Edit tour

Windows Analysis Report
Facture #F-000687 - Assek Technologies.eml

Overview

General Information

Sample name:	Facture #F-000687 - Assek Technologies.eml
Analysis ID:	1542138
MD5:	b9b4ac876f373b3e0f370405af375604
SHA1:	c20f6b5a29e8995e317703a2f00e4778db783518
SHA256:	502a1e854a1589176ef3fc3615b3458c96677cc6da413329f490bfc6ff512632
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected potential phishing Email

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

System is w10x64

OUTLOOK.EXE (PID: 1072 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Facture #F-000687 - Assek Technologies.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6812 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8CBFA21-038B-4C41-B379-020DC630673E" "4DE0A6A6-E184-4724-B159-EDE55E4ADDE2" "1072" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1072, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.office.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://api.scheduler.
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://app.powerbi.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://augloop.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: ~WRS{F2378D1A-5B71-41B6-BA95-04A72BEB8715}.tmp.0.dr	String found in binary or memory: https://books.zoho.com/api/v3/settings/templates/invoicelogo/2-9f5f6126fb9f5927bb890a052eb3e49c534d1
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://canary.designerapp.
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.entity.
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://clients.config.office.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cortana.ai
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://cr.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://d.docs.live.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://directory.services.
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ecs.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://graph.windows.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://invites.office.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://login.windows.local
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://management.azure.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://management.azure.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://mss.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://outlook.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://service.powerapps.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://substrate.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://tasks.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	String found in binary or memory: https://www.yammer.com
Source: ~WRS{F2378D1A-5B71-41B6-BA95-04A72BEB8715}.tmp.0.dr	String found in binary or memory: https://zohosecurepay.com/books/assektechnologie/secure?CInvoiceID=2-f2ca58a7bd9c8b8361df608f371ed09

Source: classification engine

Classification label: sus21.winEML@3/16@0/0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T0936180008-1072.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Facture #F-000687 - Assek Technologies.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8CBFA21-038B-4C41-B379-020DC630673E" "4DE0A6A6-E184-4724-B159-EDE55E4ADDE2" "1072" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8CBFA21-038B-4C41-B379-020DC630673E" "4DE0A6A6-E184-4724-B159-EDE55E4ADDE2" "1072" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email contains a suspicious external payment link (zohosecurepay.com) which is a common phishing tactic

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://api.diagnosticssdf.office.com	0%	URL Reputation	safe
https://login.microsoftonline.com/	0%	URL Reputation	safe
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://api.addins.omex.office.net/appinfo/query	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/tenantassociationkey	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/imports	0%	URL Reputation	safe
https://cloudfiles.onenote.com/upload.aspx	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://entitlement.diagnosticssdf.office.com	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
https://ic3.teams.office.com	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://portal.office.com/account/?ref=ClientMeControl	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://graph.ppe.windows.net	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://globaldisco.crm.dynamics.com	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.diagnosticssdf.office.com/v2/feedback	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://analysis.windows.net/powerbi/api	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
https://outlook.office365.com/autodiscover/autodiscover.json	0%	URL Reputation	safe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://officepyservice.office.net/service.functionality	0%	URL Reputation	safe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	0%	URL Reputation	safe
https://templatesmetadata.office.net/	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://messaging.lifecycle.office.com/	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://mss.office.com	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://management.azure.com	0%	URL Reputation	safe
https://outlook.office365.com	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://incidents.diagnostics.office.com	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://insertmedia.bing.office.net/odc/insertmedia	0%	URL Reputation	safe
https://outlook.office365.com/api/v1.0/me/Activities	0%	URL Reputation	safe
https://api.office.net	0%	URL Reputation	safe
https://incidents.diagnosticssdf.office.com	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/android/policies	0%	URL Reputation	safe
https://entitlement.diagnostics.office.com	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://shell.suite.office.com:1443	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/connectors	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://powerlift.acompli.net	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://cortana.ai	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/imports	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://cloudfiles.onenote.com/upload.aspx	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnosticssdf.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://ic3.teams.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.microsoftstream.com/api/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false		unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://cr.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false		unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false		unknown
https://portal.office.com/account/?ref=ClientMeControl	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://graph.ppe.windows.net	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.scheduler.	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false		unknown
https://store.office.cn/addinstemplate	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false		unknown
https://globaldisco.crm.dynamics.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://dataservice.o365filtering.com/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://prod-global-autodetect.acompli.net/autodetect	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://d.docs.live.net	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false		unknown
https://safelinks.protection.outlook.com/api/GetPolicy	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false		unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://apis.live.net/v5.0/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://officepyservice.office.net/service.functionality	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://templatesmetadata.office.net/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://messaging.lifecycle.office.com/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://mss.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://management.azure.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://zohosecurepay.com/books/assektechnologie/secure?CInvoiceID=2-f2ca58a7bd9c8b8361df608f371ed09	~WRS{F2378D1A-5B71-41B6-BA95-04A72BEB8715}.tmp.0.dr	false		unknown
https://wus2.contentsync.	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://make.powerautomate.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://api.office.net	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnosticssdf.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://asgsmsproxyapi.azurewebsites.net/	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnostics.office.com	38ED6951-AC2F-4C2D-95C9-E356F05C353E.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542138
Start date and time:	2024-10-25 15:34:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Facture #F-000687 - Assek Technologies.eml
Detection:	SUS
Classification:	sus21.winEML@3/16@0/0
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 52.109.32.7, 2.19.126.151, 2.19.126.160, 52.182.143.210
Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com, eur.roaming1.live.com.akadns.net, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, onedscolprdcus10.centralus.cloudapp.azure.com, a1864.dscd.akamai.net, ecs.office.com, ukw-azsc-000.roaming.officeapps.live.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Facture #F-000687 - Assek Technologies.eml

