Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
I RECORDED YOU! (1.97 KB).msg

Overview

General Information

Sample name:I RECORDED YOU! (1.97 KB).msg
Analysis ID:1417542
MD5:256182511dab8545923eb5bf63cb0980
SHA1:6808b0efdd6e36bb137bb7ca6cf14931ae3821b4
SHA256:6617ec557d7431df4f2a9832d223bdcce2678380d88c1de77aa650bac1f058cb
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Creates a window with clipboard capturing capabilities
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Tries to load missing DLLs

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 1100 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\I RECORDED YOU! (1.97 KB).msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6088 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "70FDBBC0-0AB7-40AD-88BC-07CDFF1497AF" "E608BE7A-C199-4627-A222-2F3B67DC1148" "1100" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1100, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.aadrm.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.aadrm.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.cortana.ai
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.microsoftstream.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.office.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.onedrive.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://api.scheduler.
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://augloop.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://augloop.office.com/v2
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://cdn.entity.
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://clients.config.office.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://clients.config.office.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://config.edge.skype.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://cortana.ai
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://cortana.ai/api
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://cr.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://d.docs.live.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://dev.cortana.ai
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://devnull.onenote.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://directory.services.
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ecs.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://edge.skype.com/rps
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://graph.windows.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://graph.windows.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ic3.teams.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://invites.office.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://lifecycle.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://login.microsoftonline.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://login.windows.local
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://make.powerautomate.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://management.azure.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://management.azure.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messaging.action.office.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://messaging.office.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ncus.contentsync.
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://officeapps.live.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://officepyservice.office.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://onedrive.live.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://outlook.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://outlook.office.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://outlook.office365.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://outlook.office365.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://outlook.office365.com/connectors
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://powerlift.acompli.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://pushchannel.1drv.ms
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://res.cdn.office.net
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.39
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://settings.outlook.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://staging.cortana.ai
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://substrate.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://tasks.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://templatesmetadata.office.net/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://webshell.suite.office.com
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://wus2.contentsync.
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drString found in binary or memory: https://www.yammer.com
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow created: window name: CLIPBRDWNDCLASSJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: classification engineClassification label: clean2.winMSG@3/16@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240329T1533120090-1100.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\I RECORDED YOU! (1.97 KB).msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "70FDBBC0-0AB7-40AD-88BC-07CDFF1497AF" "E608BE7A-C199-4627-A222-2F3B67DC1148" "1100" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "70FDBBC0-0AB7-40AD-88BC-07CDFF1497AF" "E608BE7A-C199-4627-A222-2F3B67DC1148" "1100" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow detected: Number of UI elements: 13
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote Services1
Clipboard Data		Data ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1417542 Sample: I RECORDED YOU! (1.97 KB).msg Startdate: 29/03/2024 Architecture: WINDOWS Score: 2 5 OUTLOOK.EXE 64 121 2->5         started        process3 7 ai.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
I RECORDED YOU! (1.97 KB).msg0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://otelrules.svc.static.microsoft0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://my.microsoftpersonalcontent.com0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h0%Avira URL Cloudsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%Avira URL Cloudsafe
https://d.docs.live.net0%Avira URL Cloudsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%VirustotalBrowse
https://d.docs.live.net0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
    		high
    https://login.microsoftonline.com/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
      		high
      https://shell.suite.office.com:1443C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
        		high
        https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
          		high
          https://autodiscover-s.outlook.com/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
            		high
            https://useraudit.o365auditrealtimeingestion.manage.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
              		high
              https://outlook.office365.com/connectorsC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                		high
                https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                  		high
                  https://cdn.entity.C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  https://api.addins.omex.office.net/appinfo/queryC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                    		high
                    https://clients.config.office.net/user/v1.0/tenantassociationkeyC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                      		high
                      https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                        		high
                        https://powerlift.acompli.netC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://rpsticket.partnerservices.getmicrosoftkey.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://lookup.onenote.com/lookup/geolocation/v1C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                          		high
                          https://cortana.aiC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                            		high
                            https://api.powerbi.com/v1.0/myorg/importsC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                              		high
                              https://cloudfiles.onenote.com/upload.aspxC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                		high
                                https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                  		high
                                  https://entitlement.diagnosticssdf.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                    		high
                                    https://api.aadrm.com/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://ofcrecsvcapi-int.azurewebsites.net/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://ic3.teams.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                      		high
                                      https://www.yammer.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                        		high
                                        https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                          		high
                                          https://api.microsoftstream.com/api/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                            		high
                                            https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                              		high
                                              https://cr.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                		high
                                                https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;hC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                • Avira URL Cloud: safe
                                                		low
                                                https://messagebroker.mobile.m365.svc.cloud.microsoftC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://otelrules.svc.static.microsoftC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://portal.office.com/account/?ref=ClientMeControlC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                  		high
                                                  https://clients.config.office.net/c2r/v1.0/DeltaAdvisoryC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                    		high
                                                    https://edge.skype.com/registrar/prodC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                      		high
                                                      https://graph.ppe.windows.netC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                        		high
                                                        https://res.getmicrosoftkey.com/api/redemptioneventsC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://powerlift-frontdesk.acompli.netC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://tasks.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                          		high
                                                          https://officeci.azurewebsites.net/api/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://sr.outlook.office.net/ws/speech/recognize/assistant/workC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                            		high
