Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1e aanmaning Vondst Advocaten.msg

Overview

General Information

Sample name:1e aanmaning Vondst Advocaten.msg
Analysis ID:1541154
MD5:cf9248a79027f0311a954353072e570d
SHA1:18e25b46d4b7215feb9aaaf7bfe4cbb5bdfdba8b
SHA256:f0ff8e4537c8e0025c8584fe965d3b4856db1d3f385f4487bfedfc3a5b0f0a77
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

  • System is w10x64
  • OUTLOOK.EXE (PID: 3632 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\1e aanmaning Vondst Advocaten.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 2220 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "656D964E-C486-41BA-9D58-BA6A0F66008F" "9DAEA637-B84A-4F6C-B888-977ED1238558" "3632" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3632, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 1e aanmaning Vondst Advocaten.msg, ~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp.0.drString found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.aadrm.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.aadrm.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.cortana.ai
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.microsoftstream.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.office.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.onedrive.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://api.scheduler.
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://app.powerbi.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://augloop.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://augloop.office.com/v2
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://canary.designerapp.
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.entity.
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://clients.config.office.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://clients.config.office.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cortana.ai
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cortana.ai/api
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://cr.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://d.docs.live.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://designerapp.azurewebsites.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://designerappservice.officeapps.live.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://dev.cortana.ai
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://devnull.onenote.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://directory.services.
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ecs.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://edge.skype.com/rps
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 1e aanmaning Vondst Advocaten.msgString found in binary or memory: https://eur02.safelinks.protection.outloo=
Source: 1e aanmaning Vondst Advocaten.msgString found in binary or memory: https://eur02.safelinks.protection.outlook.com/=
Source: 1e aanmaning Vondst Advocaten.msgString found in binary or memory: https://eur02.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.von=
Source: 1e aanmaning Vondst Advocaten.msgString found in binary or memory: https://eur02.safelinks.protection.outlook.com/?url=3Dhttp=
Source: 1e aanmaning Vondst Advocaten.msg, ~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp.0.drString found in binary or memory: https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fadministratie%40vondst.com%2F&data=
Source: ~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp.0.drString found in binary or memory: https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vondst.com%2F&data=05%7C02%7CJo
Source: 1e aanmaning Vondst Advocaten.msg, ~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp.0.drString found in binary or memory: https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vondst.com%2Fwp-content%2Fuplo
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://graph.windows.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://graph.windows.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ic3.teams.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://invites.office.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://lifecycle.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://login.microsoftonline.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://login.microsoftonline.com/organizations
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://login.windows.local
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://make.powerautomate.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://management.azure.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://management.azure.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messaging.action.office.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://messaging.office.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://mss.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ncus.contentsync.
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://officeapps.live.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://officepyservice.office.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://onedrive.live.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://outlook.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://outlook.office.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://outlook.office365.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://outlook.office365.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://outlook.office365.com/connectors
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://pushchannel.1drv.ms
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://res.cdn.office.net
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://service.powerapps.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://settings.outlook.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://staging.cortana.ai
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://substrate.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://tasks.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://templatesmetadata.office.net/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: ~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp.0.drString found in binary or memory: https://vondst.legalsense.nl/static/billing/vondst-mail-logo.jpg
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://webshell.suite.office.com
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://wus2.contentsync.
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: 9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean1.winMSG@3/17@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241024T0811010785-3632.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\1e aanmaning Vondst Advocaten.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "656D964E-C486-41BA-9D58-BA6A0F66008F" "9DAEA637-B84A-4F6C-B888-977ED1238558" "3632" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "656D964E-C486-41BA-9D58-BA6A0F66008F" "9DAEA637-B84A-4F6C-B888-977ED1238558" "3632" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1541154 Sample: 1e aanmaning Vondst Advocaten.msg Startdate: 24/10/2024 Architecture: WINDOWS Score: 1 5 OUTLOOK.EXE 66 146 2->5         started        process3 7 ai.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://api.diagnosticssdf.office.com0%URL Reputationsafe
https://login.microsoftonline.com/0%URL Reputationsafe
https://shell.suite.office.com:14430%URL Reputationsafe
https://designerapp.azurewebsites.net0%URL Reputationsafe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize0%URL Reputationsafe
https://autodiscover-s.outlook.com/0%URL Reputationsafe
https://useraudit.o365auditrealtimeingestion.manage.office.com0%URL Reputationsafe
https://outlook.office365.com/connectors0%URL Reputationsafe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://api.addins.omex.office.net/appinfo/query0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/tenantassociationkey0%URL Reputationsafe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://lookup.onenote.com/lookup/geolocation/v10%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/imports0%URL Reputationsafe
https://cloudfiles.onenote.com/upload.aspx0%URL Reputationsafe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://entitlement.diagnosticssdf.office.com0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://canary.designerapp.0%URL Reputationsafe
https://ic3.teams.office.com0%URL Reputationsafe
https://www.yammer.com0%URL Reputationsafe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies0%URL Reputationsafe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive0%URL Reputationsafe
https://cr.office.com0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://portal.office.com/account/?ref=ClientMeControl0%URL Reputationsafe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory0%URL Reputationsafe
https://edge.skype.com/registrar/prod0%URL Reputationsafe
https://graph.ppe.windows.net0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://tasks.office.com0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://edge.skype.com/rps0%URL Reputationsafe
https://globaldisco.crm.dynamics.com0%URL Reputationsafe
https://messaging.engagement.office.com/0%URL Reputationsafe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.diagnosticssdf.office.com/v2/feedback0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/groups0%URL Reputationsafe
https://web.microsoftstream.com/video/0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://graph.windows.net0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://analysis.windows.net/powerbi/api0%URL Reputationsafe
https://aka.ms/LearnAboutSenderIdentification0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://substrate.office.com0%URL Reputationsafe
https://outlook.office365.com/autodiscover/autodiscover.json0%URL Reputationsafe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios0%URL Reputationsafe
https://consent.config.office.com/consentcheckin/v1.0/consents0%URL Reputationsafe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json0%URL Reputationsafe
