Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Next steps Regulvar and TrueLook.eml

Overview

General Information

Sample name:Next steps Regulvar and TrueLook.eml
Analysis ID:1542204
MD5:02907ff9d49c85a2d1a60a93a754d5d0
SHA1:809c61e964013aea43a2aa02f9cdbf9ffdbdd209
SHA256:64b578d17b64560e1639d9ba1a70e190d6752655af18e1b64a54c32e7fdbd92e
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

Process Tree

  • System is w10x64
  • OUTLOOK.EXE (PID: 7444 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Next steps Regulvar and TrueLook.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7720 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5EBB83DB-6525-4B3C-8ED1-DE4DA0BBA250" "A5946450-1921-47D6-93F7-44B22328D64B" "7444" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7444, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknownDNS traffic detected: query: 241.42.69.40.in-addr.arpa replaycode: Name error (3)
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.aadrm.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.aadrm.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.cortana.ai
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.microsoftstream.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.office.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.onedrive.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://api.scheduler.
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://app.powerbi.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://augloop.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://augloop.office.com/v2
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://canary.designerapp.
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.entity.
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://clients.config.office.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://clients.config.office.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cortana.ai
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cortana.ai/api
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://cr.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://d.docs.live.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://designerapp.azurewebsites.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://designerappservice.officeapps.live.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://dev.cortana.ai
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://devnull.onenote.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://directory.services.
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ecs.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://edge.skype.com/rps
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://graph.windows.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://graph.windows.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ic3.teams.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://invites.office.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://lifecycle.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://login.microsoftonline.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://login.microsoftonline.com/organizations
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://login.windows.local
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://make.powerautomate.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://management.azure.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://management.azure.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messaging.action.office.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://messaging.office.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://mss.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ncus.contentsync.
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://officeapps.live.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://officepyservice.office.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://onedrive.live.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://outlook.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://outlook.office.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://outlook.office365.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://outlook.office365.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://outlook.office365.com/connectors
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://powerlift.acompli.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://pushchannel.1drv.ms
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://res.cdn.office.net
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://service.powerapps.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://settings.outlook.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://staging.cortana.ai
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://substrate.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://tasks.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://templatesmetadata.office.net/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://webshell.suite.office.com
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://wus2.contentsync.
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean1.winEML@3/10@1/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1032530875-7444.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Next steps Regulvar and TrueLook.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5EBB83DB-6525-4B3C-8ED1-DE4DA0BBA250" "A5946450-1921-47D6-93F7-44B22328D64B" "7444" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5EBB83DB-6525-4B3C-8ED1-DE4DA0BBA250" "A5946450-1921-47D6-93F7-44B22328D64B" "7444" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System1
Non-Application Layer Protocol		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable Media1
Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542204 Sample: Next steps Regulvar and Tru... Startdate: 25/10/2024 Architecture: WINDOWS Score: 1 10 241.42.69.40.in-addr.arpa 2->10 6 OUTLOOK.EXE 50 91 2->6         started        process3 process4 8 ai.exe 6->8         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://api.diagnosticssdf.office.com0%URL Reputationsafe
https://login.microsoftonline.com/0%URL Reputationsafe
https://shell.suite.office.com:14430%URL Reputationsafe
https://designerapp.azurewebsites.net0%URL Reputationsafe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize0%URL Reputationsafe
https://autodiscover-s.outlook.com/0%URL Reputationsafe
https://useraudit.o365auditrealtimeingestion.manage.office.com0%URL Reputationsafe
https://outlook.office365.com/connectors0%URL Reputationsafe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://api.addins.omex.office.net/appinfo/query0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/tenantassociationkey0%URL Reputationsafe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://lookup.onenote.com/lookup/geolocation/v10%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/imports0%URL Reputationsafe
https://cloudfiles.onenote.com/upload.aspx0%URL Reputationsafe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile0%URL Reputationsafe
https://entitlement.diagnosticssdf.office.com0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://canary.designerapp.0%URL Reputationsafe
https://ic3.teams.office.com0%URL Reputationsafe
https://www.yammer.com0%URL Reputationsafe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies0%URL Reputationsafe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive0%URL Reputationsafe
https://cr.office.com0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://portal.office.com/account/?ref=ClientMeControl0%URL Reputationsafe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory0%URL Reputationsafe
https://edge.skype.com/registrar/prod0%URL Reputationsafe
https://graph.ppe.windows.net0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://tasks.office.com0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://edge.skype.com/rps0%URL Reputationsafe
https://globaldisco.crm.dynamics.com0%URL Reputationsafe
https://messaging.engagement.office.com/0%URL Reputationsafe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.diagnosticssdf.office.com/v2/feedback0%URL Reputationsafe
https://api.powerbi.com/v1.0/myorg/groups0%URL Reputationsafe
https://web.microsoftstream.com/video/0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://graph.windows.net0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://analysis.windows.net/powerbi/api0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://substrate.office.com0%URL Reputationsafe
https://outlook.office365.com/autodiscover/autodiscover.json0%URL Reputationsafe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios0%URL Reputationsafe
https://consent.config.office.com/consentcheckin/v1.0/consents0%URL Reputationsafe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0%URL Reputationsafe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json0%URL Reputationsafe
https://safelinks.protection.outlook.com/api/GetPolicy0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/0%URL Reputationsafe
http://weather.service.msn.com/data.aspx0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://officepyservice.office.net/service.functionality0%URL Reputationsafe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks0%URL Reputationsafe
https://templatesmetadata.office.net/0%URL Reputationsafe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios0%URL Reputationsafe
https://messaging.lifecycle.office.com/0%URL Reputationsafe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml0%URL Reputationsafe