                                                            https://api.scheduler.C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://my.microsoftpersonalcontent.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://store.office.cn/addinstemplateC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://api.aadrm.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://edge.skype.com/rpsC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                              		high
                                                              https://outlook.office.com/autosuggest/api/v1/init?cvid=C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                		high
                                                                https://globaldisco.crm.dynamics.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                  		high
                                                                  https://messaging.engagement.office.com/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                    		high
                                                                    https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                      		high
                                                                      https://dev0-api.acompli.net/autodetectC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://www.odwebp.svc.msC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                      • URL Reputation: safe
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://api.diagnosticssdf.office.com/v2/feedbackC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                        		high
                                                                        https://api.powerbi.com/v1.0/myorg/groupsC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                          		high
                                                                          https://web.microsoftstream.com/video/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                            		high
                                                                            https://api.addins.store.officeppe.com/addinstemplateC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                            • URL Reputation: safe
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://graph.windows.netC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                              		high
                                                                              https://dataservice.o365filtering.com/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://officesetup.getmicrosoftkey.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://analysis.windows.net/powerbi/apiC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                		high
                                                                                https://prod-global-autodetect.acompli.net/autodetectC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://substrate.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                  		high
                                                                                  https://outlook.office365.com/autodiscover/autodiscover.jsonC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                    		high
                                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                      		high
                                                                                      https://consent.config.office.com/consentcheckin/v1.0/consentsC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                        		high
                                                                                        https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                          		high
                                                                                          https://learningtools.onenote.com/learningtoolsapi/v2.0/GetvoicesC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                            		high
                                                                                            https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                              		high
                                                                                              https://d.docs.live.netC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                              • 0%, Virustotal, Browse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://safelinks.protection.outlook.com/api/GetPolicyC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                		high
                                                                                                https://ncus.contentsync.C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                • URL Reputation: safe
                                                                                                • URL Reputation: safe
                                                                                                		unknown
                                                                                                https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                  		high
                                                                                                  https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                    		high
                                                                                                    http://weather.service.msn.com/data.aspxC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                      		high
                                                                                                      https://apis.live.net/v5.0/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                      • URL Reputation: safe
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://officepyservice.office.net/service.functionalityC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                        		high
                                                                                                        https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                          		high
                                                                                                          https://templatesmetadata.office.net/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                            		high
                                                                                                            https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                              		high
                                                                                                              https://messaging.lifecycle.office.com/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                		high
                                                                                                                https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                  		high
                                                                                                                  https://pushchannel.1drv.msC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                    		high
                                                                                                                    https://management.azure.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                      		high
                                                                                                                      https://outlook.office365.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                        		high
                                                                                                                        https://wus2.contentsync.C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        		unknown
                                                                                                                        https://incidents.diagnostics.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                          		high
                                                                                                                          https://clients.config.office.net/user/v1.0/iosC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                            		high
                                                                                                                            https://make.powerautomate.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            • URL Reputation: safe
                                                                                                                            		unknown
                                                                                                                            https://api.addins.omex.office.net/api/addins/searchC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                              		high
                                                                                                                              https://insertmedia.bing.office.net/odc/insertmediaC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                		high
                                                                                                                                https://outlook.office365.com/api/v1.0/me/ActivitiesC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                  		high
                                                                                                                                  https://api.office.netC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                    		high
                                                                                                                                    https://incidents.diagnosticssdf.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                      		high
                                                                                                                                      https://asgsmsproxyapi.azurewebsites.net/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      		unknown
                                                                                                                                      https://clients.config.office.net/user/v1.0/android/policiesC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                        		high
                                                                                                                                        https://entitlement.diagnostics.office.comC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                          		high
                                                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                            		high
                                                                                                                                            https://substrate.office.com/search/api/v2/initC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                              		high
                                                                                                                                              https://outlook.office.com/C3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                                		high
                                                                                                                                                https://storage.live.com/clientlogs/uploadlocationC3C37F61-6A0E-4DB6-9D05-00B223A52EE4.0.drfalse
                                                                                                                                                  		high

