Edit tour

Windows Analysis Report
TzI4WHdB.eml

Overview

General Information

Sample name:	TzI4WHdB.eml renamed because original name is a hash value
Original sample name:	abx_CloudMessage_WzExNTEsICIzNDM4MzViMi01MDZjLTRmY2UtOTFjZi1iYWU0OGFkM2Y1MzBAN2VjYjBmOTctYWQxNC00OTg3LThjMmItY2QyYmI0ZTgyMDhhIiwgIkFBa0FMZ0FBQUFBQUhZUURFYXBtRWMyYnlBQ3FBQy1FV2cwQUNwb2hPLVFnRFU2R0VzOG9WTzI4WHdB.eml
Analysis ID:	1545187
MD5:	e19f63f9bb12a84201981d2883f16f0b
SHA1:	0fdec99e011b087fb7bc42aeacfda7092d15547d
SHA256:	341085157751cb6bf6fe113797dcc777b33c3f2ba37914d14333948d9bb51bc2
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

Queries the volume information (name, serial number etc) of a device

Stores large binary data to the registry

Classification

Process Tree

System is w10x64

OUTLOOK.EXE (PID: 3340 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\TzI4WHdB.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6540 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "2069FA85-72DE-46F8-A66F-416FB100A68D" "F9F13E94-A5CF-4A96-8604-53C720F8C1C8" "3340" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.aadrm.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.cortana.ai
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.office.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.onedrive.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://api.scheduler.
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://app.powerbi.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://augloop.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://canary.designerapp.
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.entity.
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://clients.config.office.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cortana.ai
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cortana.ai/api
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://cr.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://d.docs.live.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://directory.services.
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ecs.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://graph.windows.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://graph.windows.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://invites.office.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://login.windows.local
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://management.azure.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://management.azure.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://messaging.office.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://mss.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/PushNotifications.Register
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://officeapps.live.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://onedrive.live.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://outlook.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://outlook.office.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://outlook.office365.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://service.powerapps.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://settings.outlook.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-1
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-2
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-100
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-150
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-200
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-light-
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://substrate.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://tasks.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	String found in binary or memory: https://www.yammer.com

Source: classification engine

Classification label: mal48.winEML@3/18@0/0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CEF99829-E51B-40CF-BEA5-492DC122C83C

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T0310310374-3340.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\TzI4WHdB.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "2069FA85-72DE-46F8-A66F-416FB100A68D" "F9F13E94-A5CF-4A96-8604-53C720F8C1C8" "3340" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "2069FA85-72DE-46F8-A66F-416FB100A68D" "F9F13E94-A5CF-4A96-8604-53C720F8C1C8" "3340" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email

LLM: Email contains prominent button: 'click here to view document'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: Suspicious sender domain 'christoff.ie' doesn't match claimed sender organization 'Yazaki-europe'

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 0

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: TzI4WHdB.eml

Binary or memory string: UDdEQzZPRlFSbFZQTllhK1pqL2hwRkduR0RxYWhmYjFNV3JCamZHNktwSUUzRWFUNXBRWW5mQ0lR