https://safelinks.protection.outlook.com/api/GetPolicy0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/0%URL Reputationsafe
http://weather.service.msn.com/data.aspx0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://officepyservice.office.net/service.functionality0%URL Reputationsafe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks0%URL Reputationsafe
https://templatesmetadata.office.net/0%URL Reputationsafe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios0%URL Reputationsafe
https://messaging.lifecycle.office.com/0%URL Reputationsafe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml0%URL Reputationsafe
https://mss.office.com0%URL Reputationsafe
https://pushchannel.1drv.ms0%URL Reputationsafe
https://management.azure.com0%URL Reputationsafe
https://outlook.office365.com0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://incidents.diagnostics.office.com0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/ios0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://api.addins.omex.office.net/api/addins/search0%URL Reputationsafe
https://insertmedia.bing.office.net/odc/insertmedia0%URL Reputationsafe
https://outlook.office365.com/api/v1.0/me/Activities0%URL Reputationsafe
https://api.office.net0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
  • URL Reputation: safe
unknown
https://login.microsoftonline.com/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
  • URL Reputation: safe
unknown
https://shell.suite.office.com:14439B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
  • URL Reputation: safe
unknown
https://designerapp.azurewebsites.net9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
  • URL Reputation: safe
unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
  • URL Reputation: safe
unknown
https://autodiscover-s.outlook.com/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
  • URL Reputation: safe
unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
  • URL Reputation: safe
unknown
https://vondst.legalsense.nl/static/billing/vondst-mail-logo.jpg~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp.0.drfalse
    		unknown
    https://outlook.office365.com/connectors9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://cdn.entity.9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://api.addins.omex.office.net/appinfo/query9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://clients.config.office.net/user/v1.0/tenantassociationkey9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://powerlift.acompli.net9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://rpsticket.partnerservices.getmicrosoftkey.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://lookup.onenote.com/lookup/geolocation/v19B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://cortana.ai9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
    • URL Reputation: safe
    		unknown
    https://eur02.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.von=1e aanmaning Vondst Advocaten.msgfalse
      		unknown
      https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://api.powerbi.com/v1.0/myorg/imports9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://cloudfiles.onenote.com/upload.aspx9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://entitlement.diagnosticssdf.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://api.aadrm.com/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://ofcrecsvcapi-int.azurewebsites.net/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://canary.designerapp.9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://ic3.teams.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://www.yammer.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
      • URL Reputation: safe
      		unknown
      https://api.microsoftstream.com/api/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
        		unknown
        https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
        • URL Reputation: safe
        		unknown
        https://cr.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
        • URL Reputation: safe
        		unknown
        https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
          		unknown
          https://messagebroker.mobile.m365.svc.cloud.microsoft9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
          • URL Reputation: safe
          		unknown
          https://otelrules.svc.static.microsoft9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            		unknown
            https://portal.office.com/account/?ref=ClientMeControl9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://clients.config.office.net/c2r/v1.0/DeltaAdvisory9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://edge.skype.com/registrar/prod9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://graph.ppe.windows.net9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://res.getmicrosoftkey.com/api/redemptionevents9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://powerlift-frontdesk.acompli.net9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://tasks.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://officeci.azurewebsites.net/api/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://sr.outlook.office.net/ws/speech/recognize/assistant/work9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://api.scheduler.9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
            • URL Reputation: safe
            		unknown
            https://my.microsoftpersonalcontent.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
              		unknown
              https://eur02.safelinks.protection.outlook.com/=1e aanmaning Vondst Advocaten.msgfalse
                		unknown
                https://store.office.cn/addinstemplate9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                • URL Reputation: safe
                		unknown
                https://api.aadrm.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                • URL Reputation: safe
                		unknown
                https://edge.skype.com/rps9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                • URL Reputation: safe
                		unknown
                https://outlook.office.com/autosuggest/api/v1/init?cvid=9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  		unknown
                  https://globaldisco.crm.dynamics.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://messaging.engagement.office.com/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://dev0-api.acompli.net/autodetect9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://www.odwebp.svc.ms9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.diagnosticssdf.office.com/v2/feedback9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.powerbi.com/v1.0/myorg/groups9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://web.microsoftstream.com/video/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.addins.store.officeppe.com/addinstemplate9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://graph.windows.net9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://dataservice.o365filtering.com/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vondst.com%2F&data=05%7C02%7CJo~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp.0.drfalse
                    		unknown
                    https://officesetup.getmicrosoftkey.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://analysis.windows.net/powerbi/api9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://aka.ms/LearnAboutSenderIdentification1e aanmaning Vondst Advocaten.msg, ~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://prod-global-autodetect.acompli.net/autodetect9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://substrate.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://outlook.office365.com/autodiscover/autodiscover.json9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://consent.config.office.com/consentcheckin/v1.0/consents9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://d.docs.live.net9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                      		unknown
                      https://safelinks.protection.outlook.com/api/GetPolicy9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                      • URL Reputation: safe
                      		unknown
                      https://ncus.contentsync.9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                      • URL Reputation: safe
                      		unknown
                      https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        		unknown
                        https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        http://weather.service.msn.com/data.aspx9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://apis.live.net/v5.0/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://officepyservice.office.net/service.functionality9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://templatesmetadata.office.net/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://messaging.lifecycle.office.com/9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://mss.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://pushchannel.1drv.ms9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://management.azure.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://outlook.office365.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://wus2.contentsync.9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://incidents.diagnostics.office.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://clients.config.office.net/user/v1.0/ios9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://make.powerautomate.com9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://api.addins.omex.office.net/api/addins/search9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://insertmedia.bing.office.net/odc/insertmedia9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://outlook.office365.com/api/v1.0/me/Activities9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://api.office.net9B610C80-0DE0-4B21-89BA-DA727C431C6D.0.drfalse
                        • URL Reputation: safe
                        		unknown