https://mss.office.com0%URL Reputationsafe
https://pushchannel.1drv.ms0%URL Reputationsafe
https://management.azure.com0%URL Reputationsafe
https://outlook.office365.com0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://incidents.diagnostics.office.com0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/ios0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://api.addins.omex.office.net/api/addins/search0%URL Reputationsafe
https://insertmedia.bing.office.net/odc/insertmedia0%URL Reputationsafe
https://outlook.office365.com/api/v1.0/me/Activities0%URL Reputationsafe
https://api.office.net0%URL Reputationsafe
https://incidents.diagnosticssdf.office.com0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://clients.config.office.net/user/v1.0/android/policies0%URL Reputationsafe
https://entitlement.diagnostics.office.com0%URL Reputationsafe
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
241.42.69.40.in-addr.arpa
unknown
unknownfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://api.diagnosticssdf.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://login.microsoftonline.com/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://shell.suite.office.com:1443C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://designerapp.azurewebsites.netC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://autodiscover-s.outlook.com/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://useraudit.o365auditrealtimeingestion.manage.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://outlook.office365.com/connectorsC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://cdn.entity.C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://api.addins.omex.office.net/appinfo/queryC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://clients.config.office.net/user/v1.0/tenantassociationkeyC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://powerlift.acompli.netC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://rpsticket.partnerservices.getmicrosoftkey.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://lookup.onenote.com/lookup/geolocation/v1C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://cortana.aiC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://api.powerbi.com/v1.0/myorg/importsC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://cloudfiles.onenote.com/upload.aspxC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://entitlement.diagnosticssdf.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://api.aadrm.com/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://ofcrecsvcapi-int.azurewebsites.net/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://canary.designerapp.C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://ic3.teams.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://www.yammer.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
    • URL Reputation: safe
    		unknown
    https://api.microsoftstream.com/api/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
      		unknown
      https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
      • URL Reputation: safe
      		unknown
      https://cr.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
      • URL Reputation: safe
      		unknown
      https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;hC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
        		unknown
        https://messagebroker.mobile.m365.svc.cloud.microsoftC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
        • URL Reputation: safe
        		unknown
        https://otelrules.svc.static.microsoftC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          		unknown
          https://portal.office.com/account/?ref=ClientMeControlC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://clients.config.office.net/c2r/v1.0/DeltaAdvisoryC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://edge.skype.com/registrar/prodC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://graph.ppe.windows.netC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://res.getmicrosoftkey.com/api/redemptioneventsC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://powerlift-frontdesk.acompli.netC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://tasks.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://officeci.azurewebsites.net/api/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://sr.outlook.office.net/ws/speech/recognize/assistant/workC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://api.scheduler.C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
          • URL Reputation: safe
          		unknown
          https://my.microsoftpersonalcontent.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
            		unknown
            https://store.office.cn/addinstemplateC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
            • URL Reputation: safe
            		unknown
            https://api.aadrm.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
            • URL Reputation: safe
            		unknown
            https://edge.skype.com/rpsC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
            • URL Reputation: safe
            		unknown
            https://outlook.office.com/autosuggest/api/v1/init?cvid=C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              		unknown
              https://globaldisco.crm.dynamics.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://messaging.engagement.office.com/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://dev0-api.acompli.net/autodetectC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://www.odwebp.svc.msC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://api.diagnosticssdf.office.com/v2/feedbackC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://api.powerbi.com/v1.0/myorg/groupsC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://web.microsoftstream.com/video/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://api.addins.store.officeppe.com/addinstemplateC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://graph.windows.netC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://dataservice.o365filtering.com/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://officesetup.getmicrosoftkey.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://analysis.windows.net/powerbi/apiC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://prod-global-autodetect.acompli.net/autodetectC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://substrate.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://outlook.office365.com/autodiscover/autodiscover.jsonC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://consent.config.office.com/consentcheckin/v1.0/consentsC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://learningtools.onenote.com/learningtoolsapi/v2.0/GetvoicesC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
              • URL Reputation: safe
              		unknown
              https://d.docs.live.netC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                		unknown
                https://safelinks.protection.outlook.com/api/GetPolicyC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                • URL Reputation: safe
                		unknown
                https://ncus.contentsync.C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                • URL Reputation: safe
                		unknown
                https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  		unknown
                  https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  http://weather.service.msn.com/data.aspxC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://apis.live.net/v5.0/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://officepyservice.office.net/service.functionalityC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://templatesmetadata.office.net/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://messaging.lifecycle.office.com/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://mss.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://pushchannel.1drv.msC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://management.azure.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://outlook.office365.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://wus2.contentsync.C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://incidents.diagnostics.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://clients.config.office.net/user/v1.0/iosC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://make.powerautomate.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.addins.omex.office.net/api/addins/searchC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://insertmedia.bing.office.net/odc/insertmediaC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://outlook.office365.com/api/v1.0/me/ActivitiesC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.office.netC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://incidents.diagnosticssdf.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://asgsmsproxyapi.azurewebsites.net/C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://clients.config.office.net/user/v1.0/android/policiesC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://entitlement.diagnostics.office.comC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonC2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24.0.drfalse
                  • URL Reputation: safe
                  		unknown