                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                  ⊘No contacted IP infos

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                  Analysis ID:1417542
                                                                                                                                                  Start date and time:2024-03-29 15:32:46 +01:00
                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 3m 52s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:full
                                                                                                                                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                  Number of analysed new started processes analysed:15
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                  Sample name:I RECORDED YOU! (1.97 KB).msg
                                                                                                                                                  Detection:CLEAN
                                                                                                                                                  Classification:clean2.winMSG@3/16@0/0
                                                                                                                                                  EGA Information:Failed
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  • Number of executed functions: 0
                                                                                                                                                  • Number of non-executed functions: 0
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Found application associated with file extension: .msg

                                                                                                                                                  Warnings

                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.6.63, 23.62.230.21, 23.62.230.14, 52.113.194.132, 52.168.117.171
                                                                                                                                                  • Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, eus2-azsc-000.roaming.officeapps.live.com, osiprod-eus2-buff-azsc-000.eastus2.cloudapp.azure.com, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, login.live.com, onedscolprdeus16.eastus.cloudapp.azure.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, a1864.dscd.akamai.net, ecs.office.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, us1.roaming1.live.com.akadns.net, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net
                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  ⊘No simulations

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  ⊘No context

                                                                                                                                                  Domains

                                                                                                                                                  ⊘No context

                                                                                                                                                  ASNs

                                                                                                                                                  ⊘No context

                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                  ⊘No context

