A.dat
PNG image data, 423 x 97, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BCC1D738.dat
PNG image data, 903 x 175, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C5458553.dat
PNG image data, 246 x 44, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D6103DD9.dat
PNG image data, 345 x 70, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5E8782E3-8D4A-45DD-A929-A96DB03A977F}.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729606183002160900_0A09A35D-7331-45A2-8597-74C0710D4482.log
data
dropped
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729606183002952600_0A09A35D-7331-45A2-8597-74C0710D4482.log
data
dropped
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241022T1009420773-740.etl
data
dropped
C:\Users\user\AppData\Local\Temp\olk383C.tmp
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 22 13:10:55 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 169
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
Chrome Cache Entry: 170
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 171
Web Open Font Format (Version 2), TrueType, length 137104, version 331.-31196
downloaded
Chrome Cache Entry: 172
ASCII text, with very long lines (1492), with no line terminators
downloaded
Chrome Cache Entry: 173
HTML document, ASCII text, with very long lines (2088)
downloaded
Chrome Cache Entry: 174
JSON data
downloaded
Chrome Cache Entry: 175
Web Open Font Format (Version 2), TrueType, length 37608, version 1.0
downloaded
Chrome Cache Entry: 176
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 177
HTML document, ASCII text
dropped
Chrome Cache Entry: 178
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 179
HTML document, ASCII text
downloaded
Chrome Cache Entry: 180
PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 181
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
downloaded
Chrome Cache Entry: 182
ASCII text, with very long lines (1492), with no line terminators
dropped
Chrome Cache Entry: 183
PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 184
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 185
HTML document, ASCII text
downloaded
Chrome Cache Entry: 186
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 187
Web Open Font Format (Version 2), TrueType, length 168824, version 331.-31196
downloaded
Chrome Cache Entry: 188
HTML document, ASCII text
dropped
Chrome Cache Entry: 189
HTML document, ASCII text
dropped
Chrome Cache Entry: 190
JSON data
dropped
Chrome Cache Entry: 191
ASCII text, with very long lines (65536), with no line terminators
dropped
There are 49 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\[EXTERNAL] Re_ Quotes.eml"
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "0F810BE9-1EE3-4005-871B-CC3AF9EB26A5" "EB03CE19-C594-4EA9-AD58-197437118574" "740" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,1824875940929507423,6371601856566642731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

URLs

Name
IP
Malicious
https://security-uk.m.mimecastprotect.com/service/get-caps-overrides
195.130.217.88
https://login.windows.net
unknown
https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=3D=
unknown
https://url.uk.m.mimecastprotect.com/s/0c3qC3QDxSxmYrQsYCOFQ4SPB?domain=citipostmail.co.uk/
unknown
https://security-uk.m.mimecastprotect.com/api/ttp/userawareness/report-judgement
195.130.217.88
https://url.uk.m.mimecastprotect.com/s/0c3qC3QDxSxmYrQsYCOFQ4SPB?domain=3D=
unknown