                        World Map of Contacted IPs

                        ⊘No contacted IP infos

                        General Information

                        Joe Sandbox version:41.0.0 Charoite
                        Analysis ID:1541154
                        Start date and time:2024-10-24 14:09:40 +02:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:0h 4m 52s
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:default.jbs
                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                        Number of analysed new started processes analysed:9
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • HCA enabled
                        • EGA enabled
                        • AMSI enabled
                        Analysis Mode:default
                        Analysis stop reason:Timeout
                        Sample name:1e aanmaning Vondst Advocaten.msg
                        Detection:CLEAN
                        Classification:clean1.winMSG@3/17@0/0
                        EGA Information:Failed
                        HCA Information:
                        • Successful, ratio: 100%
                        • Number of executed functions: 0
                        • Number of non-executed functions: 0
                        Cookbook Comments:
                        • Found application associated with file extension: .msg

                        Warnings

                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                        • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 52.109.28.47, 2.19.126.160, 2.19.126.151, 20.189.173.2
                        • Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, a1864.dscd.akamai.net, ecs.office.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, uks-azsc-000.roaming.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, onedscolprdwus01.westus.cloudapp.azure.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net
                        • Not all processes where analyzed, report is missing behavior information
                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                        • Report size getting too big, too many NtQueryValueKey calls found.
                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                        • VT rate limit hit for: 1e aanmaning Vondst Advocaten.msg

                        Simulations

                        Behavior and APIs

                        ⊘No simulations

                        LLM Input / Output

                        InputOutput
                        URL: Model: claude-3-5-sonnet-20240620
                        {
    "explanation": [
        "The email appears to be a legitimate payment reminder from a law firm (Vondst Advocaten)",
        "The sender's email address (administratie@vondst.com) matches the company name and purpose of the email",
        "The email contains specific details like invoice number, bank account information, and company contact details that are consistent with a genuine business communication"
    ],
    "phishing": false,
    "confidence": 8
}
                        Is this email content a phishing attempt? Please respond only in valid JSON format:
    Email content converted to JSON:
{
    "date": "Wed, 23 Oct 2024 15:09:03 +0200", 
    "subject": "1e aanmaning Vondst Advocaten", 
    "communications": [
        "\tYou don't often get email from administratie@vondst.com. Learn why this is important <https://aka.ms/LearnAboutSenderIdentification>  \n\t\n\n[CAUTION] [THIS EMAIL IS SENT FROM OUTSIDE OUR ORGANIZATION] Do not respond, do not click on links or open attachments unless you trust the sender and know the content is safe.\n\n\nGeachte heer/mevrouw,\n\nHierbij ontvangt u de door ons verzonden declaratie waarvan de betalingstermijn immiddels is overschreden. Wij verzoeken u ons te willen berichten op welke datum u deze declaratie hebt voldaan. Mocht u de declaratie nog niet hebben betaald, dan gelieve u dat alsnog te doen door overmaking op het volgende rekeningnummer onder vermelding van het declaratienummer: 147379.\n\nRabobank, 123.927.927 \nIBAN: NL92RABO0123.927.927 \nSwift Code: RABONL2U\n\nOver declaraties die langer openstaan dan 30 dagen is volgens onze algemene voorwaarden rente verschuldigd ad 1% per maand.\n\nMocht u inmiddels hebben betaald, dan kunt u deze herinnering als niet verzonden beschouwen.\n\nHoogachtend,\n\nVondst Advocaten - Administratie\n\n <https://vondst.legalsense.nl/static/billing/vondst-mail-logo.jpg> \n\nt +31 20 504 2000 (secr.) \ne administratie@vondst.com <https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fadministratie%40vondst.com%2F&data=05%7C02%7CJohn.Bruggink%40exter.com%7Ce5addbe4acfe4f8866ab08dcf363deb9%7C6b6a5f3eff1b4785a4df0b9bac9df946%7C0%7C0%7C638652857771324033%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=G4itRz1jaMTUbtztdLErBV0Z%2BZHMkiQPTNQWMBgMiNo%3D&reserved=0> \nf +31 20 504 2010 \nw www.vondst.com <https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vondst.com%2F&data=05%7C02%7CJohn.Bruggink%40exter.com%7Ce5addbe4acfe4f8866ab08dcf363deb9%7C6b6a5f3eff1b4785a4df0b9bac9df946%7C0%7C0%7C638652857771349317%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=wD57D4JVQg8j7i%2Fi%2FtEbLHP%2Bqywm91XPTYlB5p0iKdU%3D&reserved=0> \n\n<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vondst.com%2F&data=05%7C02%7CJohn.Bruggink%40exter.com%7Ce5addbe4acfe4f8866ab08dcf363deb9%7C6b6a5f3eff1b4785a4df0b9bac9df946%7C0%7C0%7C638652857771368955%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=KNQdTCud%2B73%2FpSg0848mRCfH1GIupd9odeXSyLwQnsU%3D&reserved=0> \nKantooradres \nDe Lairessestraat 111-115 \n1075 HH Amsterdam\n\nPostadres \nPostbus 75781 \n1070 AT Amsterdam\n\nDeze e-mail en eventuele bijlagen zijn uitsluitend bestemd voor de geadresseerde(n) en bevatten mogelijk vertrouwelijke informatie. Indien u geen geadresseerde bent van deze e-mail, verzoeken wij u dit direct door te geven aan de verzender, geen kennis te nemen van de inhoud, deze niet bekend te maken aan derden en deze e-mail van uw systemen te verwijderen. Vondst Advocaten N.V. is ingeschreven in het Handelsregister te Amsterdam onder nr 34279580. Al onze diensten worden uitgevoerd onder toepasselijkheid van onze Algemene Voorwaarden, die kunnen hier <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vondst.com%2Fwp-content%2Fuploads%2F2022%2F01%2FVondst-Algemene-Voorwaarden.pdf&data=05%7C02%7CJohn.Bruggink%40exter.com%7Ce5addbe4acfe4f8866ab08dcf363deb9%7C6b6a5f3eff1b4785a4df0b9bac9df946%7C0%7C0%7C638652857771394491%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Rl8z5leY3Gh%2BAOQb9gxJkFp%2FzFR8xhP1j4HgqW%2Blf4k%3D&reserved=0>  worden gedownload.\n\n"
    ], 
    "from": "Administratie Vondst Advocaten N.V. <administratie@vondst.com>", 
    "to": "John Bruggink <John.Bruggink@exter.com>"
}
                        URL: PDF document Model: claude-3-haiku-20240307
                        ```json
{
  "contains_trigger_text": true,
  "trigger_text": "Wegens juridische werkzaamheden in de maand augustus 2024;",
  "prominent_button_name": "unknown",
  "text_input_field_labels": [
    "Honorarium",
    "Subtotaal",
    "Btw 21% over  440,00",
    "Door u te voldoen"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
                        URL: Email Model: claude-3-haiku-20240307
                        ```json
{
  "contains_trigger_text": true,
  "trigger_text": "Hierbiij ontvangt u de door ons verzonden declaratie waarvan de betalingstermijn inmiddels is overschreden. Wij verzoeken u ons te willen berichten op welke datum u deze declaratie heeft voldaan. Mocht u de declaratie nog niet hebben betaald, dan gelieve u dat alsnog te doen door overmaken op het volgende rekeningnummer onder vermelding van het declaratienummer: 147379.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": [
    "Rabobank, 123.927.927",
    "IBAN: NL92RABO0123.927.927",
    "Swift Code: RABONL2U"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false
}
                        URL: PDF document Model: claude-3-haiku-20240307
                        ```json
{
  "brands": [
    "Vondst"
  ]
}
                        URL: Email Model: claude-3-haiku-20240307
                        ```json
{
  "brands": [
    "Vondst",
    "Rabobank"
  ]
}