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://api.diagnosticssdf.office.com	0%	URL Reputation	safe
https://login.microsoftonline.com/	0%	URL Reputation	safe
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://api.addins.omex.office.net/appinfo/query	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/tenantassociationkey	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/imports	0%	URL Reputation	safe
https://cloudfiles.onenote.com/upload.aspx	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://entitlement.diagnosticssdf.office.com	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
https://ic3.teams.office.com	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://portal.office.com/account/?ref=ClientMeControl	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://graph.ppe.windows.net	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://powerlift-frontdesk.acompli.net	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	0%	URL Reputation	safe
https://api.scheduler.	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://api.aadrm.com	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://globaldisco.crm.dynamics.com	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://dev0-api.acompli.net/autodetect	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.diagnosticssdf.office.com/v2/feedback	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://dataservice.o365filtering.com/	0%	URL Reputation	safe
https://officesetup.getmicrosoftkey.com	0%	URL Reputation	safe
https://analysis.windows.net/powerbi/api	0%	URL Reputation	safe
https://prod-global-autodetect.acompli.net/autodetect	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
https://outlook.office365.com/autodiscover/autodiscover.json	0%	URL Reputation	safe
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://apis.live.net/v5.0/	0%	URL Reputation	safe
https://officepyservice.office.net/service.functionality	0%	URL Reputation	safe
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	0%	URL Reputation	safe
https://templatesmetadata.office.net/	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://messaging.lifecycle.office.com/	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://mss.office.com	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://management.azure.com	0%	URL Reputation	safe
https://outlook.office365.com	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://incidents.diagnostics.office.com	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://insertmedia.bing.office.net/odc/insertmedia	0%	URL Reputation	safe
https://outlook.office365.com/api/v1.0/me/Activities	0%	URL Reputation	safe
https://api.office.net	0%	URL Reputation	safe
https://incidents.diagnosticssdf.office.com	0%	URL Reputation	safe
https://asgsmsproxyapi.azurewebsites.net/	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/android/policies	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.diagnosticssdf.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://shell.suite.office.com:1443	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/connectors	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/appinfo/query	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://powerlift.acompli.net	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://cortana.ai	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/imports	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://notification.m365.svc.cloud.microsoft/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://cloudfiles.onenote.com/upload.aspx	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnosticssdf.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://ofcrecsvcapi-int.azurewebsites.net/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://ic3.teams.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.microsoftstream.com/api/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://cr.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://portal.office.com/account/?ref=ClientMeControl	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/c2r/v1.0/DeltaAdvisory	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://graph.ppe.windows.net	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://powerlift-frontdesk.acompli.net	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://sr.outlook.office.net/ws/speech/recognize/assistant/work	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.scheduler.	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://store.office.cn/addinstemplate	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/autosuggest/api/v1/init?cvid=	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://globaldisco.crm.dynamics.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://messaging.engagement.office.com/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://dev0-api.acompli.net/autodetect	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.diagnosticssdf.office.com/v2/feedback	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://dataservice.o365filtering.com/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://officesetup.getmicrosoftkey.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://analysis.windows.net/powerbi/api	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://prod-global-autodetect.acompli.net/autodetect	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://substrate.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/autodiscover/autodiscover.json	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://notification.m365.svc.cloud.microsoft/PushNotifications.Register	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://d.docs.live.net	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://safelinks.protection.outlook.com/api/GetPolicy	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://ncus.contentsync.	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false		unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://apis.live.net/v5.0/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://officepyservice.office.net/service.functionality	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://templatesmetadata.office.net/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://messaging.lifecycle.office.com/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://mss.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://management.azure.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://wus2.contentsync.	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnostics.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://make.powerautomate.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.addins.omex.office.net/api/addins/search	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/odc/insertmedia	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://api.office.net	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://incidents.diagnosticssdf.office.com	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://asgsmsproxyapi.azurewebsites.net/	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	CEF99829-E51B-40CF-BEA5-492DC122C83C.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545187
Start date and time:	2024-10-30 08:09:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TzI4WHdB.eml renamed because original name is a hash value
Original Sample Name:	abx_CloudMessage_WzExNTEsICIzNDM4MzViMi01MDZjLTRmY2UtOTFjZi1iYWU0OGFkM2Y1MzBAN2VjYjBmOTctYWQxNC00OTg3LThjMmItY2QyYmI0ZTgyMDhhIiwgIkFBa0FMZ0FBQUFBQUhZUURFYXBtRWMyYnlBQ3FBQy1FV2cwQUNwb2hPLVFnRFU2R0VzOG9WTzI4WHdB.eml
Detection:	MAL
Classification:	mal48.winEML@3/18@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 40.126.32.76, 20.190.160.20, 40.126.32.140, 40.126.32.138, 40.126.32.68, 40.126.32.72, 40.126.32.74, 20.190.160.22, 52.109.76.240, 52.113.194.132, 2.19.126.160, 2.19.126.151, 104.208.16.88
Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, officeclient.microsoft.com, a1864.dscd.akamai.net, ecs.office.com, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, prod.configsvc1.live.com.akadns.net, s-0005-office.config.skype.com, onedscolprdcus08.centralus.cloudapp.azure.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, neu-azsc-config.officeapps.live.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: TzI4WHdB.eml

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.225680570497973
Encrypted:	false
SSDEEP:	1536:6YLIgsp2g8WgsnNcAz79ysQqt2/qoQ1rcm0FvEy7LGWyYiKvGusu1:hIgY8WgEmiGu2/qoQ1rt0Fvf7CWyDKH
MD5:	2D1AEA4E6DFF9A65514D8E91ACE2C116
SHA1:	8AD50A317341FB079BD6F570B312925B9D85564F
SHA-256:	F625477F50EA7B6B04DAC79BE86900CB36B05E9944462AFCB153CCA1B075DF24
SHA-512:	C04D85DC146976E5FEECCB34122CB0647D4154EE63349AF04A68107D59B3135460321025A2651B7E3FB266C428891037DD4E9C3473C478EF2B989A1809B231FF
Malicious:	false
Reputation:	low
Preview:	TH02...... .`.........SM01X...,...p.q...........IPM.Activity...........h...............h............H..h...............h............H..h.... ..........h....0..........h...............h...............h....@..........h....H..........0....T...............d.........2h...............k..............!h.............. h..............#h....8.........$h........8....."h..............'h..............1h....<.........0h....4........./h....h.......H..h....p.........-h..............+h............................ ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:	6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.3709505944546687
Encrypted:	false
SSDEEP:	3:LU:A
MD5:	C8C46CCD16B2D41BD77E0A44DEEBBB49
SHA1:	3300190C55079CB9D0E0AAD8CACC42831E27F6A6
SHA-256:	9CC09A69574784F1DB0B4EF7B36A39BD1D0F546614BE84C30A8806259D7F2872
SHA-512:	D647B273B789DC7736247CFA7E0453338AA432CFD1A97643C7904DB340863E9F14F9DC233806D5B4519FE252499D1CC136A819D5F80BFF073C12CD56B4C6783D
Malicious:	false
Reputation:	low
Preview:	1730272276