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.375609069353968
Encrypted:	false
SSDEEP:	3072:3IgL+P4nIgVmiGu2jqoQWrt0FvgslT2hciD:3pBmi22rlT2hc+
MD5:	6966245C408DF45F2562C0AEFF19793C
SHA1:	E7AF101FA0E5232FF83F343B189E75CD3FE669DA
SHA-256:	52FEC996C0CC9C4415F033A9E065D35EC7AE3CAF9374CBA00172AB21CE18F791
SHA-512:	CE751A80F70D5F81FC488D890BCA98ABB56A409A2BEB28BFE7E87164136BF5F7D93015BC8B13227C2A70D557B22AA4207F5D47EAA9AC38A66CAFF2337B221C4B
Malicious:	false
Reputation:	low
Preview:	TH02...... .@....&......SM01X...,...`y...&..........IPM.Activity...........h...............h............H..h...............h.........N'.H..h\tin ...pDat...h./..0...X......ho.....(........h........_`0k...h3...@...I.Rw...h....H...8.5k...0....T...............d.........2h...............k..............!h.............. h.c.x....p.....#h....8.........$h.N'.....8....."h..).....(.)...'h..............1ho...<.........0h....4....5k../h....h.....5kH..hpn(.p.........-h .............+h..............0.;.2.7.6.9. ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:	6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:LMQn:z
MD5:	A15280C7FEDA59FE3988D7CF2B73C4AF
SHA1:	3682C31237E040E217404E146D9F992E66D5B474
SHA-256:	F4B4854029CC88B0B1608D89C97710C3CE389A4770D74429B99C14F298FDFBF8
SHA-512:	38FBFBDE067A9923E51030CF3D489E6ED999094FAEB18E55F76A7076D6776F5E96738135D412D873C967B6262EFCB46FD8CCBFFEF26CA4EF9AD260EFA56DFC4C
Malicious:	false
Preview:	1729863390

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\38ED6951-AC2F-4C2D-95C9-E356F05C353E