                        Joe Sandbox View / Context

                        IPs

                        ⊘No context

                        Domains

                        ⊘No context

                        ASNs

                        ⊘No context

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):231348
                        Entropy (8bit):4.383966337886005
                        Encrypted:false
                        SSDEEP:3072:V5gr1ugGmiGu2uqoQwrt0FvH3Ro/sLGPm:VE4mi2rxRoELGO
                        MD5:0948C449E3B6D217FD0CB9190DD1ACA7
                        SHA1:5F43951FCC0D10B2E6505AAE4D81E4F990E95093
                        SHA-256:0357C1E573FDD5F437B8346770581948DEFDEA22B388A7FF424CB7F30215111B
                        SHA-512:D300673003EB67B89CB345DD9D827222B5070BC0606869513725322C7B74E76248632FDDB37A4B656747C7B904B4C4F0B6FFFA6953F5747C0463A836014A1A70
                        Malicious:false
                        Reputation:low
                        Preview:TH02...... .@...&......SM01X...,...P....&..........IPM.Activity...........h...............h............H..h.;............h...........H..h\tin ...pDat...hx...0...(.;....hS..............h........_`3k...h....@...I.Rw...h....H...8.8k...0....T...............d.........2h...............k..............!h.............. h.j.S....@.;...#h....8.........$h.......8....."h..............'h..k...........1hS...<.........0h....4....8k../h....h.....8kH..hP#..p....;...-h .......l.;...+h..........;.....1.7.6.F.2.A. ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:ASCII text, with very long lines (65536), with no line terminators
                        Category:dropped
                        Size (bytes):322260
                        Entropy (8bit):4.000299760592446
                        Encrypted:false
                        SSDEEP:6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
                        MD5:CC90D669144261B198DEAD45AA266572
                        SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                        SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                        SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                        Malicious:false
                        Reputation:high, very likely benign file
                        Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:ASCII text, with no line terminators
                        Category:modified
                        Size (bytes):10
                        Entropy (8bit):2.1219280948873624
                        Encrypted:false
                        SSDEEP:3:LMF:y
                        MD5:FE35E3E4234F3D7F2254EAC74BCE6A7D
                        SHA1:E1D1AD89A5E682106723CE4F13D9C38B6EEE34C8
                        SHA-256:3F852E9CD49C7023C1142C8B97828426A87DDF5DF9489CA4702E3B6AE86726C0
                        SHA-512:F0EE9FD6D9A4CCFABD04B61420F454315CE504FC65A103E65F5FF2B42E8CB7226F10922715C347838D70C63957CD6B022B37384D08F30B5AB35A24755334CEB1
                        Malicious:false
                        Reputation:low
                        Preview:1729771872

                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9B610C80-0DE0-4B21-89BA-DA727C431C6D