                  World Map of Contacted IPs

                  ⊘No contacted IP infos

                  General Information

                  Joe Sandbox version:41.0.0 Charoite
                  Analysis ID:1542204
                  Start date and time:2024-10-25 16:31:49 +02:00
                  Joe Sandbox product:CloudBasic
                  Overall analysis duration:0h 4m 32s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:default.jbs
                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                  Number of analysed new started processes analysed:6
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • EGA enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Sample name:Next steps Regulvar and TrueLook.eml
                  Detection:CLEAN
                  Classification:clean1.winEML@3/10@1/0
                  Cookbook Comments:
                  • Found application associated with file extension: .eml

                  Warnings

                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                  • Excluded IPs from analysis (whitelisted): 20.190.159.68, 20.190.159.64, 20.190.159.23, 40.126.31.69, 20.190.159.75, 40.126.31.73, 40.126.31.67, 20.190.159.0, 52.109.76.240, 52.113.194.132, 51.104.15.253
                  • Excluded domains from analysis (whitelisted): ecs.office.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, prod.configsvc1.live.com.akadns.net, onedscolprduks04.uksouth.cloudapp.azure.com, s-0005-office.config.skype.com, login.msa.msidentity.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, neu-azsc-config.officeapps.live.com, login.live.com, s-0005.s-msedge.net, config.officeapps.live.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
                  • Not all processes where analyzed, report is missing behavior information
                  • Report size exceeded maximum capacity and may have missing behavior information.
                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.
                  • VT rate limit hit for: Next steps Regulvar and TrueLook.eml

                  Simulations

                  Behavior and APIs

                  ⊘No simulations

                  LLM Input / Output

                  Joe Sandbox View / Context

                  IPs

                  ⊘No context

                  Domains

                  ⊘No context

                  ASNs

                  ⊘No context

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  ⊘No context

                  Created / dropped Files

                  C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):231348
                  Entropy (8bit):4.392513890435494
                  Encrypted:false
                  SSDEEP:1536:nsYLh1gs7FiCylAZFgs1XNcAz79ysQqt26+6CqoQdArcm0FvbpuyqMI6oG5MmHWm:XjgwM0gqmiGu2fqoQSrt0FvPiQPr9KNc
                  MD5:68FB8E92ACA9933791CC85A10F8643E7
                  SHA1:718D240838A3752C2186C93570DAECA7D7627B23
                  SHA-256:3C0BFFACDAFB447004F1113269BE8C68B74271BBB75633AE221D5E2168A9E00B
                  SHA-512:B5C1D99C89A0C7A96DE0F68916C9F5D2CBC69F4A827C14C706C3E2CE844CFEE6CCB85C75C09CB5D934F1F1ECAD5EF9463522F6D120C2E2B33A539BBCD95EB07A
                  Malicious:false
                  Reputation:low
                  Preview:TH02...... ...9..&......SM01X...,....8-..&..........IPM.Activity...........h...............h............H..h.O.......l....h........p.}.H..h\jon ...ppDa...h..0...(.O....hq..............h........_`.j...h....@...I..v...h....H...8..j...0....T...............d.........2h...............k_.D.....e.....!h.............. h..D.....@.O...#h....8.........$hp.}.....8....."h.y.......y....'h..i...........1hq...<.........0h....4.....j../h....h......jH..h [..p....O...-h .......l.O...+h..........O................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C2CE5C0B-FFDF-4970-A8B9-C389ABCE8F24