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178267
Entropy (8bit):	5.290269064834387
Encrypted:	false
SSDEEP:	1536:Qi2XfRAqFbH41gwEwLe7HW8QM/o/NMdcAZl1p5ihs7EXXDEAD2Odago:iCe7HW8QM/o/TXgk9o
MD5:	606EF65DA11BC201E03E228B500857D2
SHA1:	2CACFF723AC5461CFC3FEDEC212DD5340733D4CD
SHA-256:	8E5A6729D32CC64197EB4ACA95F1E920F5AFFEF6ED1AF4CEE7E1D41DB7E39EA8
SHA-512:	06EBCC09922A2534E89256928E13CA3778FDC95B2F0F30DE25804B840A3BFBF55D02E47E79E16AD8CB5B74011E48B23FCE95BFEEF1058D50B07917777EB8F98C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-25T13:36:21">.. Build: 16.0.18209.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09304735440217722
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpEl9Xll:l9F8E+9
MD5:	D0DE7DB24F7B0C0FE636B34E253F1562
SHA1:	6EF2957FDEDDC3EB84974F136C22E39553287B80
SHA-256:	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
SHA-512:	42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13784977103055013
Encrypted:	false
SSDEEP:	3:7FEG2l+m024lll/FllkpMRgSWbNFl/sl+ltlslN04l9XllSn:7+/lZPoBg9bNFlEs1E39q
MD5:	2A48A2E672FCC23278B493871E4EB4D2
SHA1:	E54F3306FA3A2D56F6E327C6ACE91DB1B858C769
SHA-256:	A1652345C03006993339967ED831EB6F39CFA487130A0280251F8825C8B3E696
SHA-512:	6F0E9A939D4A63613A2F4377120929991B25E69225208DE6A1773A9AD0C7803F9239E3718EF6687FA047207050DE153F9B7207668786A7376C80B66F04A0B9C0
Malicious:	false
Preview:	.... .c.....C......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04412598418920338
Encrypted:	false
SSDEEP:	6:G4l2QZ+/H2zt4l2QZ+/H25L9XXPH4l942U:l2B/H2xo2B/H255A0
MD5:	2F94EB100F9E8666B477BF51D05E0797
SHA1:	E54E0C927853FE3760F8943CA7C5E3DBB2AD2BDE
SHA-256:	D2F64E9909F7E48F93D36226551EB2B7F1C865FD5D1B574CB9D911C0BDB58062
SHA-512:	32C1E68D1E42A90977FBEC26B3DD292CA52A0D5377CD800A86CE35CEEB73A9854D674387931DDAD70821FEAC1A5CB5E3F7065266B369788E3EB7C06950768294
Malicious:	false
Preview:	..-.......................i.........7..7W.....-...-.......................i.........7..7W.....-.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3953380518090994
Encrypted:	false
SSDEEP:	24:KTluQMIzRDbmj+ill7DBtDi4kZERDBPxqt8VtbDBtDi4kZERD36ZWf:OluQjPk+ill7DYMhxO8VFDYMj
MD5:	390DC41A9621C44C72E511A911706E65
SHA1:	A05001792A114679E997E4680CAFABC8FB5C9688
SHA-256:	041777ACB373B995DDB08A970FD3BB7CA8C7B5126B4251529F97B475D347AC7E
SHA-512:	40F57734C125DD2DE32F534106759E0B7B8EB789482F2055D0AD1CBEA00F357AFD46F581A8B1E7071513AFFD70C2F8A5275FE0EDB74AAC89677003C0219ECCBE
Malicious:	false
Preview:	7....-..............7..7..................7..7.X{4`8..SQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F2378D1A-5B71-41B6-BA95-04A72BEB8715}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	5136
Entropy (8bit):	3.8643736763586647
Encrypted:	false
SSDEEP:	48:0tkfsUsA6+p50fh8a5aR+sNZVjgVQU5ggeVLHvffQSJsYa3:PsA6Y5uERxbLBHLa3
MD5:	85A78FB222D50FA1AC9394202F330BDC
SHA1:	FFEAA0F4229B7C9974D3C3BF1CC555CDC1AAF4B8
SHA-256:	F534BE98290A76D83292F1452825DEC64B99657AD7F2DAE40210879D035E526F
SHA-512:	29A762BC6736CA4508449EB7F26FC2C3DB0E074F14D80F700471A90B0D5B1C95F95587C37B51D97D9F4B2D93C86208DC3157234E81118BC548A47F06E2F372F6
Malicious:	false
Preview:	....A.T.T.E.N.T.I.O.N. .:. .C.o.u.r.r.i.e.l. .e.x.t.e.r.n.e. .-. .C.A.U.T.I.O.N.:.E.x.t.e.r.n.a.l. .e.m.a.i.l...............................................................................................................................................................................................................................................................................................................................................................................................................................p...t.......$...>...j...x........................................................................................................................................................................................................................................................................................................................................-D..M.................$.....-D..M............[$.a$......$.....-D..M............\$.a$.....$.-D@.M.......U....a$.............