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CEF99829-E51B-40CF-BEA5-492DC122C83C

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180288
Entropy (8bit):	5.290999995661178
Encrypted:	false
SSDEEP:	1536:fi2XfRAqFbH41gLEwLe7HW8QM/o/NMOcAZl1p5ihs7EXXOEADpOoagYdGVF8S7CC:tPe7HW8QM/o/aXbbkx
MD5:	6341824246EC53A573C26DCFD31AC7EF
SHA1:	E48E43FE448AC30B039438F5245C1002A6817701
SHA-256:	25CBF63383C2EFD9E0A1EEC3977A8CE220B900EF5838E2F9E7F563118EC44DE3
SHA-512:	10156CF3795294D7259DA7E7F9980938AA1A5AB929E59964122A85F034BA37C5CC6D20035E62DD8125FFE8120D708713BB159EBBAB453891F732535D0EC03BC4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-30T07:11:07">.. Build: 16.0.18222.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04497712130921007
Encrypted:	false
SSDEEP:	3:GtlxtjlQ/uxZv2Q4tlxtjlQ/uxZv2It9R9//8l1lvlll1lllwlvlllglbelDbllb:GtkuH2Q4tkuH2ItX9X01PH4l942wU
MD5:	645F19039DC76F3433E6B13ECF2445A8
SHA1:	C3C858014E7E27C3D3CEBE556EC522C79EB5D37F
SHA-256:	218DB8FFD2AA1590C05E9F403877083540E580C1F91C8CAA44231C978AEA9C62
SHA-512:	BE9082E523135B93D4BCE4482268C35EFF60CDD5AA7905AC60D755DBE7D12E09F4E253EC728DC7F15F639D58DF29C0310C0BC9AFE676DE3353774D3E90314E21
Malicious:	false
Reputation:	low
Preview:	..-.......................6.....B....<..H....=..-.......................6.....B....<..H....=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	49472
Entropy (8bit):	0.4842266388364434
Encrypted:	false
SSDEEP:	48:r34XQ1jUll7DYMIjzO8VFDYMrKBO8VFDYML:VGll4x/jVGqAjVGC
MD5:	F9A40893E9E2D3A104BFA67B907B1247
SHA1:	2B599CC6377CDF177FB35E748199353B6E6B5976
SHA-256:	1022372B24C5A22839C7A973D0525FD6307C3714A1DEBE89B649C7F1FF3755DC
SHA-512:	48100F4EF5DED2B071CB85A0591159E743E754CCB79E134DB25582FED14A653FB58FA93975D6F4EC3D33B2F7C99DC91223D6FE30FBF3485850E6DDC4714DCDCD
Malicious:	false
Preview:	7....-............B....<.)..18W..........B....<.K5.d...SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730272264747654300_017780D0-FD05-4F99-858A-E1872B4B26C8.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28791), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.14568201259180352
Encrypted:	false
SSDEEP:	1536:SRKa9yWTqpSC+bWxwBThT8r0FFeOPdWUP698Okj4hH9d:M93Q+bzBFW
MD5:	1840174F79C89E20F02B5409E76D8DF2
SHA1:	9FE218CD8A53ABACB4F2AAF19CEABD31D896A455
SHA-256:	ABB0FE4ADA54633C26CDA3D4BC16D4720250DD8DB8573BA98025543EEDEB667A
SHA-512:	FA7FB7EF69260C44F15AFA3E070F760B2C9F5A82C48D24449F71901066C4B47596ED8D48EE2C6244BC40742F1186FB07080B1013947AD8A18E87954EFB893A84
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/30/2024 07:11:04.811.OUTLOOK (0xD0C).0xF24.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":23,"Time":"2024-10-30T07:11:04.811Z","Contract":"Office.System.Activity","Activity.CV":"0IB3AQX9mU+FiuGHK0smyA.4.7","Activity.Duration":20,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/30/2024 07:11:04.811.OUTLOOK (0xD0C).0xF24.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-10-30T07:11:04.811Z","Contract":"Office.System.Activity","Activity.CV":"0IB3AQX9mU+FiuGHK0smyA.4.8","Activity.Duration":18,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Da