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):178267
                  Entropy (8bit):5.2902868508330485
                  Encrypted:false
                  SSDEEP:1536:/i2XfRAqFbH41gwEwLe7HW8QM/o/NMdcAZl1p5ihs7EXXDEAD2Odago:NCe7HW8QM/o/TXgk9o
                  MD5:23D078F629B4F1CBF66226E5C82501EC
                  SHA1:0F47F34A2B64BE2C2BA42902AF02ED29FD55D695
                  SHA-256:082622556EC6E55E6998C2D2B62C24032ADDD5CC7AA559FD9E421C1625F8E2AA
                  SHA-512:B599B7AE0562B487D06888E40647FB2F07BC69088D3E207DD358F053D64F37691019A588DDEC45E94E1C5597DFD6828EB72E401B795FF554296C6832D161624E
                  Malicious:false
                  Reputation:low
                  Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-25T14:32:58">.. Build: 16.0.18209.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):32768
                  Entropy (8bit):0.04604146709717531
                  Encrypted:false
                  SSDEEP:3:GtlxtjlEzHL74lxtjlEzHLjXl1R9//8l1lvlll1lllwlvlllglbelDbllAlldl+l:GtgL74gLj99X01PH4l942wU
                  MD5:1C13965F94FE0B4D9F54A7DB724B510E
                  SHA1:37EFB6CAFCB6146EE25BA968F1C019C38D824A15
                  SHA-256:E349F544F052B040A3BDB038D189B8565D2D0AAB2E4E4FA70BB417DE143BEC0E
                  SHA-512:046336803AAF44A3FFE615CEA527E3850FEF0889E08812FA546F9EA691B25A60AFBCEC6AB36EEC7E269893F7203E88C673C09063C0B680D86A5232EDD1C44285
                  Malicious:false
                  Reputation:low
                  Preview:..-.......................#.RI..>.E....~b......-.......................#.RI..>.E....~b............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:SQLite Write-Ahead Log, version 3007000
                  Category:modified
                  Size (bytes):49472
                  Entropy (8bit):0.484468959954253
                  Encrypted:false
                  SSDEEP:48:rDQ14Ull7DYM4zyzO8VFDYMJzBO8VFDYML:oFll4wjVG69jVGC
                  MD5:E881E6DAB1995AD15DBD7E8E16AAB67E
                  SHA1:21623B43B48772ECF8C4F39FBD010B84A9D26147
                  SHA-256:749667D42198789EBC4551CBC655FF9FD2740494DA42C52150888A6308E4EDC5
                  SHA-512:FB4E228329AE0D9DF8E1435C9CBBBE9A07634FDB847D9B6AB9817A7E6E649C0DBD4AA21471FCA2126A728E62144D6B6F2E805AEBCC2D1B9A2EBDB78662C7A42D
                  Malicious:false
                  Preview:7....-..........>.E....z,.Q...........>.E....Q|u.Q..SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729866775872550700_89D51F64-2DD3-4C8A-B076-FD2520528368.log

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:ASCII text, with very long lines (28763), with CRLF line terminators
                  Category:dropped
                  Size (bytes):20971520
                  Entropy (8bit):0.16059681999111247
                  Encrypted:false
                  SSDEEP:1536:KUh0Bz5gflmmvrEhTTNSO51qwAc9/lBtL/LM/UGCj6SwHvjlPzKxT7BA:XEJkO5iYZqf
                  MD5:B221CC701CAA4373DAB5EF3AD3CD83D3
                  SHA1:E2A1B3A31372207C52AC4FBF90760559A2E61D4C
                  SHA-256:913CF729BA8F717A1B226A9A1488EA5AC83CE628D5C9B31A4B43324BBD95CE13
                  SHA-512:5CDAD4623C3D1CC289A33135DE39240B79FBDD73F622FBB77474B776700739E2F8CD9DB894395967CE0CE9CA051909B36E68F5DFDAE8F2AF08BADA8A2DB2C86F
                  Malicious:false
                  Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/25/2024 14:32:56.047.OUTLOOK (0x1D14).0x1D18.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":16,"Time":"2024-10-25T14:32:56.047Z","Contract":"Office.System.Activity","Activity.CV":"ZB/VidMtikywdv0lIFKDaA.4.9","Activity.Duration":17,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/25/2024 14:32:56.078.OUTLOOK (0x1D14).0x1D18.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-10-25T14:32:56.078Z","Contract":"Office.System.Activity","Activity.CV":"ZB/VidMtikywdv0lIFKDaA.4.10","Activity.Duration":13882,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1729866775874315300_89D51F64-2DD3-4C8A-B076-FD2520528368.log

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):20971520
                  Entropy (8bit):0.0
                  Encrypted:false
                  SSDEEP:3::
                  MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                  SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                  SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                  SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                  Malicious:false
                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241025T1032530875-7444.etl

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):106496
                  Entropy (8bit):4.510441631788983
                  Encrypted:false
                  SSDEEP:768:OwDKu8W6WYRZnM7rrB4San69CkQZ0sXPJ5VWFWYWuWFyQa3xY:xR4Sf9CkQBXRB6Y
                  MD5:C7A46890DE30380899D289E42C13EE06
                  SHA1:020144CF400825357FF1F64826C7A4C09062A208
                  SHA-256:97DB89DAED928442D5408CE1A84BF0C792647D3CCCBA58C7F6DD31B946BBAC99
                  SHA-512:39320DFA7ACB36023D4900CFC6E53D8D3573347CA29D5693777260DE25B4CE4AC5B70EE80CE137F3E001C29724B2BD82AFCC3F2CE8A7866BBFFDAB70C59C17D0
                  Malicious:false
                  Preview:............................................................................b............}...&..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................o.............}...&..........v.2._.O.U.T.L.O.O.K.:.1.d.1.4.:.a.a.9.a.6.8.3.1.5.c.5.5.4.0.1.4.b.1.5.b.e.c.7.9.9.e.c.9.8.7.d.6...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.5.T.1.0.3.2.5.3.0.8.7.5.-.7.4.4.4...e.t.l.............P.P..........}...&..................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):30
                  Entropy (8bit):1.2389205950315936
                  Encrypted:false
                  SSDEEP:3:MyX:My
                  MD5:084A472CAA9C9F138DF3A0107670633A
                  SHA1:DF0BF3EFF721A1C2BAD82746E34BEC5F94276C5D
                  SHA-256:FF8442A824A9F2A4F6ADE140DF0296B1EDE6D4FC6DB41EF66CBAF59C0B494673
                  SHA-512:F1412A0B3669D3C3388A6F034A6F180654B96967C308BAAECA8680FC301742D512774D44E67D2BB9A1D9BD9299B41D3ED745E46D1EAA257D7CC53319337D117A
                  Malicious:false
                  Preview:....{.........................