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729863378329943600_7DA219A1-F480-42EE-9CEB-728AF7B1D33F.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28741), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.16148658956789785
Encrypted:	false
SSDEEP:	1536:oI9PWa4ZRhTkHebiyqRWzJbv/orf9dpPTLDMjGCbY2nPu/oBQ:2NZjuebeW+qx
MD5:	B206B7685926E20D32ADEE40895596D3
SHA1:	CFF33B474166C2358BCA662521A6AACBBD2E51AA
SHA-256:	2DEFD6362E6506C83561389E35D66D5A4E058A756E4123CC748BA2AECC12A1B8
SHA-512:	DBC3068A143CB0F7E8B7AC4C6EA2B034A726E0F11DE493208BB277F552C91280D004F6D4E9F6E3EA49687A934032A2CD1ECC9FB11334F8562631F13F21C7755F
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/25/2024 13:36:18.399.OUTLOOK (0x430).0xE18.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":21,"Time":"2024-10-25T13:36:18.399Z","Contract":"Office.System.Activity","Activity.CV":"oRmifYD07kKc63KK97HTPw.4.9","Activity.Duration":15,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/25/2024 13:36:18.414.OUTLOOK (0x430).0xE18.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":23,"Time":"2024-10-25T13:36:18.414Z","Contract":"Office.System.Activity","Activity.CV":"oRmifYD07kKc63KK97HTPw.4.10","Activity.Duration":11968,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersi

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729863378330677100_7DA219A1-F480-42EE-9CEB-728AF7B1D33F.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T0936180008-1072.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	4.488903669825622
Encrypted:	false
SSDEEP:	768:O5wxU8KEffLGqwEpuD4ZIZ9Eihan9qD1WnWTXmb/ybEIi76cL6BgsWnWP:B/c4Ze9Eioi5XwKbq0
MD5:	F72BCDE0D4CA1DFFBFEBAB1CCEF83A5C
SHA1:	B350FA8939D830ED5F9444E3B44AF5B7F6FDD38E
SHA-256:	E8CDF29CEA457C8C84857B562522209FA956EB3953F2B2FC200CBA2250638385
SHA-512:	E72281BB15968941B4A90A46CC7278A6B48DD2CDE17E9F3DFE79A95E1B05BCDAA3325D681CD5B9EC9630C33A55F450A7EE1819BC5C880BA39FE4FE15598DD8A2
Malicious:	false
Preview:	............................................................................^.......0....B...&..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1.............................................................y`............B...&..........v.2._.O.U.T.L.O.O.K.:.4.3.0.:.8.0.1.b.b.2.0.4.5.5.5.5.4.1.9.3.a.0.c.b.2.2.a.a.d.f.8.6.0.e.c.4...C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.5.T.0.9.3.6.1.8.0.0.0.8.-.1.0.7.2...e.t.l.........P.P.....0....B...&..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:pVJX:
MD5:	7A126C0586324C9F262140481CFB6D20
SHA1:	C719B45998896508E197B288E7F2BAE0C4BAB36A
SHA-256:	182E916E835FF4E603060C4A9A8A757451C743B37CE6C27B192D8066FE6F1C71
SHA-512:	9644C7DE3B7C0D8445A21D8B7BFA28BD0774752ACC024D71CFBC6B7FC633E026945F28BB7F3651F667EEFFE1F9242CE390ABB6F817DD3598265020ADE0B7FEC6
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.670639372186112
Encrypted:	false
SSDEEP:	12:rl3baFz5qLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheC8lpm:r5mnq1Py9618Pm
MD5:	CC38DC57FEDB8616E8637D1D99A3DF1D
SHA1:	B9B99A9939F680D5A8BE68E933EF45101977DF9D
SHA-256:	0F5E94526D7836806E3E95F7838516EAAAAC5259CF139B525FC6085B33D42BC8
SHA-512:	EEC954056EF20D5EBD4300170F721D0CA7197D3F7E8D4969E980C564E2A640CEFC31416AEBBC146F0AB31212E578FFB1ED567D69A00EA5C6AF29A431851476EA
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	3.6636032125525713
Encrypted:	false
SSDEEP:	1536:ETnPJeo3NQ1YqSt34ZiwgRuqfgsaOu+JcUyogb8LRHPMgDOvW53jEpEHP4qQ10P1:wPoodQ1YqSt34Z3gReVv8y5Rp9
MD5:	8E20A72E94BFEAE7B93CE9657D0F04DA
SHA1:	5303D855ABF3C43C7FB0C0961FB1878F83A84F5A
SHA-256:	B605E268EA1E36E211002CE5A1B326A2115667B9538F659D3565F541BD84C69B
SHA-512:	0D8719F8F6BC4BAF1AE80A1C3E056CBE2BBA03AF10F25B8E5A9A3DCE7125BD951A19C4D1F5662A8764014058649541B379D4AFEF69B4C150836FF4555E83E945
Malicious:	true
Preview:	!BDN....SM......\....p..........<.......b................@...........@...@...................................@...........................................................................$.......D......................:...............7........~..................................................................................................................................................................................................................................................................................`.......K.*..m......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.747399362393307
Encrypted:	false
SSDEEP:	1536:Hu+JcuBCgkDQ1Y1St34ZqwgRuqZgsSgfVe+/T3W53jEpEHP4qQ10PAwr1hDONKqD:yxQ1Y1St34ZvgR0Fv+7Zp9nDD
MD5:	0BA700449138F816E107109B0B8A5924
SHA1:	B712777B34EF36E6BC4225BA552E0EF8AA1DAD05
SHA-256:	DC4073F711269CB146B35E204D70C987A2C9B0C323501B1366ECA8F8BF722AE0
SHA-512:	CF1A5D7BFD5600B3C6CA96C8FAFD301FE02642B774ED7376B8082D082D621A57AC881296E7104514CA9F89AA4840945FFFCC8D28870D9F9DD95344C45ABBAD87
Malicious:	true
Preview:	d-G.C...^.......0...-.}..&....................#.!BDN....SM......\....p..........<.......b................@...........@...@...................................@...........................................................................$.......D......................:...............7........~..................................................................................................................................................................................................................................................................................`.......K.*..m..-.}..&.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	RFC 822 mail, ASCII text, with CRLF line terminators
Entropy (8bit):	6.124461568217972
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	Facture #F-000687 - Assek Technologies.eml
File size:	66'668 bytes
MD5:	b9b4ac876f373b3e0f370405af375604
SHA1:	c20f6b5a29e8995e317703a2f00e4778db783518
SHA256:	502a1e854a1589176ef3fc3615b3458c96677cc6da413329f490bfc6ff512632
SHA512:	5efb491a480f8bb8f0b1bd542a3c037b548ca91381029676c07c383230af2c1b6286f57a52af55b079a5905d0854c75ed273e810bedf3ebbd8cfc9bc20adc0e2
SSDEEP:	1536:wJHNIZMCjH76S9+1geHKNzzu7OjHuwZwqOtdjIvQhE2P:whNLi2/wZwtdjIvQzP
TLSH:	A153E13346411512F32473EA6F839FDE2234740294F74098759FE1DEB1967BB79A0A8B
File Content Preview:	Received: from TO1PPFA009A73C9.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b08::670).. by YQXPR01MB5754.CANPRD01.PROD.OUTLOOK.COM with HTTPS; Fri, 25 Oct 2024.. 10:27:17 +0000..Received: from YT4PR01CA0048.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:fe::9).. by TO1

Static Mail

General

Subject:	Facture #F-000687 - Assek Technologies
From:	Recevables <recevables@assek.ca>
To:	Linda Gaulin <lgaulin@regulvar.com>
Cc:
BCC:
Date:	Fri, 25 Oct 2024 10:26:43 +0000
Communications:	ATTENTION : Courriel externe - CAUTION:External email <https://books.zoho.com/api/v3/settings/templates/invoicelogo/2-9f5f6126fb9f5927bb890a052eb3e49c534d130e54c0d7eb3f0166cd0041c6789a3b840ec167bdeab503b1141cf436f4> Facture #F-000687 Bonjour, Votre facture peut tre consulte, imprime et tlcharge au format PDF partir du lien ci-dessous. Merci pour votre confiance. MONTANT DE LA FACTURE $45,42 No. de la facture: #F-000687 Date de la facture: 2024-10-25 CONSULTER LA FACTURE<https://zohosecurepay.com/books/assektechnologie/secure?CInvoiceID=2-f2ca58a7bd9c8b8361df608f371ed0982168c7d00325acce9a3b840ec167bdea30f7c8fd50a25b966b7b8a3214a9fd9b67c2c73e804057d856db1c5399dc85e798e1fb71080bbb7a> Salutation, Danielle Hbert Assek Technologie 1-888-833-8044 <https://sender.zohofinanceinsights.com/ocimage/2d6f.38b26ff/mka16f4ba0-92bb-11ef-90c1-525400cbcb5e_hkffd13c1f9dba78934a1e88d42a3af546944e33fa00e54e03e7897a45a279e37c.gif>
Attachments:	F-000687.pdf