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730272264748358500_017780D0-FD05-4F99-858A-E1872B4B26C8.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T0310310374-3340.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	4.503286818073832
Encrypted:	false
SSDEEP:	768:UVyFIMvWHW5W9Wco9ku1BoZQ4ptXow/Agg+0q9jrLmS8DvCRXiecr+D0:wc4Uq9jrVBXitrf
MD5:	702EBF75568F6A170D704AE3CB4AF25E
SHA1:	061932BC6AE1E188E108D09EFFC3361BCF1B8151
SHA-256:	17D15624B54BA39AA503C6341DF659BC08BBCAEAC85E709126D73D6F481E9331
SHA-512:	6D00A5CBB467091B78D238D26790FD954B9F09713F934FCE634D26497A2DF4D44E810DB6F26CD77EA7E6A69D78E401EBC48E8CB134CF0F3153013002AA9D0AEB
Malicious:	false
Preview:	............................................................................b...$.........f...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................PB.W..............f...........v.2._.O.U.T.L.O.O.K.:.d.0.c.:.4.a.f.a.8.4.2.b.7.e.0.3.4.2.2.9.a.6.2.a.2.d.b.4.c.1.8.e.d.e.2.3...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.3.0.T.0.3.1.0.3.1.0.3.7.4.-.3.3.4.0...e.t.l.............P.P.$.........f.*..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\olkEE59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	497450
Entropy (8bit):	6.002729917118743
Encrypted:	false
SSDEEP:	12288:S+mu+ItYC4ur4mGC9BV/iztJSQ8D366x8GKnUhtrpEw/J:Sfu8mGCbV6pJShD366on+J
MD5:	675AA69A189141F941CA473D0B851FD7
SHA1:	3528424496562984E0467EAC087AACC006305467
SHA-256:	A436AFCEF83CB7CB9C9F995D6409ECE1ED594CC74C0FD059A9AA3013923DBD8E
SHA-512:	388289C3EE1ACE44B239C1CEF41612851EC36E00526B8D606D1204D2A77DDEC5D4DB1347AB86AFE2C8A4AE4E1915BD3C8AA3AD4755EDC487683B6B4884C0DB9D
Malicious:	false
Preview:	XRIN5BUSd4Hs2PeA9KJtGfYRoB9/WmYpfyikEIgpmMHb+kNUQ8+NCS4B8D6iQL+RfgOWT6BEQCqiZQF59Th9+g1GbLuv274V7t4nG3ft1gkQttnPvP2W+vHy2XPI8w2dNLCAWgY5C/UFM3pUbgppAUnA/GpqbHPrADLa5Dz2Ti+Rhpvo1VhyZlVDFF6gL68JgN36wGLdAZJM64Im7k7gIiPIIukxbZsJ/vnw1aOK1XxIjitjUK3y386WG/YYV/dywm7y9mo9irjp6elB/6Emp154Wd5+/kWZH+OdLTy+LyVrdmyXR7/9W+WBT32jZIf7bXcS1OBDcPGlHn1llnlrqdrt06iquhaBpbu41B1cLQwwjGEv417jw7GmNhUjbD0XI/8VyiykpdSipK5S3b6PFOVuoNujatEn1Gcqppf+oHdI1nbgRBKAArGB/K/9SmRS9eOSRCY+TO/QTSemT45PoI9fGBjQiTkSJwhnxsdlenxMSnOz1KjpNYz7ayWYRn2meYIpBZ9sGvGoKaKGgpsTEzO68wP9E/ZR0Dee5MJLuIl3evBILLZ8eTE6Jzf0KHzwJR8/AWIg74gYVnr7aJ67R+ZadjfIZKMqE9xlUq/obpMZ2M3JEbqFEybkwcpNJ+LbbIBYbrAQYR6Ifkfpqgn+Dq02sqQZwMagWXYZKKdtVJTn7EdzATPzkO4AYfxrA5na2KajXgeV5TtMKYZQxSQgQ5hkhBbKXD9181QHdMA/3d98SPSbBRTvubOy3i8g6CYzYRQV03iSYxBx0DCHbt3Wq4ABVUMFA0XdXaE8/JsP3x7RhwOPXl+cXhREXWDB4RuYjFvmf25b41sBJf5x0FYbDqjcC0NDkuUOBZ6LqyWT6QvAhq1K4p/m4K4o2OqKJrrQ7xGoP7pB/9m/h66cc8SCN03UmpIoVaU1UxKZr0qy0pB0HQ2iYkXqE9NSvzIpCXToUxzABRcO0gbhAXsI/mLdtWzQPICMEgsGj49/HwkM