                  C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:Microsoft Outlook email folder (>=2003)
                  Category:dropped
                  Size (bytes):271360
                  Entropy (8bit):2.45651500925567
                  Encrypted:false
                  SSDEEP:1536:bkxHce2gEFJe1vbe34/+BY8pKAqWxTiGsCerPLx0W53jEpEHP4qQ10PAwrxP2byO:gHmFGANiGZp9egsp9
                  MD5:5D8C8ABBDE43C22F36C1D9785325CAFC
                  SHA1:99EE3067A2A8450A54C1AF76EF0D4440A39AE40B
                  SHA-256:548DA7D76C58A96CD7A1790C2799BC32F7AA5082435C587B2B48B8F640D7EEE8
                  SHA-512:ED1303F9EBA1D81962535F4644BC119963459BD652D6181DC38FC0294769B1E92E3E91076CA3D693500D7748E2853AE36F8FEAC1764381289088327BDC1D1D33
                  Malicious:false
                  Preview:!BDN&..ySM......\.......................Y................@...........@...@...................................@...........................................................................$.......D......@........................R..................................................................................................................................................................................................................................................................................................`........<..DN......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                  Download File
                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                  File Type:data
                  Category:dropped
                  Size (bytes):131072
                  Entropy (8bit):2.265846186699966
                  Encrypted:false
                  SSDEEP:1536:Ge2gkeAW53jEpEHP4qQ10PAwrLWAuqcqW:ixp963
                  MD5:2F424D488A0A4B4E470CB12CA7040E8F
                  SHA1:04785B96EA719EBBE97974571DCC289CB13AB123
                  SHA-256:F5E0790188ACD953971E473937260FEE3F7BA07F4070322771292372BAB4053F
                  SHA-512:63C8710D3DF6DC532782971B3E305587358C2FFB2B79FC4600F932584E60C03D2AB29F25D884B6D58F3E630CEF0FEA7E91E7DCF9576153A7085CA7A13D668C0E
                  Malicious:false
                  Preview:..V.C...u...............&....................#.!BDN&..ySM......\.......................Y................@...........@...@...................................@...........................................................................$.......D......@........................R..................................................................................................................................................................................................................................................................................................`........<..DN......&....................#.........@X......8...@2...........j...........2...........r...........6...........d......8.......D........_..............H........o......8...(...L.......................P.......@W..........h...T........H..............\...............n...H...\...............n...H...X........I.......................r...........6...........d......8.......<...............n...H...@........K......(.......D.......

                  Static File Info

                  General

                  File type:RFC 822 mail, ASCII text, with CRLF line terminators
                  Entropy (8bit):6.043958706561302
                  TrID:
                  • E-Mail message (Var. 5) (54515/1) 100.00%
                  File name:Next steps Regulvar and TrueLook.eml
                  File size:12'246 bytes
                  MD5:02907ff9d49c85a2d1a60a93a754d5d0
                  SHA1:809c61e964013aea43a2aa02f9cdbf9ffdbdd209
                  SHA256:64b578d17b64560e1639d9ba1a70e190d6752655af18e1b64a54c32e7fdbd92e
                  SHA512:41dc4806ad6bdae3ae67078af504481df7c9d9bf1d9ced5cbfab29cd116cbbff5cf97da167bc0a3c268f545d74c5a5f826508bbfc5bfb6ec0d22f474462c81a0
                  SSDEEP:192:HUNpKaGOxY7r4asCNkrNvta+C3w5CtLNCJx/XLjv/DC7:daGV4t7dta+0dSxDjHm
                  TLSH:B242F91123431826EF2061C54C51AD2C6008F952F6BF89817EAFA5BE67CF17EBE75C86
                  File Content Preview:Received: from YT3PR01MB11285.CANPRD01.PROD.OUTLOOK.COM.. (2603:10b6:b01:141::22) by YT2PR01MB4350.CANPRD01.PROD.OUTLOOK.COM with.. HTTPS; Thu, 24 Oct 2024 14:25:47 +0000..Received: from YQXPR0101CA0049.CANPRD01.PROD.OUTLOOK.COM.. (2603:10b6:c00:14::26) b