Headers

Key	Value
Received	by mx.zohomail.com with SMTPS id 1729852003987318.0810443206219; Fri, 25 Oct 2024 03:26:43 -0700 (PDT)
From	Recevables <recevables@assek.ca>
To	Linda Gaulin <lgaulin@regulvar.com>
Subject	Facture #F-000687 - Assek Technologies
Thread-Topic	Facture #F-000687 - Assek Technologies
Thread-Index	AQHbJsh3X/LpPAM+HU6lpWtr7wSGfA==
X-MS-Exchange-MessageSentRepresentingType	1
Date	Fri, 25 Oct 2024 10:26:43 +0000
Message-ID	<2d6f.38b26ff.m1.a16f4ba0-92bb-11ef-90c1-525400cbcb5e.192c336d55a@sender.zohobooks.com>
Content-Language	fr-CA
X-MS-Exchange-Organization-AuthSource	YT2PEPF000001CE.CANPRD01.PROD.OUTLOOK.COM
X-MS-Has-Attach	yes
X-MS-Exchange-Organization-Network-Message-Id	50939eb2-62c5-4f65-6c89-08dcf4df9058
X-MS-TNEF-Correlator
X-MS-Exchange-Organization-RecordReviewCfmType	0
x-ms-publictraffictype	Email
received-spf	SoftFail (protection.outlook.com: domain of transitioning sender.zohobooks.com discourages use of 209.172.38.68 as permitted sender)
authentication-results	spf=softfail (sender IP is 209.172.38.68) smtp.mailfrom=sender.zohobooks.com; dkim=pass (signature was verified) header.d=assek.ca;dmarc=pass action=none header.from=assek.ca;compauth=pass reason=100
x-ms-office365-filtering-correlation-id	50939eb2-62c5-4f65-6c89-08dcf4df9058
x-ms-traffictypediagnostic	YT2PEPF000001CE:EE_\|TO1PPFA009A73C9:EE_\|YQXPR01MB5754:EE_
x-forefront-antispam-report	CIP:209.172.38.68;CTRY:CA;LANG:fr;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:hsmx01-hz11.hornetsecurity.com;PTR:hsmx01-hz11.hornetsecurity.com;CAT:NONE;SFS:(13230040)(69100299015)(3613699012)(8096899003)(4076899003);DIR:INB;
x-microsoft-antispam	BCL:0;ARA:13230040\|69100299015\|3613699012\|8096899003\|4076899003;
x-ms-exchange-crosstenant-originalarrivaltime	25 Oct 2024 10:27:01.6053 (UTC)
x-ms-exchange-crosstenant-fromentityheader	Internet
x-ms-exchange-crosstenant-id	417fb5a3-bdeb-4e46-8a16-fa39afbc7d97
x-ms-exchange-crosstenant-network-message-id	50939eb2-62c5-4f65-6c89-08dcf4df9058
x-ms-exchange-transport-crosstenantheadersstamped	TO1PPFA009A73C9
x-eopattributedmessage	0
x-eoptenantattributedmessage	417fb5a3-bdeb-4e46-8a16-fa39afbc7d97:0
x-ms-exchange-transport-endtoendlatency	00:00:16.0967177
x-ms-exchange-processed-by-bccfoldering	15.20.8093.014
x-ms-exchange-crosstenant-authsource	YT2PEPF000001CE.CANPRD01.PROD.OUTLOOK.COM
x-ms-exchange-crosstenant-authas	Anonymous
x-antispameurope-sender	sender+a16f4ba0-92bb-11ef-90c1-525400cbcb5e_vt1@sender.zohobooks.com