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):178267
                        Entropy (8bit):5.290263142504655
                        Encrypted:false
                        SSDEEP:1536:Ti2XfRAqFbH41gwEwLe7HW8QM/o/NMdcAZl1p5ihs7EXXDEAD2Odago:5Ce7HW8QM/o/TXgk9o
                        MD5:05A5C67400819A11993AA2D150776B10
                        SHA1:AE9800B4B6E36584249632E901E3743BAADA76E6
                        SHA-256:339F0DF207C577E2998ED2EE19A865D1A8A70924505AC32561DF4E3110427EC0
                        SHA-512:52DF720082A343C04FA73F460B106A3908E27FA455F4C0331048B001209E39C19159FB48441AF8C6B26CEC664B863425CE572DD4C9A7C2CFF4A9321229372B3D
                        Malicious:false
                        Reputation:low
                        Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-24T12:11:05">.. Build: 16.0.18209.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                        Category:dropped
                        Size (bytes):4096
                        Entropy (8bit):0.09304735440217722
                        Encrypted:false
                        SSDEEP:3:lSWFN3l/klslpEl9Xll:l9F8E+9
                        MD5:D0DE7DB24F7B0C0FE636B34E253F1562
                        SHA1:6EF2957FDEDDC3EB84974F136C22E39553287B80
                        SHA-256:B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
                        SHA-512:42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
                        Malicious:false
                        Reputation:high, very likely benign file
                        Preview:SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:SQLite Rollback Journal
                        Category:dropped
                        Size (bytes):4616
                        Entropy (8bit):0.13784977103055013
                        Encrypted:false
                        SSDEEP:3:7FEG2l+RhXlllEl/FllkpMRgSWbNFl/sl+ltlslN04l9XllRhXn:7+/l2/lSg9bNFlEs1E39/Xn
                        MD5:4BED237F9624FC67BABC9F5D55D5D706
                        SHA1:691A74B226B1A83B498DCE75D1C848FDD10F4125
                        SHA-256:F1E4E9DFE409A1D9A35811C60DA44616CE79A5A70FFC268F223F21CC1A96B86C
                        SHA-512:2608E1514BDE333ACBBC78A4FD85AF5D2FC9C9E45D5DDDBE7303F8D9A9544847A5457C06F4DC17856FA771A864E753D0282E01804646FEDCEC2AED1A6EE7600F
                        Malicious:false
                        Reputation:low
                        Preview:.... .c.....s3......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):32768
                        Entropy (8bit):0.04441244726134427
                        Encrypted:false
                        SSDEEP:3:G4l2iWju9FHIal2iWju9Ftl/lWlL9//Xlvlll1lllwlvlllglbXdbllAlldl+l:G4l21O6al21OiL9XXPH4l942U
                        MD5:4A03AA8E21A1A84DB0A2FCF6DEB77FCC
                        SHA1:C3C200F0612B974E817C30F5ADC8C2DFBACD7E92
                        SHA-256:9571CF5CB7AD2B668279AC991688A57FE997B487F9704F9C7F583546A1B9FBE7
                        SHA-512:FDB8F59CDA351BD4DCCD71A915AA027347F1A5890B05E8D396C0777CC44572E51323779F6A79DF7F130126260FCCF6A386FF8B8049BBD4E73A50DBDB4D04E744
                        Malicious:false
                        Preview:..-.......................7.M.n-W.o.KX0.[\c.>b.@..-.......................7.M.n-W.o.KX0.[\c.>b.@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:SQLite Write-Ahead Log, version 3007000
                        Category:dropped
                        Size (bytes):45352
                        Entropy (8bit):0.3939581326820173
                        Encrypted:false
                        SSDEEP:24:KgAnlqQMIzRDjXill7DBtDi4kZERDVlM9Qxqt8VtbDBtDi4kZERDMW5c9:teIQj3Xill7DYMhlMmxO8VFDYMQ
                        MD5:E16395A4D18488E250FF4B418B6740F2
                        SHA1:9608B61A177ABB34EC89F44DD9DB51293EDCFA30
                        SHA-256:41C9540C4B26B9A92A206F252C13628B3EF8CF52694BE2E9CFF0514CED00FEED
                        SHA-512:0637D8132322FA5723D591CDC935D0D81F7E5797B0865A15A98A1BF3A31AA4B8CC069BAEC3DE837B686186537B0788D55A6B2E66ECA9E9CCCFFFEE4F4906B47F
                        Malicious:false
                        Preview:7....-..........W.o.KX0..V.j.nOZ........W.o.KX0....X....SQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{565E27DC-6048-43A9-90D8-107480DDAA71}.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):10300
                        Entropy (8bit):3.736607814345117
                        Encrypted:false
                        SSDEEP:192:Fp4NcfDM4wRTmN0wTmNkwwsmBsSxwamU:j4C1wRo0w2wbw
                        MD5:50C0C35179514E2951430A39DE7C113B
                        SHA1:EB581CA439B1C2832C1801DC0B41D95A86B7E3CD
                        SHA-256:3354BF8217817B782AA0148EACAC2048BA2C8D4C3F0EC352A6A927FEA4662DCF
                        SHA-512:2A5EBA9AA7ECD7B39064A5564BF94C5D908A59F5ABA779963F0C079AAB06B812DF57679D17D4B8AA07C444562AA735A0445580F66D50B5E54CF8BACBA008A0DD
                        Malicious:false
                        Preview:......Y.o.u. .d.o.n.'.t. .o.f.t.e.n. .g.e.t. .e.m.a.i.l. .f.r.o.m. .a.d.m.i.n.i.s.t.r.a.t.i.e.@.v.o.n.d.s.t...c.o.m... .H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.a.k.a...m.s./.L.e.a.r.n.A.b.o.u.t.S.e.n.d.e.r.I.d.e.n.t.i.f.i.c.a.t.i.o.n."...........................................................................................................................................................................................................................................................................................................................................@...Z......."...................................................................................................................................................................................................................................................................................................................................................d....-D..M............*...$..$.If........!v..h.#v....:V.......t.....6......5.......4

                        C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729771862359119600_2F825A4D-4420-4FD2-B449-E8C9D7A229C4.log

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:ASCII text, with very long lines (28744), with CRLF line terminators
                        Category:dropped
                        Size (bytes):20971520
                        Entropy (8bit):0.17659845941849142
                        Encrypted:false
                        SSDEEP:1536:CE6a6jLIWiTT/DzAEJUuCi4/rBSYiP7xEBMRojDS/FlgasjyBQVFWb:mjETfzAfq/ZAnW
                        MD5:A7A55BDDD34EC27F29C40DC29CF548B8
                        SHA1:8BF2C0C8AF7BAF702789DB94C6EC6BBAB59D580A
                        SHA-256:93D0C44BDDAC5F044A19778CAEA3D3C2633221364EFF04C4B35B638E0931B2CB
                        SHA-512:372C5F0449FE09D54352A595D99CDDD5B73D0174F6E61490B82395EB8A98A198EB67303454B317A2774B8CBB6412561C218C6636FC1C6087B274CAA4F1C58407
                        Malicious:false
                        Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/24/2024 12:11:02.426.OUTLOOK (0xE30).0xCA4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":15,"Time":"2024-10-24T12:11:02.426Z","Contract":"Office.System.Activity","Activity.CV":"TVqCLyBE0k+0SejJ16IpxA.4.9","Activity.Duration":12,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/24/2024 12:11:02.457.OUTLOOK (0xE30).0xCA4.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":23,"Time":"2024-10-24T12:11:02.457Z","Contract":"Office.System.Activity","Activity.CV":"TVqCLyBE0k+0SejJ16IpxA.4.10","Activity.Duration":12140,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersi

                        C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729771862360143700_2F825A4D-4420-4FD2-B449-E8C9D7A229C4.log

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):20971520
                        Entropy (8bit):0.0
                        Encrypted:false
                        SSDEEP:3::
                        MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                        SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                        SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                        SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                        Malicious:false
                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241024T0811010785-3632.etl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):94208
                        Entropy (8bit):4.465394047083513
                        Encrypted:false
                        SSDEEP:768:rZ1q9BfasRvNGU4CqsSUEmw9NSo9VW9NWbXNep5ZOyWOWR9/:rZe461w9NSAXoQv
                        MD5:90C32D0E2C0048A5103A103ABEC1614C
                        SHA1:0C8BB845F682E94E48B2AE804CAD72685838E6C2
                        SHA-256:96A798EE618963608CAA5F130642B322EA1B248F6990BCBBAC99271342178EA7
                        SHA-512:80B357AA17C67292D26EA02DF5793732CB7D5F52873230F4F4CBA475EE6DFB60A41FC526189DD40004A488090CD87DB7941FF2C3DE234E0C3D027BCDFC9BFDCF
                        Malicious:false
                        Preview:............................................................................^.......0........&..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................`./._................&..........v.2._.O.U.T.L.O.O.K.:.e.3.0.:.0.8.9.0.f.1.f.e.1.8.5.3.4.3.f.8.b.1.4.c.7.f.8.2.8.f.5.6.3.d.8.8...C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.4.T.0.8.1.1.0.1.0.7.8.5.-.3.6.3.2...e.t.l.........P.P.....0........&..........................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Temp\~DF34DEB7EF051F4AAE.TMP

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):163840
                        Entropy (8bit):0.40513660086885833
                        Encrypted:false
                        SSDEEP:192:mA1zyml/YSXHnkmHBQG4ywrmei5gNgz0XHWQOoIAbAFAqwNh/:Zzj/lEOmG4F7i5/z0XHOoIMu
                        MD5:7C2C0E4822FBB5105A125F854CD9658F
                        SHA1:BC04F81B2284695FC69C5E5BD1BAD3D49A050AB4
                        SHA-256:42C937906E4AF869F641FF293422DD19FBBBF2107AB48F529655F6BB520D44F6
                        SHA-512:19B559FBB28918377C05754FBC09A350549B2E2C95D97C238794EB21B3693DF3A21AF48DA81E1D0090AC2A513D2C8922DA2EBC8F0CC350CCD9B3080668C1D717
                        Malicious:false
                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):30
                        Entropy (8bit):1.2389205950315936
                        Encrypted:false
                        SSDEEP:3:rat:
                        MD5:51D5D96377E73470847F07C782195189
                        SHA1:10E628A27F99B2DDDFD30D440DABEA96BF4ACCEC
                        SHA-256:6ABAA63F918B4632B84952249B24C2EBB2A2022427BDA8C6278C97FF1C27E154
                        SHA-512:B9A600BFC7A3EB860457E787C1A2E2BAA5F13835EAB8291CC6DA317BA47E6191443AD4A194126F9710BF3D95CB5C940C96D918EE79AB74B7E849FA890B3F8596
                        Malicious:false
                        Preview:.............................

                        C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:Composite Document File V2 Document, Cannot read section info
                        Category:dropped
                        Size (bytes):16384
                        Entropy (8bit):0.6697515851668764
                        Encrypted:false
                        SSDEEP:12:rl3baFwqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheCQ:rqmnq1Py961Q
                        MD5:E56E5008DDFF32990A36E8FB0DCE3F71
                        SHA1:15DD6197AA021D06FAE7F58D502E14C69C5474EE
                        SHA-256:459F5069A21B4B6837FB383066312BEDF1D2E9A726289A26182B8A4B5FD84ADB
                        SHA-512:6648021C5EB23B1AF78817CA44F728F18EE63C65EE38BEF730342AB16318C3ACC4DEDB50C546EB9A55333C2444ED3FB0761A32423A3FEB41484A35EDE8118494
                        Malicious:false
                        Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:Microsoft Outlook email folder (>=2003)
                        Category:dropped
                        Size (bytes):271360
                        Entropy (8bit):1.5117350967702463
                        Encrypted:false
                        SSDEEP:768:EQcPRSfWjy25Fdd4o3yqtclUfPmagG5GQcA8BUTIZ:BZ2r4jqtIOGQcAeNZ
                        MD5:197B05270CAD579166CDA1D207337270
                        SHA1:A8CAB6B1C123FB192494E333B4B51748093AA8B7
                        SHA-256:C817BE6E21C84FED0CBDBBE180F535A912E3D682574378EC3D5A13675BD09409
                        SHA-512:E392BFA613AF7F136B0E6F509E81F304A0D7C466C66E91389641245F46AD368EE2C45CA58BBA8E7782B7346FE99C6960EF0B3826144715DFA9CBD2376EE31C4B
                        Malicious:false
                        Preview:!BDN.|^aSM......\...bx..................]................@...........@...@...................................@...........................................................................$.......D.......:.......................|...............r..................................................................................................................................................................................................................................................................................H........U\.C*......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                        Download File
                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        File Type:data
                        Category:dropped
                        Size (bytes):131072
                        Entropy (8bit):0.631749713702387
                        Encrypted:false
                        SSDEEP:96:8H2HonLKZHQVg1hLKxHMdjRJ1VZUjRFaet2HHVMlDpWHDT6H2HonLKZH:lI2Eg1w9mt2PHOHzI2
                        MD5:979B87A46565D07F6A92B65F9845E414
                        SHA1:ABBA3A81D09FAE3362475A2E44BF281C597896A4
                        SHA-256:66C1086364F38FA86B9869287734BD72D5CEE2837376B25B0CD08CB4A7AF9A45
                        SHA-512:B13B17EBF1D2A53866BEE5B2523C48E2D2CE048365C3984EFF385C9103DB799022620C01FDA1D75317C907F2DB9E25FF1C5325260B215937429C52B3EDC4895F
                        Malicious:false
                        Preview:.o.>C...S.......0...f....&....................#.!BDN.|^aSM......\...bx..................]................@...........@...@...................................@...........................................................................$.......D.......:.......................|...............r..................................................................................................................................................................................................................................................................................H........U\.C*..f....&.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                        Static File Info