                  Static Mail

                  General

                  Subject:Next steps Regulvar and TrueLook
                  From:Jim Obrien <j.obrien@truelookcameras.com>
                  To:Antoine Damais <adamais@regulvar.com>
                  Cc:
                  BCC:
                  Date:Thu, 24 Oct 2024 14:25:25 +0000
                  Communications:
                  • ATTENTION : Courriel externe - CAUTION:External email Hello Antoine, Not sure we've met yet, but Regulvar was brought up at a builder convention we attended this year so thought Id send a quick note to you directly. My team at TrueLook is helping project leadership with cameras that include time-lapsing, 24/7 recording with AI power motion detection, and a built-in modem for live remote viewing and installation is only 15 minutes. We just released month-to-month leasing and thought Regulvar would be great to speak with about how were seeing management view, document, and ensure the safety and security of multiple job sites at once. Happy to offer a customized walkthrough. Regards, Jim James O'brien Vice President TrueLook The information within this communication is intended only for the recipient detailed in this email. If you received this email erroneously, kindly respond to this email and continue with its deletion, so that we can ensure such an error does not transpire again. If you do not want to hear from us on our emails? Please just let me know or reply with STOP.
                  Attachments:

                    Headers

                    Key Value
                    Receivedfrom d5a58d68-a6ad-4e4a-8cb9-082186b4157d.local (ec2-3-82-119-51.compute-1.amazonaws.com. [3.82.119.51]) by smtp.gmail.com with ESMTPSA id af79cd13be357-7b1659dff36sm496281185a.32.2024.10.24.07.25.25 for <adamais@regulvar.com> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Oct 2024 07:25:25 -0700 (PDT)
                    FromJim Obrien <j.obrien@truelookcameras.com>
                    ToAntoine Damais <adamais@regulvar.com>
                    SubjectNext steps Regulvar and TrueLook
                    Thread-TopicNext steps Regulvar and TrueLook
                    Thread-IndexAQHbJiCea66s2Vs8kUSQuVm3zXTjDg==
                    X-MS-Exchange-MessageSentRepresentingType1
                    DateThu, 24 Oct 2024 14:25:25 +0000
                    Message-ID<d5a58d68-a6ad-4e4a-8cb9-082186b4157d@truelookcameras.com>
                    Content-Languagefr-CA
                    X-MS-Exchange-Organization-AuthAsAnonymous
                    X-MS-Exchange-Organization-AuthSource QB1PEPF00004E0F.CANPRD01.PROD.OUTLOOK.COM
                    X-MS-Has-Attach
                    X-MS-Exchange-Organization-Network-Message-Id e8574aa2-ceac-4215-6a45-08dcf437bb2d
                    X-MS-Exchange-Organization-SCL-1
                    X-MS-TNEF-Correlator
                    X-MS-Exchange-Organization-RecordReviewCfmType0
                    x-ms-publictraffictypeEmail
                    received-spfSoftFail (protection.outlook.com: domain of transitioning truelookcameras.com discourages use of 209.172.38.68 as permitted sender)
                    authentication-resultsspf=softfail (sender IP is 209.172.38.68) smtp.mailfrom=truelookcameras.com; dkim=pass (signature was verified) header.d=truelookcameras.com;dmarc=pass action=none header.from=truelookcameras.com;compauth=pass reason=100
                    x-ms-office365-filtering-correlation-ide8574aa2-ceac-4215-6a45-08dcf437bb2d
                    x-ms-traffictypediagnostic QB1PEPF00004E0F:EE_|YT3PR01MB11285:EE_|YT2PR01MB4350:EE_
                    x-forefront-antispam-report CIP:209.172.38.68;CTRY:CA;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:hsmx01-hz11.hornetsecurity.com;PTR:hsmx01-hz11.hornetsecurity.com;CAT:NONE;SFS:(13230040)(43022699015);DIR:INB;
                    x-microsoft-antispamBCL:0;ARA:13230040|43022699015;
                    x-ms-exchange-crosstenant-originalarrivaltime24 Oct 2024 14:25:38.0305 (UTC)
                    x-ms-exchange-crosstenant-fromentityheaderInternet
                    x-ms-exchange-crosstenant-id417fb5a3-bdeb-4e46-8a16-fa39afbc7d97
                    x-ms-exchange-crosstenant-network-message-id e8574aa2-ceac-4215-6a45-08dcf437bb2d
                    x-ms-exchange-transport-crosstenantheadersstampedYT3PR01MB11285
                    x-eopattributedmessage0
                    x-eoptenantattributedmessage417fb5a3-bdeb-4e46-8a16-fa39afbc7d97:0
                    x-ms-exchange-transport-endtoendlatency00:00:09.1693365
                    x-ms-exchange-processed-by-bccfoldering15.20.8093.014
                    x-ms-exchange-crosstenant-authsource QB1PEPF00004E0F.CANPRD01.PROD.OUTLOOK.COM
                    x-ms-exchange-crosstenant-authasAnonymous
                    x-antispameurope-senderj.obrien@truelookcameras.com