x-antispameurope-recipient	lgaulin@regulvar.com
x-antispameurope-msgid	b9964da7f74938e9c7737a670d15afd2-c31d51ae276ec7000141457c800d8d09
x-antispameurope-body-digest	68a78f42c80ec9aa11ca4994feba1a25
x-antispameurope-virusscan	CLEAN
x-antispameurope-spfresult	NONE
x-antispameurope-orig-ip	135.84.80.167
x-antispameurope-orig-host	bmail-167.transmail.net
x-antispameurope-orig	6e60626719ce4aa7f926e0e198757b04
x-antispameurope-disclaimer	This E-Mail was scanned by www.antispameurope.com E-Mailservice on mx-gate06-hz11 with 4XZf8n6lspzrSM3
x-antispameurope-date	1729852011
x-antispameurope	INCOMING:
x-antispameurope-connect	bmail-167.transmail.net[135.84.80.167],TLS=1;EMIG=0
x-antispameurope-wc	5:458:4:56087:0:200:0:0:0:0:0:1:1:0:2:0:1:15:175:15:1:0:0:0:0:58:0:0:0:1:0:0:0:0::0:1:0:0:0:0:0
x-antispameurope-spamstatus	CLEAN
x-antispameurope-reason	XARG-WL:xw_exprx_191128-62-0198
dkim-signature	a=rsa-sha256; b=If8iPjHmeTmmac5H2Jw+zL5XQd83CGGKzfYzO2P0M3L8lreOyIbkEI63BsDytDPD+sp5bCjq3+kg6xVuLddZx1XN7F6kfQpVyzHIzOtqHxvXo3/aRyhARD7eae4i+1+TvtL4Ksg5GOB90+Q6M7klJURgaLVfNQz3bfBjWmdK/Z8=; c=relaxed/relaxed; s=1522905413783; d=assek.ca; v=1; bh=LFfhc4NXSYajfMAUrAiU8wpvLJD8eNu1DNkNKk5TAdI=; h=date:from:to:message-id:subject:mime-version:content-type:date:from:to:message-id:subject;
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	ExrUziuDqjkd14Nc5t2E4s3ZT0tEP0L3tRc/DjYIpQmpYjSItZqynQU3Ups1TKCpZxahp6zw2VNrB7NBCwfRdoExK89RGRfyKytlJ/iZysQR+VvXWWbfAkvCrTDZbDst9YNp95U5n2NYqHpLQg23N5Kay3IXdJ3NRzY+Lto7qkOLmr0bQfzbonMbLQ9qJ3QiSknHALhpDPhuUmTcGUw5z2IWmOYUdQIoBo9p58s8Qmqhl7z1gG7WY3CE4cI2GqYqqVzwRJS8iZFDNtauLaPK5F+KKG5nFuvHRxJUFExEZK4fgLUT3avOnxHw3G1kHpQkW2lO+ZL7EbS4dAQk1Md17ufHlBhdHdDSYsdo6PJ1UWG7aVyPX5grfxZyD3Ih8FdfizTpepz0qHgtE7Cgt2cfG+YArv0VtWm1XyS4yUGffxeouv2INBC90swcuovA6W4DFRzNOUHyDiDEtphhbdHVuEsL5A/TmB6moPouiVmnp1NS0z0Ji0qZeOEa8ZPfWaUM0iEl+xPfh4mspHfm5X3v5Hy2MrvodDkn/5k+cAJ7IaTpVupuoV38QpPu5rRMDAWUlh3QmYL5jWFp4TAxXy+SQEZxQKX8jR/qn2vLVAFWr0rgRRCaj2D7VWF4EtyKWdxAvwOOVtFrl0l83SmR2ckPar78ruhOFlIJ2OkaqBvQGvd0CXt1Rycp+h8n3AiTxysSR3J6SBLz9fALpcsN7otxOcEIsS76oJmY7Xgh+k0lvltJJcgyi46V4oQbCr6H+opRiuPBwy+JmOfNkEhv4Sb/6bqquauuSZbb+lgLJw1ZmmLoe1Mfdjmc+4dvBjMI3oahYVi4SFWFYBbkzqhqFujRKTAugZhD0JjJN+5OHgRdYo4cR/yK27XGiATPy13Hn1axYeMlhhS499PU9vOY6NomhvYGKO+4g3EOWw+ApfZIy6H5dj9O2QHZuqNvIXBRCeCDj+aP4Lgu04sUFkwzVZX+NjyXl1pvPeeJaOXcPwsoBD4BxZ0lwtu6AqGt7SU+mSqSfwbHZDmQaG9pT2Wv4sulSYIHQ9P/XD+HNHyPLHuNwBcYDl8atdk6n00iNwPiebfX8uo+bwjm3SKHMBjeeSjTjb5JqNJgxWsDKcF3yMlR4M3dttD5vF5+OR/+S+7wdJpsZ0SNAb/9DrgBQ++599RPZO9Sy