C:\Users\user\AppData\Local\Temp\~DFA5E9483B9A40E3EC.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFF24578F0CCBE5C89.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3613836054883338
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	679672A5004E0AF50529F33DB5469699
SHA1:	427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
SHA-256:	205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
SHA-512:	F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6688653379048958
Encrypted:	false
SSDEEP:	12:rl3baFFZqLKeTy2MyheC8T23BMyhe+S7wzQe9zNMyhe+S7xMyheCRMRkm:rvmnq1Pj961Kp
MD5:	172EDB4BD237A7713C04FEC54B09EDFF
SHA1:	22C880A59D76DA16A8833ED99C92C47067D831C2
SHA-256:	6D0677F48C38FE09BB6E2AF25D502F4A37F1BC0C3E889F5364DE7A1E173679C2
SHA-512:	75957E28AD050B36E3BCF2561E117D98CD9CC06AE0F8634783457CDABA3CD7E703F72B30073A1E30217DA733A1FD8B82B64ACAD502DC113674605C784686684D
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0Q5BIN5LC92R3RWMLVTN.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	9871
Entropy (8bit):	3.5404342367434247
Encrypted:	false
SSDEEP:	96:tzy1CZ/Kad9ky1a/Kaly1w/Kaxy1eW/KaYwy1CM/Kay:xySwyy5yktyDryNm
MD5:	F4E5C973EF794C471C13CEFF5D45511C
SHA1:	9DB0D9F486FE70CF0B4FCBE5FC10682F1496FD98
SHA-256:	D9750FB74C7F3D2ECC1095FC8710A87DBAEF0171889A3AC079E2B8563CACB775
SHA-512:	9D952A309BCB77AD2ACDCB88C6B5787380BBA4972339E36DEDF581A632C9D78A5283881AC104124332373C774706FD2F67D47F377EAAABADFB5780C3DF0883E6
Malicious:	false
Preview:	...................................FL..................F.@.. ...CY.Y....Q~.....~.Y............................;....P.O. .:i.....+00.../C:\.....................1.....^YL9..PROGRA~2.........O.I^YL9....................V.....{x..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....j.1.....DW.n..MICROS~2..R......DW.n^Yh9....U@........................M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....N.1.....DW.n..root..:......DW.n^YF9.............................r.o.o.t.....Z.1.....DW.n..Office16..B......DW.n^YF9.....<......................Y.O.f.f.i.c.e.1.6.....b.2.....DW.m .OUTLOOK.EXE.H......DW.m^YN9....Z*....................J...O.U.T.L.O.O.K...E.X.E.......p...............-.......o............F.......C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE.... .-.c. .I.P.M...N.o.t.e.A.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.R.o.o.t.\.O.f.f.i.c.e.1.6.\.O.U.T.L.O.O.K...E.X.E.........%ProgramFiles%\Microsoft Office\Root\

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6d2bac8f1edf6668.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	9871
Entropy (8bit):	3.5404342367434247
Encrypted:	false
SSDEEP:	96:tzy1CZ/Kad9ky1a/Kaly1w/Kaxy1eW/KaYwy1CM/Kay:xySwyy5yktyDryNm
MD5:	F4E5C973EF794C471C13CEFF5D45511C
SHA1:	9DB0D9F486FE70CF0B4FCBE5FC10682F1496FD98
SHA-256:	D9750FB74C7F3D2ECC1095FC8710A87DBAEF0171889A3AC079E2B8563CACB775
SHA-512:	9D952A309BCB77AD2ACDCB88C6B5787380BBA4972339E36DEDF581A632C9D78A5283881AC104124332373C774706FD2F67D47F377EAAABADFB5780C3DF0883E6
Malicious:	false
Preview:	...................................FL..................F.@.. ...CY.Y....Q~.....~.Y............................;....P.O. .:i.....+00.../C:\.....................1.....^YL9..PROGRA~2.........O.I^YL9....................V.....{x..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....j.1.....DW.n..MICROS~2..R......DW.n^Yh9....U@........................M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....N.1.....DW.n..root..:......DW.n^YF9.............................r.o.o.t.....Z.1.....DW.n..Office16..B......DW.n^YF9.....<......................Y.O.f.f.i.c.e.1.6.....b.2.....DW.m .OUTLOOK.EXE.H......DW.m^YN9....Z*....................J...O.U.T.L.O.O.K...E.X.E.......p...............-.......o............F.......C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE.... .-.c. .I.P.M...N.o.t.e.A.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.R.o.o.t.\.O.f.f.i.c.e.1.6.\.O.U.T.L.O.O.K...E.X.E.........%ProgramFiles%\Microsoft Office\Root\