                    x-antispameurope-recipientadamais@regulvar.com
                    x-antispameurope-msgid 2b89e04077bf3552b64dff2a55f16b78-a9d98daaef530b2cceb7ae9086ed542b
                    x-antispameurope-body-digest03c9638eab41d823594559d618235a98
                    x-antispameurope-virusscanCLEAN
                    x-antispameurope-spfresultNONE
                    x-antispameurope-orig-ip209.85.222.171
                    x-antispameurope-orig-hostmail-qk1-f171.google.com
                    x-antispameurope-orig773314532ab258864c63fddc4d05898f
                    x-antispameurope-disclaimerThis E-Mail was scanned by www.antispameurope.com E-Mailservice on mx-gate09-hz11 with 4XZ7VZ5vzVz3xbcY
                    x-antispameurope-date1729779928
                    x-antispameuropeINCOMING:
                    x-antispameurope-connect mail-qk1-f171.google.com[209.85.222.171],TLS=1;EMIG=0
                    x-antispameurope-wc 5:174:0:3679:0:17:0:0:0:0:0:0:0:0:0:0:0:8:8:8:0:0:0:0:0:35:0:0:0:0:0:0:0:0::0:1:0:0:0:0:0
                    x-antispameurope-digest606c4b49c1bc1b95f7a2a3db119f06de
                    x-antispameurope-spamstatusCLEAN
                    x-antispameurope-reasonNOREASON:HO
                    dkim-signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=truelookcameras.com; s=google; t=1729779926; x=1730384726; darn=regulvar.com; h=mime-version:date:content-transfer-encoding:subject:to:from :message-id:from:to:cc:subject:date:message-id:reply-to; bh=nIjnfCYglvjuanVNVNieq6nwnntsl7pITwpEZYzzkiA=; b=Wr+C1UnevTbpx+AK7LIJOJIJJmW/pWlAbp4KgTUnwjEh/qqDO5u5Sqh2nc3vRMm1vm FjylY5RtL2N7zuFYXUQtHFMIFBBZlvlGDDVWl4RuZEK/o+BtmRjtlVGb7kX+v4MRIErf aXl/i/LYnKfzNz1IfjkKxfgMEw3i5xRrobbLg=
                    X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                    X-Microsoft-Antispam-Message-Info AUplqSLMSb64UHK9rkW9es8K+I7iJTlXUCj5hPzboInMxQg13LTCB0lC6z/fXOzQLS1MhWZ8mfXPOWf4Z6ar9N0T9wGRtGjCCd50NbsZJzuELYaZyOdprDnowp11DMQwcwDhybXFzJznjtaxTosoHZHsiLAELFa4Dp0045ObkxgzfCQq0O+tAL+A5r8pg0gPXZI4a3WpRvYb9AurPUrJD9YdKoBRt1XcP7XQQrwExCNnNRfbonAvo/xo5w+Hpsqvcu7bU3WhNPu/a3TIYdvN8Brb278oftmE36ZfQTfyj6LLuiIFWtto5z5d4tEFPZoUOMaThKlvKBYltV5SFiZOQeJLGmb3MX9AJNOxBQjMtVJj9gJv6tWtJZwRthztXw59tHBMj82JWpl2ZN2PKZDFIhxkZYEm/0c3iSnWVhOOtgiHs6lESQ1i2qhN3H1a7kGF42EiZE+rZ2ZnNssybyjmgj3+y7aP2d8fgit6jV7AhN6IMSG0rphDAJNwjKUUDOeBlNNlq0ZM7jbjtF4qjdmiUmsYDM6h8vzo7AQihh5FQ5HJXs2WQHNwKfcNweOxkkTrkudnQGU7tezTB+QiIQANUOkX2dGsgnHFzLn4tF9fjsEmnnCCBu1lgQpH5XX4mMXKl0xeVEnRVOAGnSC+fkcJRsux+Cg/F8i2ZhsEUnkRSVypfZIFqCRvigw+hNXFHbXcG+It77qxRe9wsz9QsO33dyPXOiCsldAhu4wCLVF7f3KAakEFMjp4xPkFHvxJYyc6jgPp89HOTykd4McgZaGoFSfwVxy/gH78Jx1f5MjxDILE5YgUD3ylrL8HmhkQYthk4AOb2JlhvEPY/yNI7gANMtaN4hG/IBAH9eO9q6o2VGS4zSnYq5eYXjfGyH2UMPpuEzZVGAvNX764VoeqqM5HP+FXBpCStjjKX1KPKOSvxXY6mPO5EPzbXDzXyi7zkIexzy0FhCgo4gtYOJnnTd3GJiTOf7Xh7Mjq4/N2u7hU0IXyKkhQhutSGA08SeKWcIF8SFwge1tFNbbEXMDMGNX89N9EtJu5m8tmQggjEc60PU6Izbbzp3LFbeK+sH3YHlvRvobvqu6Pe7cOP97hCRVjTXV694msl5KetakSEYs9X/rB/QCVGtt6bURh6FO9d6dUY1wSGDqNGX6B75Mn/gsKYzAQtzytpADdKLOVZBfmGJtt5uD7uU1ctOUwZXqPd8mhoT+g6y9TSW1hvYFiWj3lTWu8wy9kxUfFdqaFBU24Y7nBOjQ/wNwws87usH/GSth9QmbLM9OFmd0ScYAeSvVTe/1Bhm7Kz4OvgzVj3ddd41LfyJJgoS10vfspHJBQwmFz+cZm96BuK2SH61FrzOnV5tIi5ecxlUBGRsnX2TM9thGb2aLraRYWKSIYPpKtIanYfMEUHRzdChNXRUcD7dJHGp6jYj2mXrCdouD9AUvMSwixpHRnytZz9o6EoDN8tAi0df9i9BCpxM3wjaZySIwXtWfrMWyaR7IjZS038VgVmzBkauPB2gwNSJqbb94qi04e5Xh5dZkZLqlfEw6u51vm/Nce8kc3LS9erY0suNDnxOeqfNxr4nRZT0TzsK1AR2Aa3IpkQJf77/N8p19dyWuAQOh5MlJgC4VKCvPUWDQOgNcJl1peFEy1zFNweATXMD9oKr7F1oZ1RVxQXQUxz/x+7ldu9PHT8k902RvB8PgvLfUGnvMCIEYhc+r2e0hzf5Ts+rD4QxsnnX4GN1cxcSAy4tWyZan8kSLb7Rm9PuVscFkJ6XbVP/Zd5xHSkQE5GSZfSstMfhWT/fS/d9BXUtDoaW/3D9Fsf2ejvAIRBrJQc8yNXuDq7ssVY/1+Hsms08gr6/iRDGlyOzOk9WSPsjWvc5qCKyOrqtdadBC00imOTZq3h1EEd/ni/efpR8M7kjqlSb8uNXDvWt15zUs0nnBClVmL56L059iKbBYLJmVpMh68YMdvo+xeYqSTWaEVBtnH8bgk6kgPS4JKa/vlYaE1QGtmHKHtLFEZXfr+i8w/vnhDrh6wyueP+bCc+04bjWgECYCBtueFbIkdM103+XPIwF9iqNK/Cw4pQXcAHcoNZSLFsAGgPUE9z/IC07+Df7vyBTvBOmx68QuX2vrqn6OhDWRbs1KZwwOxuZCwi5z7ebSoSzr5h8d9qXYIT0Dv8n2He8onA2nBRg0UAFGXs0whVWbb+XKGUC4EvS0tticcD+uKUxejD9F3jtzJ/QBS+4w1TlgPCX82nuDZxCADGfTGZN0sFWphpM9bp+a1KwXcO95LDm/CagOoKRALoJ8ywbrPqMnphyBpGJL85bquQtRgHVDUjnMzOz/a3GkeqnRDEt48iVRMftu6F8YkmJVUmdKpWuPgltY/QcVvUXpKmao42bYRD0e4wS1dfYpvRKPDNgz7rptqnzkFM5yhYFElgSrwWY/2eckHCQY0aOL+wSQV0eQu1xQ6KuGaWSsIMZkMDJBOXALsDZM8/k+COkEgEo7wI/x1RbouZj+DQN+ash2J99ElYtJKaW5BwqVnhLVcKC0YnjSnOzJLu5zLtbA+Rr7OVhFF7grLBHOFv3LzaqhNMI1pD/M1ssv4Z8yNtFDdWuggoxh1O2WytOCb7JypHsfiA+fDOVL/oHYkGoRKo5BQK5f8CeZNi2OMfGB65BTnXAJ3RpE5lIz5c1i+JpazLC+u4W2BeG+C97td3Vep1mecaDAOAO3mM9f83RreuNGH3vYOf6HBjYOX5Bj0E06M5cyTRPK5A6QKChXF9oOODCLO6fckukz0i7zbfI9aAP16sVKlvgI7EgJh+U6FK/K8UNtem+3DnGECsefTFZzAwCl9Tw==
                    Content-Typetext/plain; charset="utf-8"
                    Content-ID<3B871ECFA278694E9267D2E866AFD1BC@CANPRD01.PROD.OUTLOOK.COM>
                    Content-Transfer-Encodingbase64
                    MIME-Version1.0