https://url.uk.m.mimecastprotect.com/r/lJ_qgGoNKOtmgnbcVAzK9AK7bCK_bMUk-wR7tn7n2Yc-AiwWUwSJ5cdo4JD9L-rHbsi-7W3dO8y5uQV2nzI3pgGYX2bWfu1MDc-X9rMWVK_hsH3igqVCwlv82yO9Us1bD9QGVJXYV3iwcJyaZUtCzpN5gQCtVwfSk4NF3Jvvjo6dam7LE0uymt-W2XHlpqniDQv0P0k8ZJKYaCstCrmE1sq1ZoAQ3VLjp0OO2PZzixRmPZJK3FnHnTaIJwVqhz9-vSI1xigm4TWyfd7JWmu74nSWtZqj9NqEJglaSsVWuKMnELweU3CY7wK_cfeqtPwaqs8jlAL3SZc0pjK71K0ISYzpKLaSw_JCCc6zzmE5PGZHuWIotNrok3xDwjmYYdSvbsjWzlsuRUUe3Ge-nzuT_-uUD_uGughyFXcxYqfAHpXCIep-KQdcjuq5Gyqg4rYzIdDobbwKUqvbUjmSwsU6Kbz8qPGQrWgdumJENyi7ViVKh-mx850nErkNPPaV8cEVsF1xwTxYLEAhTmhHRFqA7DnqNRyYU8B2moBCnufp7KSRLhEp1_IHwcMi0uGvittYjkbd0gHZii0doZ1PDx7jizS1e86c9bnhOUytqDfaRPkGLrrmXFvMSMHe0VxnfFBGLZEIqK8aCvyVOEzBNaAsXqjn0X24VWZs0SIbrkF1BRP5g_6PPLDHAT96Al--7XzfEabS-JA9VJrrtaFy3rXYfe_PvCiuYE1POvOJHaa21-S6TObxg0FHlmY4H26jk9CS7vhpZOSEqojkHw-5NIh6Xakwp7HlCqrjIavb4slvXKlKIaN5TvHEmT0NJj9Tz-QJoPY9eQM87kb2xd-yGPumDZ7hR0YYULul-RYv02pa-1WDseD-F4nYtDSc3kB_FBhSsd7qv8I8acNjgeUi66fzcgkqjzwY1Ak8-rqfZ5tLgDhm9ERoKKIvhlix5yGPfqgo-DeV8vH-ifijkZj4e-P3X0N4ZVegzbHvflS2YJEfRIM2ZTxn5VC8ZDWCYGaXdMxa-Xov1SeLhzQ3sfqwVdjwkawHIkJjfU9pZvXyT4wweCBC_7qUW957fgdrFlNjD_OpvHMhKk1h1izSHy7ii-zdycvdZ55YGRKW-ie68VFpMpuz5oVeWVY8m0UNcRHEP8m5K8yoY5B6-eCpIAdFkvttmdpXGGaT12kyDsVFQFWETMsj8H1QDh_aI7A9POPidkQkb6OBHXgsuGpWFpJ7TZpJtZE_xchIobol4vmRh9vZ3C7SBFFUgu2j_6TsHiuUabrhI1LDwP2myyzmHFvUZYPA63CI0ALKTC_P6Bdxq6lht5KkGmACREYDtRBF-kGJGhffu6rERZeMQ0nfJSw2WChLK1jbgMCBHYL3S4-BEPw5PH-SiK9RaCgZ1w57VS9HyVp4OGintMwvFcQnU7rvdJzEkZdi4t8aDyLC9o716IyalFvWYhB4e3mlTwas-zp5HzyR4hjd1nJlTGZJWMuF6od9aAqJ7Km-rQxd5IqVVmylAAWZcvb-jW3S3DKhwFAbbm589D2i8V1Ahs9IA4oJJJ2bu9Awuqg-HnPHJKo_4hhaednodO1xzyNtzCbjY4E7eS3B-byyTokN9NXcayzRrrlbu-ZurIeZlGgKuBTF9L_m7XijX9CyiEOJxd5P9tMh_dWoXhuL43DvkDgu8YCVS7eHbfhAIrtQ0d6MIxxcL-850Mi3jgwhBdqQ2cOv7WeTXKWLZwdlTJ7VskYkBAOcWLTeSdttQUE3-QQ-kJfH-CEaeqzid78FONS1wZWx0Q4TQqpFFwX8eSv7UAMuKvVR0B3t_xGGzYWRIwBeVOXr5vZoBcF-UMBLMDSVPav9LcIQTX2kRlpaIqJ8ZIwFhoubGQDjrim0kRm_bNuVBgMgErHTJcV2pJTnJL__3tmZV69wE1a-RhSdL93OvwNV64V3vO0Mk4bo9ExF_PVACnZvL13I9EFyx5gx-FczdJEFLTL4jS49Rbm7U-13pOV0m7fZmA1jK2Le-Y_di64hqoJB23dOBPHhNuMYHq85KydOEFnP7Z_gU4UXxk0Ps4xjc7KgISdm3Oo-HIMF3JDqBZPpMlOEPxaOrXhz9KoGRPzxtjSALNe7ZMzlekRv9jFmUh0XeDON53e2BHdy5Y-Iqp0G4_4LYz1VAwO-ROsOS1HpU5iwxdGKXswYU88Ib8_7gaU4wozJ8bO64yNZKF5C2zrX8k3OUc2NoaVycJlmClbfiJm38U1iy7kIsgbYqZ4cbNxCUyN9JIXDNUEVq9hglStXb2skpoO7fOPCwpNJ8EouBnKaaqfqUwoEBOv0kg3KNHlQYcgNRHs7wdADjpIkc4SG9rKb-9cikDPyc8ewBOXVRgNMCId09T1jmoIKg81Y-x2m4lKFPFudbrhPD2SgwlCflAA8Pj29VMRney0ZsSZy7IkpSOOnUw63fCM01mEIK4h_AJxXkc95E_MdFjbrWGZphvIu3S4e9O_SL8PS6DmThM1gANG5sii-BspX62TapMynCEuVBu-NysWd3Q1yieP87FuW_flBV8SKtJdHT9Qbg6t2SJ_lnDQotoJa0yYsHbQDcIPPvXfh8mX42-pWTzjckUt5wV-Tu-elaapxyxJz6fkGt3Ov5FWCkJ8_EiImNX8ET64m6IBQ3UKoeUxke0usx91hq1MiTQYLQhN1wwIKXERA6HabvM8c8QnufMmaJ02EdZhbqvEYMHIFLv4CWsLX8tGcKTMw9-Nee4D74ju-n2k2X2d1Jb2My1dA-khL5uhYtUyOxu0fz_ZK9fy60xI8PCYY34A_n6fIbH4qra_OEkifHZnzIjEPUZE8CFZFlO1vb6h22fJZbVcX4dfodAQuFTI5EJZhsiQD6wUMTx26NdCU0VQXS__o4H8S5ERpqKkuYWeoMb3bN6hlD-C8QXfG9d7b1B6-gcO4WHVuMERXogy_ecxYjvbaVzjOnpeuwU21QchBWLt2GNjiq4BmeTWwsnAa3ubVm4JZjyX0xSs6ITuOFi-ATf53vdnH-8fWFVOZIbn8GXeUOYp2e6MoupBHZMsnmUEbMaYleK5J9RQe2xMVZAdFHULtmulMHPgRXcXatf3BR4NZSWZUaJehNgrHhmmhBxUoBE-FVKq09cj9qwS2zXhW4oKE5n-giuFW1h0R-WkjsuD_2VBRb6OPuYX7XbiJqfaSYwAkeWqD67lDcuPWiyuvTFoBoTvrUXEICc8QF90mYBgQlQLEIioelrQ1q4k-zIYFhBphiCF2ZTMhEdn0Le6tdEaJvpdIBpOuMaPHNVVlz4WzHLWHe3W2pHjvooK6m7kRzrxSGuuN4vOOUDR6v85uLhzFz9Yn3VEAXveq3f0QsOIlW0hqDMaZNjeF1cxwdupbtyG9Asa5_0bNi3isugO-hDdvgJ8HMnJmX2RB9AQC731VAjr2FOGj1eW1jhk4YAnjp_k34V_T5hVuIN3t_zR93P5S72Z5QzCCvfkwmQJ-qZ7kthtcmSyibJg2sPvOig6M3OTeif9tAMe_KDZNsoJMJ6WhCiOWi2lPL9XnzN_Ejr52AKfCPg24pE5JORbssHV6RyPtzjH_6h-rn5gK9_dxvecUWMpgpBtZgDt3k0zuu9hJ0UJwHT-aQDBUm64X6_wAxmPkIH9R58KLiPg2rvWrR4WTBGfVYHnxe-VNGsWkI8q2d_3LEpV2KbazcIVlADeW7lq1pxwIS4tLpRM1IVx35-uFgxeoTwzvpBXJg_m76fW3dEiBpPj-Iz-o0mW8OoRHbeBpz9Wf-281L2xUFTe9UHGdN-R0ALhWbAgr9EmhXIPFRVMx4yq3GjCzfidQGFZ95MZ8UQY0CAzKNs2e9TLJq5GphfNs2kxJ1It65KGydHBVtgiEhvRbCaWLI_SyKmc
91.220.42.63
https://security-uk.m.mimecastprotect.com/ttpwp/resources/languages/en.json
195.130.217.88
https://url.uk.m.mimecastprotec=
unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2
195.130.217.88