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	2302976
Entropy (8bit):	2.761704874149365
Encrypted:	false
SSDEEP:	12288:yo/Hr+hHlWscqH52NpJQIzeTLYsnGCXb55SIsVePCKPbTUpBVXD:BHyLJZ2dQI2LOC1k1Veza7z
MD5:	B9A8A2DFE883F416DEDAE270EEE0A122
SHA1:	AD6681A15308AD9C501BD15A0652EBFF5A2CC352
SHA-256:	3407CD06A1E70C3E88972D3D409982344E72DEC00B9D90F0EF713AA0D246E569
SHA-512:	BF5574E544AE6ECBC8CA2CC727A427167162115DBAF60E1E3E8BE47A372ECDFD6E7F5ED973959CF8CE6AEC696A495C02BD72FEFE6A867E060E20BD92F781199D
Malicious:	true
Preview:	!BDN.Z..SM......\........K..............R................@...........@...@...................................@...........................................................................$#......D...............................................z..................................................................................................................................................................................................................................................................................\|.........*G..J.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	5.816580174846835
Encrypted:	false
SSDEEP:	12288:Qo/jTmgH6W7Mqg52NcJ3IbKRIYsnxC81azZS9a9+J+8FT7ubpYrn:vjqNwM2C3IUIpCpFSa9MANyn
MD5:	521542C5267A647F425B15CC932B1DEC
SHA1:	6B6A25FE0E970CD2BEE449DBBF7F087273FF75A2
SHA-256:	6673739E3EB54762EA8DFAAB20A6ED76CA3772779048B7FCDE3E4E23657CD9E7
SHA-512:	224C43121CFF0FFE18E7C022F37C5851D79F4D23D9A40F027C953576B565A7FB5ED58173DD4032DAB4DF651FA5805CF6CC7A731159F4F22493AFC8B50EAD6D37
Malicious:	true
Preview:	7z.JC.................N.....................#.!BDN.Z..SM......\........K..............R................@...........@...@...................................@...........................................................................$#......D...............................................z..................................................................................................................................................................................................................................................................................\|.........G..J...N.*.......N............#..........p......4....0Q..........V...... ...P1Q......................1Q.........@............2Q.................<...03Q.....................p4Q..........~......p....5Q.................P....5Q.................8....6Q......................6Q.....................P;Q. ...............8.....P.`.....................P.d........H............P.h........9..........(.P.l.....................P.p.......

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.725966007224554
TrID:
File name:	TzI4WHdB.eml
File size:	868'113 bytes
MD5:	e19f63f9bb12a84201981d2883f16f0b
SHA1:	0fdec99e011b087fb7bc42aeacfda7092d15547d
SHA256:	341085157751cb6bf6fe113797dcc777b33c3f2ba37914d14333948d9bb51bc2
SHA512:	cba7592e20e39d1dd2019d15edda357aa0047f6cb806adaa2dcb615b67fc45947728d4ebe59f862b1712381cf454a28dca7236b8589da177b61af45d5ae640f6
SSDEEP:	12288:n3Xa4gSkBIQjXP+PZGz87azcuaus7bni8fUZtdFRu7UbfaFMjt10c8TiTuNDqdr:nnMS2I8f+PC9pa/bnisSjFOfMcc8TArx
TLSH:	4205F12407883FA9CA54672EF07A220D5BF4178AC96533CC6B67AD4B7FFEC040A165B5
File Content Preview:	authentication-results: spf=pass (sender IP is 185.129.138.188).. smtp.mailfrom=christoff.ie; dkim=none (message not signed).. header.d=none;dmarc=bestguesspass action=none.. header.from=christoff.ie;compauth=pass reason=109..date: Wed, 02 Oct 2024 11:05:

Static Mail

General

Subject:	Your Document-108886102157-ao5SKSoo1s Ready
From:	Yazaki-europe 97145610840-5Z4iNPo9qI <shane@christoff.ie>
To:	ergun.tan@yazaki-europe.com
Cc:
BCC:
Date:	Wed, 02 Oct 2024 11:05:49 +0000
Communications:	CAUTION: This email originated outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If the email is suspicious, please report it using the 'Phish Alert Report' button. CAUTION: This email originated outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If the email is suspicious, please report it using the 'Phish Alert Report' button. CAUTION: This email originated outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If the email is suspicious, please report it using the 'Phish Alert Report' button. CAUTION: This email originated outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If the email is suspicious, please report it using the 'Phish Alert Report' button. CAUTION: This email originated outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If the email is suspicious, please report it using the 'Phish Alert Report' button. CAUTION: This email originated outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If the email is suspicious, please report it using the 'Phish Alert Report' button. CAUTION: This email originated outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. If the email is suspicious, please report it using the 'Phish Alert Report' button. CAUTION:
Attachments:	Reff_Yazaki-europe_575810710108_ZnjKTIejsM.html