                                                                                                                                                  Dropped Files

                                                                                                                                                  ⊘No context

                                                                                                                                                  Created / dropped Files

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):231348
                                                                                                                                                  Entropy (8bit):4.396808189884732
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:xxYL4cgsLPipG6YiEgsssNcAz79ysQqt2/Y9/qoQ5Ercm0Fv6CZykGqE9FgfBOmu:YrgJXCgamiGu2KqoQart0FvsAt40pXM
                                                                                                                                                  MD5:F64864C45BAEF4793A6DAC350D065D0A
                                                                                                                                                  SHA1:4F10FD291A551FCE456E661F70D2E54F1AC0A28D
                                                                                                                                                  SHA-256:6AB80BD4C87352AC8342A16791249A3AF5502E1F465DF410ED165C59AD99C212
                                                                                                                                                  SHA-512:EC42F4F2986C849DE2213ACE750C8D705ABF3198ABBDD1D5E9261E2C41829B57B489872438CD0C5433E8C2820783C28D9A3868BD40632D5299CCD26183C74F82
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:TH02...... ..%"........SM01X...,..................IPM.Activity...........h...............h............H..h.........'.k...h.........~..H..h\cal ...pDat...hx...0........h.??............h........_`.j...h.>?.@...I.lw...h....H...8..j...0....T...............d.........2h...............k..............!h.............. h..............#h....8.........$h.~......8....."h`.............'h..............1h.??.<.........0h....4.....j../h....h......jH..h. ..p.........-h .......$.....+h.<?.....x................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):322260
                                                                                                                                                  Entropy (8bit):4.000299760592446
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
                                                                                                                                                  MD5:CC90D669144261B198DEAD45AA266572
                                                                                                                                                  SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                                                                                                                                                  SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                                                                                                                                                  SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                  Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):10
                                                                                                                                                  Entropy (8bit):2.1709505944546685
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:LyfQ:ufQ
                                                                                                                                                  MD5:436F2A243682EBD7662EC915FC347BF2
                                                                                                                                                  SHA1:4C050A821609183A46A158644BC7F7670C01FCD8
                                                                                                                                                  SHA-256:46106F0E4941B44D3C69526F5524AF8A47F00CEAB4A41129D624B43660F669FB
                                                                                                                                                  SHA-512:52BFA96E585C4D64CCF88BEC5D58E42D6CC6FA25C50ED9730A54985A3704B0C7D07CD919D91B67425184954174AFEABEAAF689E7F3CCE68712311328A4C2BE14
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:1711722795

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C3C37F61-6A0E-4DB6-9D05-00B223A52EE4

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):165923
                                                                                                                                                  Entropy (8bit):5.341241346194577
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:i+C7FPgOuB3U9guwwJQ9DQA+zezhQik4F77nXmvYd8XRTEwreOR6g:ZIQ9DQA+zezyXeMJ
                                                                                                                                                  MD5:306F20623E45E99DBC476433EC8E1536
                                                                                                                                                  SHA1:2FD465561BB480EA1C4C46FE5988A6D11AE150F6
                                                                                                                                                  SHA-256:139319D6039601129B4CF18E6ED6C7ED91AB5513049EEC92ECF9A6AA728F0F74
                                                                                                                                                  SHA-512:94B64D53B198BF8D369AAFC13F7F04C3315A6CB9B73986E49C0F608CA8685CE15ACFA97608FCFF8D5994B9DBF7B098C59FD7065FCC9262FCB83A7E8D55E57B23
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-03-29T14:33:14">.. Build: 16.0.17524.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):4096
                                                                                                                                                  Entropy (8bit):0.09304735440217722
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:lSWFN3l/klslpEl9Xll:l9F8E+9
                                                                                                                                                  MD5:D0DE7DB24F7B0C0FE636B34E253F1562
                                                                                                                                                  SHA1:6EF2957FDEDDC3EB84974F136C22E39553287B80
                                                                                                                                                  SHA-256:B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
                                                                                                                                                  SHA-512:42D00510CD9771CE63D44991EA10C10C8FBCF69DF08819D60B7F8E7B0F9B1D385AE26912C847A024D1D127EC098904784147218869AE8D2050BCE9B306DB2DDE
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:moderate, very likely benign file
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................K.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:SQLite Rollback Journal
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):4616
                                                                                                                                                  Entropy (8bit):0.13784977103055013
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:7FEG2l+6xwlS/FllkpMRgSWbNFl/sl+ltlslN04l9Xllj:7+/lFxWKg9bNFlEs1E397
                                                                                                                                                  MD5:4A0F39947055F1673BD6B8D382F659E6
                                                                                                                                                  SHA1:397AB7E6DBC75F3FC0BF2CE6036105B7389DE4BB
                                                                                                                                                  SHA-256:DDBA6C6CABF2D9BDE8B5105B33C20647EFADC45DFB3FD67B6EE40895776C0BAE
                                                                                                                                                  SHA-512:E4BB9378F7CBCE7E9C91876949191EFAD63504E71F0DB788F59454A46DBA14D506FFBD608C19FEA5BD72E3799DB3E221031488CAC80B2928E99F218E5DFEF727
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:.... .c....._.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):32768
                                                                                                                                                  Entropy (8bit):0.0446603401158491
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:6:G4l2g+vPZlY4l2g+vPZ/SL9XXPH4l942U:l2x32m5A0
                                                                                                                                                  MD5:FC882B23D9A3BE70C1F25B684108D435
                                                                                                                                                  SHA1:89EA28EA5A370ED9930829C723A1050356BD07E9
                                                                                                                                                  SHA-256:79DC26EFCA88FEDCC2028ADD9E5C23EBD93ABDAD9540B5A68930190F78093837
                                                                                                                                                  SHA-512:F1EEBA794FA7AF550BB7EC1205E9DE693A33D77E9BFBF78D9D07EDF9DCD5461C581872294E1E39CFACCEDF7134336131F1D0CCA079919982B8AA087516AA3AAF
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:..-......................TL*. .e...U...KZ.:9.<..-......................TL*. .e...U...KZ.:9.<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                  Category:modified
                                                                                                                                                  Size (bytes):45352
                                                                                                                                                  Entropy (8bit):0.3942112049918054
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:KasPo6QMIzRDKofdill7DBtDi4kZERDKS/N6qxqt8VtbDBtDi4kZERDKa:6g6Qjp1ill7DYMx/5xO8VFDYM
                                                                                                                                                  MD5:1446917C0EC9CBE3EEE6860A59153CE3
                                                                                                                                                  SHA1:99CEF675D18A00E8A356096D7809CC01DA0D3EC9
                                                                                                                                                  SHA-256:595EF54564A2A6AD544C3994AC19742B18C45CA9C524BD53E4A5020917F9A8D6
                                                                                                                                                  SHA-512:7343A82D94C59F4110DC1B2105CA3AB6A65060AB5B99428DB00EF4C9DF26AE152ECE2BEECD32AD13DC58C49A8591036A5B5B1E9573F96DA5BCEDFCAAACC4CC7C
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:7....-..........e...U...o.x.L.(........e...U..\.'..8%.SQLite format 3......@ ..........................................................................K.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711722792294208800_3FBB6D4D-9C91-438A-A2BB-402811EF3BDC.log