0yPF8127xvoRhKfwu8oj56sV4z/mD7NH+E5aNlDmaQfDbHwid8+q58PnWIJheprBqKTCgBxpnd7kETc7ytvgKSaCbp/ce9oVSFLltUh6lI/uEaO98ws/wsoHPgbnSjUQRKtHrMb6/LN5Si5woiCogaDlSkAeCmX43O2dFWgN2QXLOx4QyyXfmpHUKbNyVu8yUxe3sEzHjuYmswQWve1RoavfRSIIu1yNPzDh3z27dATvAC6IlW+YPYKJQJ5n8DZO6Ks7fDf0yXNRxR022VvtfoMiLAyPOvBG05z57tkiq91ahfrBmR21N3A04R4I9rMvTo4ibNaUwlFH6xYKAAP8zRL/vOY/DpyzEa79XNVTheZiuJxYe3NnRGlPaY0fFLFSheR0qLvbNWI/z0DtlvCB11PM/eXJLoMmLKUBq+BVqTnU09ejQFrXaaIkBu1nYG1dVo5D/qdXhNKpdQRldcOvSzXvg8D5dUt7+tIv76ldK0B7O+HK3BweS8FBAKPYggQVJ+8pa0ggUWLFcXiSXL02NlwBVWzG4i7kaLSpW8w611DD4iG1ha7Pw/8i/aWbwcUWDBtmuUzbsrCDk1AWUK8kQl5LYdEOrlAjXGZ0wLxVGvXFnI1l1OTDLEP9O3plV6v8Jczj7kdmE41r3qXcqOrltR5PZFwyLfytevscUeykgUc8qDJm7JooAKqX4SI5/PD7aFCukWGGhpDV71XDKJM9iWrqq2clnVxsrjZfQsABpOSLVH4fwc/nKpKCxlHy2How3MMTH0W6feRrQfOWFYFIDL//nLpn8eKaQSueCTPboBDb+7SYECvR8bxVsjjznD0LWsHGTWN/qFDOwMxZxQ/qAYEvMH6yBi5l8VB3Fs6+MDTc7qg/jlxRVItGmELLmBXWnzsEjmz+8wMQCbRv5oZOVqDSVuVzNEWDaJX3A6wvGIZLkW+f8NpH7LgMVTeEnfs8U1hkB0UJ2rpYPJ4kLd+o7xnTF11621Y9NQmNGHfYDu9kpRHN5KVo04xhKz74BQMb0eBLW7qr233/f7mynICUUcjgKgpui8hqlvFo0wuIs4+4Tevx4bTMC1/2av+dv0IKlEbFZ3rUHGQ7hh825Dd5CZh2wjP24rCq+lWBQIYzHim6dWk33tt+yNoaRmAog==
Content-Type	multipart/mixed; boundary="_004_2d6f38b26ffm1a16f4ba092bb11ef90c1525400cbcb5e192c336d55_"
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Target ID:	0
Start time:	09:36:14
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Facture #F-000687 - Assek Technologies.eml"
Imagebase:	0x990000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:36:25
Start date:	25/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8CBFA21-038B-4C41-B379-020DC630673E" "4DE0A6A6-E184-4724-B159-EDE55E4ADDE2" "1072" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff611460000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Facture #F-000687 - Assek Technologies.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\38ED6951-AC2F-4C2D-95C9-E356F05C353E

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F2378D1A-5B71-41B6-BA95-04A72BEB8715}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729863378329943600_7DA219A1-F480-42EE-9CEB-728AF7B1D33F.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729863378330677100_7DA219A1-F480-42EE-9CEB-728AF7B1D33F.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T0936180008-1072.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Static File Info

General

Static Mail

General

Headers

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
Facture #F-000687 - Assek Technologies.eml