https://url.uk.m.mimecastprotect.com/s/cIB8C4Q0yS6JAw1iNFEF4GZlf?domain=urldefense.proofpoint.com
unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/fa-regular-400.33904a1b964c9b363ce7.woff2
195.130.217.88
https://security-uk.m.mimecastprotect.com/ttpwp/resources/main.5257ca6e429949972959.js
195.130.217.88
https://www.example.com/
https://url.uk.m.mimecastp=
unknown
https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6koDwiMu6F5BKCc?domain=urldefense.proofpoint.com
unknown
http://www.mimecast.com/
unknown
https://url.uk.m.mimecastprotect.com/s/P5e4CYWP9Ug3oyxU9iGFxYVR2?domain=whistl.co.uk
unknown
https://url.uk.m.mimecastprotect.com/s/cIB8C4Q0yS6JAw1iNFEF4GZlf?domain=3D=
unknown
https://url.uk.m.mimecastprotect.com/s/lBBfC1WAvUOpwQYUYtmFVP1nh?domain=linkedin.com
unknown
https://hnamedmr.ukremediatlon.co.uk/LVGwXwqP
172.67.128.229
https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6=
unknown
https://security-uk.m.mimecastprotect.com/api/ttp/url/get-page-data
195.130.217.88
https://url.uk.m.mimecastprotect.com/s/1k4bC2xBwh6koDwi=
unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/polyfills.5257ca6e429949972959.js
195.130.217.88
https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico
195.130.217.88
https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB
https://security-uk.m.mimecastprotect.com/ttpwp/resources/styles.5257ca6e429949972959.js
195.130.217.88
https://pub.lucidpress.com/50f1c535-8058-4eec-b469-2bd69fae4557/
unknown
https://url.uk.m.mimecastprotect.com/s/0c3qC=
unknown
https://www.example.com/favicon.ico
93.184.215.14
https://security-uk.m.mimecastprotect.com/ttpwp/resources/runtime.5257ca6e429949972959.js
195.130.217.88
https://url.uk.m.mimecastprotect.com/s/rS3GCXLO9cGn7LYCVh6FWJ9uL?domain=whistl.co.uk/
unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273
195.130.217.88
https://url.uk.m.mimecastprotect.com/s/rS3GCXLO9cGn7LYCVh6=
unknown
https://url.uk.m.mimecastprotect.com/s/ZlrZCZYQ9UxMnWNsysRFBA-ZP?domain=hnamedmr.ukremediatlon.co.uk
91.220.42.63
https://url.uk.m.mimecastprotect.com/s/=
unknown
https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png
195.130.217.88
https://url.uk.m.mimecastprotect.com/s/lBBfC=
unknown
https://www.iana.org/domains/example
unknown
https://url.uk.m.mimecastprot=
unknown
https://url.uk.m.mimecastprotect.com/s/lBBfC1WAvUOpwQYUYtmFVP1nh?domain=3D=
unknown
https://security-uk.m.mimecastprotect.com/ttpwp
195.130.217.88
https://community.mimecast.com/docs/DOC-241
unknown
There are 34 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
url.uk.m.mimecastprotect.com
91.220.42.63
security-uk.m.mimecastprotect.com
195.130.217.88
www.google.com
142.250.185.68
hnamedmr.ukremediatlon.co.uk
172.67.128.229
www.example.com
93.184.215.14

IPs

IP
Domain
Country
Malicious
142.250.185.68
www.google.com
United States
91.220.42.63
url.uk.m.mimecastprotect.com
United Kingdom
192.168.2.18
unknown
unknown
172.67.128.229
hnamedmr.ukremediatlon.co.uk
United States
195.130.217.88
security-uk.m.mimecastprotect.com
United Kingdom
239.255.255.250
unknown
Reserved
93.184.215.14
www.example.com
European Union

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046
000b046b
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\3517490d76624c419a828607e2a54604
001f6000
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046
000b049c
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046
001f0433
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046
000b0465
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9207f3e0a3b11019908b08002b2a56c2
11023d05
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\0a0d020000000000c000000000000046
00030429
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
{ED475418-B0D6-11D2-8C3B-00104B2A6676}
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
LastChangeVer