                    File Icon

                    Icon Hash:46070c0a8e0c67d6

                    Network Behavior

                    Network Port Distribution

                    UDP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Oct 25, 2024 16:33:15.200397015 CEST5349771162.159.36.2192.168.2.4
                    Oct 25, 2024 16:33:15.810712099 CEST5503353192.168.2.41.1.1.1
                    Oct 25, 2024 16:33:15.820230007 CEST53550331.1.1.1192.168.2.4

                    DNS Queries

                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                    Oct 25, 2024 16:33:15.810712099 CEST192.168.2.41.1.1.10xa483Standard query (0)241.42.69.40.in-addr.arpaPTR (Pointer record)IN (0x0001)false

                    DNS Answers

                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                    Oct 25, 2024 16:33:15.820230007 CEST1.1.1.1192.168.2.40xa483Name error (3)241.42.69.40.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false

                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    High Level Behavior Distribution

                    Click to dive into process behavior distribution

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Target ID:0
                    Start time:10:32:50
                    Start date:25/10/2024
                    Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    Wow64 process (32bit):true
                    Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Next steps Regulvar and TrueLook.eml"
                    Imagebase:0x50000
                    File size:34'446'744 bytes
                    MD5 hash:91A5292942864110ED734005B7E005C0
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:false

                    General

                    Target ID:1
                    Start time:10:32:57
                    Start date:25/10/2024
                    Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5EBB83DB-6525-4B3C-8ED1-DE4DA0BBA250" "A5946450-1921-47D6-93F7-44B22328D64B" "7444" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                    Imagebase:0x7ff637bf0000
                    File size:710'048 bytes
                    MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:false

                    Disassembly

                    ⊘No disassembly