                        General

                        File type:CDFV2 Microsoft Outlook Message
                        Entropy (8bit):6.411045835528834
                        TrID:
                        • Outlook Message (71009/1) 45.36%
                        • Outlook Form Template (41509/1) 26.51%
                        • ClickyMouse macro set (36024/1) 23.01%
                        • Generic OLE2 / Multistream Compound File (8008/1) 5.12%
                        File name:1e aanmaning Vondst Advocaten.msg
                        File size:272'384 bytes
                        MD5:cf9248a79027f0311a954353072e570d
                        SHA1:18e25b46d4b7215feb9aaaf7bfe4cbb5bdfdba8b
                        SHA256:f0ff8e4537c8e0025c8584fe965d3b4856db1d3f385f4487bfedfc3a5b0f0a77
                        SHA512:758bfaf0af1b14c0b79fffeb8ed8fe3e887a39d9da58a712f12dd828f1b936287f95da33b155dea3e688b00cc60fbcb7b2897fff1e04d0abb2b1db4e599395bc
                        SSDEEP:3072:h8A/GfX5m6FwhXkmH+LZpEVZ+sOa5OyAOo8V1vCb1i4ji:jGrmMpHs5A18V1ab1F
                        TLSH:B3441C13ED98860BF12287BDFAA37C79121E7A51FAD3B7F510742EDB0A614019C93639
                        File Content Preview:........................>......................................................................................................................................................................................................................................

                        Static Mail

                        General

                        Subject:1e aanmaning Vondst Advocaten
                        From:Administratie Vondst Advocaten N.V. <administratie@vondst.com>
                        To:John Bruggink <John.Bruggink@exter.com>
                        Cc:
                        BCC:
                        Date:Wed, 23 Oct 2024 15:09:03 +0200
                        Communications:
                        • You don't often get email from administratie@vondst.com. Learn why this is important <https://aka.ms/LearnAboutSenderIdentification> [CAUTION] [THIS EMAIL IS SENT FROM OUTSIDE OUR ORGANIZATION] Do not respond, do not click on links or open attachments unless you trust the sender and know the content is safe. Geachte heer/mevrouw, Hierbij ontvangt u de door ons verzonden declaratie waarvan de betalingstermijn immiddels is overschreden. Wij verzoeken u ons te willen berichten op welke datum u deze declaratie hebt voldaan. Mocht u de declaratie nog niet hebben betaald, dan gelieve u dat alsnog te doen door overmaking op het volgende rekeningnummer onder vermelding van het declaratienummer: 147379. Rabobank, 123.927.927 IBAN: NL92RABO0123.927.927 Swift Code: RABONL2U Over declaraties die langer openstaan dan 30 dagen is volgens onze algemene voorwaarden rente verschuldigd ad 1% per maand. Mocht u inmiddels hebben betaald, dan kunt u deze herinnering als niet verzonden beschouwen. Hoogachtend, Vondst Advocaten - Administratie <https://vondst.legalsense.nl/static/billing/vondst-mail-logo.jpg> t +31 20 504 2000 (secr.) e administratie@vondst.com <https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fadministratie%40vondst.com%2F&data=05%7C02%7CJohn.Bruggink%40exter.com%7Ce5addbe4acfe4f8866ab08dcf363deb9%7C6b6a5f3eff1b4785a4df0b9bac9df946%7C0%7C0%7C638652857771324033%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=G4itRz1jaMTUbtztdLErBV0Z%2BZHMkiQPTNQWMBgMiNo%3D&reserved=0> f +31 20 504 2010 w www.vondst.com <https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vondst.com%2F&data=05%7C02%7CJohn.Bruggink%40exter.com%7Ce5addbe4acfe4f8866ab08dcf363deb9%7C6b6a5f3eff1b4785a4df0b9bac9df946%7C0%7C0%7C638652857771349317%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=wD57D4JVQg8j7i%2Fi%2FtEbLHP%2Bqywm91XPTYlB5p0iKdU%3D&reserved=0> <https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vondst.com%2F&data=05%7C02%7CJohn.Bruggink%40exter.com%7Ce5addbe4acfe4f8866ab08dcf363deb9%7C6b6a5f3eff1b4785a4df0b9bac9df946%7C0%7C0%7C638652857771368955%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=KNQdTCud%2B73%2FpSg0848mRCfH1GIupd9odeXSyLwQnsU%3D&reserved=0> Kantooradres De Lairessestraat 111-115 1075 HH Amsterdam Postadres Postbus 75781 1070 AT Amsterdam Deze e-mail en eventuele bijlagen zijn uitsluitend bestemd voor de geadresseerde(n) en bevatten mogelijk vertrouwelijke informatie. Indien u geen geadresseerde bent van deze e-mail, verzoeken wij u dit direct door te geven aan de verzender, geen kennis te nemen van de inhoud, deze niet bekend te maken aan derden en deze e-mail van uw systemen te verwijderen. Vondst Advocaten N.V. is ingeschreven in het Handelsregister te Amsterdam onder nr 34279580. Al onze diensten worden uitgevoerd onder toepasselijkheid van onze Algemene Voorwaarden, die kunnen hier <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vondst.com%2Fwp-content%2Fuploads%2F2022%2F01%2FVondst-Algemene-Voorwaarden.pdf&data=05%7C02%7CJohn.Bruggink%40exter.com%7Ce5addbe4acfe4f8866ab08dcf363deb9%7C6b6a5f3eff1b4785a4df0b9bac9df946%7C0%7C0%7C638652857771394491%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Rl8z5leY3Gh%2BAOQb9gxJkFp%2FzFR8xhP1j4HgqW%2Blf4k%3D&reserved=0> worden gedownload.
                        Attachments:
                        • Declaratie 147379 - Exter B.V. - Exter DSM.pdf