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
{ED475418-B0D6-11D2-8C3B-00104B2A6676}
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
LastChangeVer
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
{ED475418-B0D6-11D2-8C3B-00104B2A6676}
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
LastChangeVer
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\NoEmail\9375CFF0413111d3B88A00104B2A6676
LastChangeVer
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
CantBootResolution
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
ProfileBeingOpened
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
SessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
BootDiagnosticsLogFile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
OutlookBootFlag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
k91
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
SessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
ProfileBeingOpened
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\1f\417C44EB
@%SystemRoot%\system32\mlang.dll,-4612
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Wizards
PageSize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\MailSettings
Template
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Options
WMACUpdated
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Options
DefaultKerningLigatures
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Experiment\outlook
BuildNumber
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook
Expires
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.3
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.4
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.7
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.9
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.10
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.11
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.12
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.13
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.14
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.15
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.16
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.17
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.18
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.19
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.20
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.21
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.22
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.23
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.24
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.25
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.26
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.27
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
1.28
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
VersionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook
ETag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook
DeferredConfigs
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook
ConfigIds
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
BootDiagnosticsLogFile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsData
CantBootResolution
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
am1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Display Types\Balloons
HWND64ForOrphanedNotIcon
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\ColleagueImport.ColleagueImportAddin
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\Microsoft.VbaAddinForOutlook.1
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
`m1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
/n1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OscAddin.Connect