Headers

Key	Value
authentication-results	spf=pass (sender IP is 185.129.138.188) smtp.mailfrom=christoff.ie; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=christoff.ie;compauth=pass reason=109
date	Wed, 02 Oct 2024 11:05:49 +0000
from	Yazaki-europe 97145610840-5Z4iNPo9qI <shane@christoff.ie>
message-id	<0c1863b1-1ba3-47b8-81ff-cd0296df734d@SJ1PEPF00001CEB.namprd03.prod.outlook.com>
mime-version	1.0
received	from PH8PR10MB6646.namprd10.prod.outlook.com (2603:10b6:510:222::19) by BLAPR10MB4884.namprd10.prod.outlook.com with HTTPS; Wed, 2 Oct 2024 11:05:58 +0000, from MW4PR04CA0372.namprd04.prod.outlook.com (2603:10b6:303:81::17) by PH8PR10MB6646.namprd10.prod.outlook.com (2603:10b6:510:222::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8026.16; Wed, 2 Oct 2024 11:05:51 +0000, from SJ1PEPF00001CEB.namprd03.prod.outlook.com (2603:10b6:303:81:cafe::13) by MW4PR04CA0372.outlook.office365.com (2603:10b6:303:81::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8005.29 via Frontend Transport; Wed, 2 Oct 2024 11:05:51 +0000, from h3.cmg2.smtp.forpsi.com (185.129.138.188) by SJ1PEPF00001CEB.mail.protection.outlook.com (10.167.242.27) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8026.11 via Frontend Transport; Wed, 2 Oct 2024 11:05:49 +0000, from masopa.internal.cloudapp.net ([52.235.1.214]) by cmgsmtp with ESMTPSA id vxAusMu9UTNCyvxAvsKcye; Wed, 02 Oct 2024 13:05:47 +0200
received-spf	Pass (protection.outlook.com: domain of christoff.ie designates 185.129.138.188 as permitted sender) receiver=protection.outlook.com; client-ip=185.129.138.188; helo=h3.cmg2.smtp.forpsi.com; pr=C
return-path	shane@christoff.ie
sender	shane@christoff.ie
subject	Your Document-108886102157-ao5SKSoo1s Ready
to	ergun.tan@yazaki-europe.com
x-cmae-envelope	MS4xfGU5dS2NSVTRLZpCuHrY9q1Ou/aw10CFwwszJROj36MlSj3r9ubwzncVsosHUwqBI3IX1bwqIgyPqv7l6R71eFAusvh+N5WnfZ1lYXHcLfLRVRnlN1nm xmWv6bJezQEqzelCb7Te2Vx3mBt7n2XKfA74BP7EwZ06K7ba2VR4xQ6fMA3iqivJ25V/sU2vOGTyUObwKsMq2z97KQUlyqVW86E=
x-eopattributedmessage	0
x-eoptenantattributedmessage	7ecb0f97-ad14-4987-8c2b-cd2bb4e8208a:0
x-forefront-antispam-report	CIP:185.129.138.188;CTRY:CZ;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:h3.cmg2.smtp.forpsi.com;PTR:h3.cmg2.smtp.forpsi.com;CAT:NONE;SFS:(13230040)(2613699012)(43540500003);DIR:INB;
x-microsoft-antispam	BCL:0;ARA:13230040\|2613699012\|43540500003;
x-microsoft-antispam-mailbox-delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
x-microsoft-antispam-message-info	au0s0V0NV6x59PD8HERSS+kKbC2hs0qF/NDSegCqNbFLD5ndJlb6KK7l5RD05DXqUGK/6ffvcLKweysc7pxgrFzXwS3iRB7Iq6LGUSNIOM3QjnjY4SCjRV3PfkRPlblzrC8qRj5mqwJXQrEjALSKUam223FEFRh2WMofZjVl53AqZPCEiXs5Hb8771at9BnVk4XEXCpqGYMuJYat1QE/6iH+xKiMQiEzrBlm94vagxdQZlvd91Cz9KlxCexwlRxBHSk9dDMKDRiVaSdTKlXsMwH4mLOYc32Q+DM6LX00+TvlICCtwc+Yx+7N6Ky3845IFBRyH4XQQieZDOUCqoGKcF88sONBQ8QQzfWcgEKb+2QWqFy+45QUTZasuxaHGMsE74E5xDOnAIcDOHE3PzvpYFRAY2N4AdWfKt4z1Z3dwbZBJX6AF9hbuxeE4eU54wLFTxltJOxhq2/3uAc+jNORA0KYbZk5u5vpk65F7YLs91BkpJW5BNLCeDRejaF5HllqePdaALSyxIExbCmHEsrdzTU8tD2IWM6nB4/oLA9Tl/GFHGlnUCUozP/xeUTBzcKs6DpRCSDFWdDtGJ6++wjzKP5BVCXIR0xTdgJseO6YYNH1ArWGKFhPmPwJlBtzhJhcsFNaR3h4bLv3TjHp5ZWnIl1Tjn0GDWoM+Ohz7u9pFd07c8aVjO/bniSqLLuPJKU5kURqa97nVldsQQ95lSCj2WKck4Ez/a0IyV3BoD5yr2uNWOHM1WNuisU5VQwy84K6PA6m+i6UFNTp4m4mzOkvDVNEZ8d/LjCw5Oy69JijUENVFoaZPKSBv/c/0VlxUHjOp3w8+1u/cxncGXof/02gbhHtaM2ptz9AfiGfD5dOYd1PGmKkuDsp8ChpG05HpF48Aq+EBEwanmsQtHvIq2GAtpFoInW9eG5EIIj3g4vIr+DvPr9vooH8ZK+G6UwXeWRs57OBPJ0JLO6tgwXaL6l/KjCngFVRNihj2uaOp1DjxZEsElrlxSRjSl+DuYa188rWUyy+ohPAeNC8rGOJN7IkIIVeRx7C74ysRgip4