                        Headers

                        Key Value
                        Receivedby mta-64-143.flowmailer.net with ESMTPSA id 20241023130903ad513fcbb2000c1207
                        AM8P193MB0931.EURP193.PROD.OUTLOOK.COM with HTTPS; Wed, 23 Oct 2024 1309:36
                        by DBAP193MB1067.EURP193.PROD.OUTLOOK.COM (260310a6:10:1cb::5) with
                        2024 1309:04 +0000
                        (260310a6:20b:31f::32) with Microsoft SMTP Server (version=TLS1_2,
                        Transport; Wed, 23 Oct 2024 1309:04 +0000
                        15.20.8093.14 via Frontend Transport; Wed, 23 Oct 2024 1309:04 +0000
                        Wed, 23 Oct 2024 1509:03 +0200
                        FromAdministratie Vondst Advocaten N.V. <administratie@vondst.com>
                        ToJohn Bruggink <John.Bruggink@exter.com>
                        Subject1e aanmaning Vondst Advocaten
                        Thread-Topic1e aanmaning Vondst Advocaten
                        Thread-IndexAQHbJUzPLlWj5PImp0y2zEwaVLpJTA==
                        DateWed, 23 Oct 2024 13:09:03 +0000
                        Message-ID<fm-17605-20241023130903ad513fcbb2000c1207-n93K5m@bounces.vondst.com>
                        Content-Languageen-US
                        X-MS-Exchange-Organization-AuthSourceAM2PEPF0001C709.eurprd05.prod.outlook.com
                        X-MS-Has-Attachyes
                        X-MS-Exchange-Organization-Network-Message-Ide5addbe4-acfe-4f88-66ab-08dcf363deb9
                        X-MS-TNEF-Correlatorreceived-spf: Pass (protection.outlook.com: domain of bounces.vondst.com
                        x-ms-publictraffictypeEmail
                        x-forefront-antispam-reportCIP:185.136.64.143;CTRY:NL;LANG:nl;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mta-64-143.flowmailer.net;PTR:mta-64-143.flowmailer.net;CAT:NONE;SFTY:9.25;SFS:(13230040)(69100299015)(5073199012)(4076899003)(8096899003);DIR:INB;SFTY:9.25;
                        authentication-resultsspf=pass (sender IP is 185.136.64.143)
                        dkim-signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=s1;
                        h=fromfrom:sender:to:to:cc:subject:subject:content-type:content-type:content-transfer-encoding:Date:Message-ID:MIME-Version;
                        x-ms-office365-filtering-correlation-ide5addbe4-acfe-4f88-66ab-08dcf363deb9
                        x-ms-traffictypediagnosticAM2PEPF0001C709:EE_|DBAP193MB1067:EE_|AM8P193MB0931:EE_
                        x-ms-exchange-transport-crosstenantheadersstampedDBAP193MB1067
                        x-eopattributedmessage0
                        x-microsoft-antispamBCL:0;ARA:13230040|69100299015|5073199012|4076899003|8096899003;
                        x-ms-exchange-crosstenant-originalarrivaltime23 Oct 2024 13:09:04.3147 (UTC)
                        x-ms-exchange-crosstenant-network-message-ide5addbe4-acfe-4f88-66ab-08dcf363deb9
                        x-ms-exchange-crosstenant-id6b6a5f3e-ff1b-4785-a4df-0b9bac9df946
                        x-ms-exchange-crosstenant-fromentityheaderInternet
                        x-ms-exchange-transport-endtoendlatency00:00:32.6374726
                        x-ms-exchange-processed-by-bccfoldering15.20.8093.014
                        x-eoptenantattributedmessage6b6a5f3e-ff1b-4785-a4df-0b9bac9df946:0
                        x-ms-exchange-crosstenant-authsourceAM2PEPF0001C709.eurprd05.prod.outlook.com
                        x-ms-exchange-crosstenant-authasAnonymous
                        x-ms-exchange-atpmessagepropertiesSA|SL
                        X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
                        X-Microsoft-Antispam-Message-Info=?us-ascii?Q?B3JjZRh7eSh0KIpgPwBbMU8JuZG+/l5ClKYSk9G9EQVHnL27r2+IDWQZCfuo?=
                        Content-Typemultipart/mixed;
                        MIME-Version1.0
                        dateWed, 23 Oct 2024 15:09:03 +0200

                        File Icon

                        Icon Hash:c4e1928eacb280a2

                        Network Behavior

                        ⊘No network behavior found

                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:08:10:58
                        Start date:24/10/2024
                        Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                        Wow64 process (32bit):true
                        Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\1e aanmaning Vondst Advocaten.msg"
                        Imagebase:0xad0000
                        File size:34'446'744 bytes
                        MD5 hash:91A5292942864110ED734005B7E005C0
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:false

                        General

                        Target ID:4
                        Start time:08:11:05
                        Start date:24/10/2024
                        Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "656D964E-C486-41BA-9D58-BA6A0F66008F" "9DAEA637-B84A-4F6C-B888-977ED1238558" "3632" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                        Imagebase:0x7ff66fd60000
                        File size:710'048 bytes
                        MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:false

                        Disassembly

                        ⊘No disassembly