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
>n1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\UCAddin.LyncAddin.1
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
.n1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\UmOutlookAddin.FormRegionAddin
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
.n1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
.n1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
.n1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Resiliency\StartupItems
>n1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Search
IndexAvailableBody
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastSyncTimeOutlook
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingLastWriteTimeOutlook
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\UserInfo
SharingMachineID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier
a4922304f05a0caf296a5dab7d32866b
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier
a1907cf74a0e723ae4d6d10c2be13b22
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier
5f7af7540aa81b0933473148ec658dad
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier
76e17cf74d1871db022de719ec047c24
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier
a534c6b591e8e4482771367da0dfc1a5
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier
6b5ad615dd992da766ae34dec0713a44
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Volatile
MsaDevice
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet
UseRWHlinkNavigation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet
UseRWOSHlinkNavigation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Logging
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000000000000F01FEC\Usage
OutlookMAPI2
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109A10090400000000000F01FEC\Usage
OutlookMAPI2Intl_1033
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Exchange\Forms Registry
CacheSyncCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData
ChunkCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook
Expires
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\ColleagueImport.ColleagueImportAddin
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
ColleagueImport.ColleagueImportAddin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
SessionId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\OneNote.OutlookAddin
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-CH
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
en-GB
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
OneNote.OutlookAddin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\OscAddin.Connect
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
OscAddin.Connect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\UCAddin.LyncAddin.1
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
UCAddin.LyncAddin.1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\UmOutlookAddin.FormRegionAddin
LoadCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\AddInLoadTimes
UmOutlookAddin.FormRegionAddin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\740
0
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\UserInfo
CountQuickSteps
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingConfigurableSettings
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
RoamingConfigurableSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018400CF391B14D
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Search\Catalog
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst
There are 170 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB
https://security-uk.m.mimecastprotect.com/ttpwp/#/ua?key=YHCH0jK4xsNRMGObU0ehDxT0fg3jXsga1nzcx-4fokPB1Xd4nzhmP6PAOTq_52_c9hx____uGeArAE7NPLh9tr4j9XByPup4XVZ61RaDPROs8aoUE601fyVV1A9ypfpB
https://www.example.com/