yWoAxW6GY/CqB6TVN2EbN9NuXlni5Os2aSLpzKicIN1oPJf++8Q6N5hjHOPbK2jGm+cGxyTQUh/VCRMtCYCr9OXAJgA8sM7NRETVMr3/Jj1Bu9h1P0p9DX1obXS4zOtFvVcXPL79iOGZNF8Kv/Pig6sLexyjJGJOjiPQRw170pUyTdZ+NvX2LnrbMbWTYMiNRiqZ4eEqCAbZ8VgEIBSV7XvRfp6/2PFZ7yZz1A8hGOy626bM0HRkMTob7yUEUUBdmwAiXZZhS/GLIHU3tlagmZDLQyDD+HTOwg2g5nRnLSZJeSQlWX0eXq9V/1OCe/c9y1hhkpBnbvmJZIzbJszEZXh4VkuXHUEzrZ9oVdnryXN2uryEZH3hdLCurgh6xlfkMjJQtrHfWl1GkjjkKxpPrEVo54zuCBcV+A0vbI7TbJ62eVAmbAGwMI7SeDDwhGOvv+4YxpasW/CzTDIhDwt6BBMc9REmty/pry4QBKq6KMWlo+B3ClTPCEzHv3qL6mWaAP8NJBrsMY06/lKsRSnkEZngNXzpjz5i5nyn0uZqgcd7de7pyhXC3Q1E6GYlsCSdTpy955frGdL/eI4qpwHjOpIofxnyaFJwlvDyoE5rC8ENAvMRMNTn6fwF0wmpUZW/ctXfIHfevNhUGQtwlzyQOgjTE0N4X6L3iX39Rt7ucaU/7PqQ9J49A+ndRMPktxUp6AeDylAJ/DhXgBx9tuNnzUWNK6l
x-ms-exchange-crosstenant-authas	Anonymous
x-ms-exchange-crosstenant-authsource	SJ1PEPF00001CEB.namprd03.prod.outlook.com
x-ms-exchange-crosstenant-fromentityheader	Internet
x-ms-exchange-crosstenant-id	7ecb0f97-ad14-4987-8c2b-cd2bb4e8208a
x-ms-exchange-crosstenant-network-message-id	1ac512ff-40c9-48b7-afb0-08dce2d22cac
x-ms-exchange-crosstenant-originalarrivaltime	02 Oct 2024 11:05:49.3417 (UTC)
x-ms-exchange-organization-authas	Anonymous
x-ms-exchange-organization-authsource	SJ1PEPF00001CEB.namprd03.prod.outlook.com
x-ms-exchange-organization-expirationinterval	1:00:00:00.0000000
x-ms-exchange-organization-expirationintervalreason	OriginalSubmit
x-ms-exchange-organization-expirationstarttime	02 Oct 2024 11:05:50.0292 (UTC)
x-ms-exchange-organization-expirationstarttimereason	OriginalSubmit
x-ms-exchange-organization-messagedirectionality	Incoming
x-ms-exchange-organization-network-message-id	1ac512ff-40c9-48b7-afb0-08dce2d22cac
x-ms-exchange-organization-scl	1
x-ms-exchange-processed-by-bccfoldering	15.20.8026.016
x-ms-exchange-transport-crosstenantheadersstamped	PH8PR10MB6646
x-ms-exchange-transport-endtoendlatency	00:00:09.0306827
x-ms-office365-filtering-correlation-id	1ac512ff-40c9-48b7-afb0-08dce2d22cac
x-ms-publictraffictype	Email
x-ms-traffictypediagnostic	SJ1PEPF00001CEB:EE_\|PH8PR10MB6646:EE_\|BLAPR10MB4884:EE_
x-priority	1
Content-Type	multipart/mixed; boundary="===============5865403979696187278=="

File Icon


Icon Hash:	46070c0a8e0c67d6

Target ID:	0
Start time:	03:10:28
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\TzI4WHdB.eml"
Imagebase:	0x580000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:11:13
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "2069FA85-72DE-46F8-A66F-416FB100A68D" "F9F13E94-A5CF-4A96-8604-53C720F8C1C8" "3340" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff600a10000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TzI4WHdB.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CEF99829-E51B-40CF-BEA5-492DC122C83C

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730272264747654300_017780D0-FD05-4F99-858A-E1872B4B26C8.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1730272264748358500_017780D0-FD05-4F99-858A-E1872B4B26C8.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241030T0310310374-3340.etl

C:\Users\user\AppData\Local\Temp\olkEE59.tmp

C:\Users\user\AppData\Local\Temp\~DFA5E9483B9A40E3EC.TMP

C:\Users\user\AppData\Local\Temp\~DFF24578F0CCBE5C89.TMP

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0Q5BIN5LC92R3RWMLVTN.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6d2bac8f1edf6668.customDestinations-ms (copy)

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Static File Info

General

Static Mail

General

Headers

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
TzI4WHdB.eml