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:ASCII text, with very long lines (28723), with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):20971520
                                                                                                                                                  Entropy (8bit):0.15937376250464796
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:hWyobywOtmTVX8IGzC7v2E3wDSe4EyRm2s3O/OJfFI5iNeMFl08g6fmIuuOurjq6:oyTg58IMB/wMnz
                                                                                                                                                  MD5:B162C7CF742105CE6882CA6AD54CB770
                                                                                                                                                  SHA1:1B95072C17D4C7A26213BDB457C643A34183F304
                                                                                                                                                  SHA-256:EBDF1A4C8E45CDC8AB32D0F9013D02450F0C3FAC6278B9227DCF6D8F514567BA
                                                                                                                                                  SHA-512:77E6FF45BD4A64A60CC0D886C2567B411604A20D48DDAAB4D26F667C5D70355C54B19583D36922F5304EFBFC7748CEBDACF93C5736F8C09FE77AFF8F775771B8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..03/29/2024 14:33:12.329.OUTLOOK (0x44C).0xE74.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":21,"Time":"2024-03-29T14:33:12.329Z","Contract":"Office.System.Activity","Activity.CV":"TW27P5GcikOiu0AoEe873A.4.9","Activity.Duration":12,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...03/29/2024 14:33:12.345.OUTLOOK (0x44C).0xE74.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":23,"Time":"2024-03-29T14:33:12.345Z","Contract":"Office.System.Activity","Activity.CV":"TW27P5GcikOiu0AoEe873A.4.10","Activity.Duration":11371,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersi

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711722792295483500_3FBB6D4D-9C91-438A-A2BB-402811EF3BDC.log

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):20971520
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3::
                                                                                                                                                  MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                                                                                                                                  SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                                                                                                                                  SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                                                                                                                                  SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240329T1533120090-1100.etl

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):94208
                                                                                                                                                  Entropy (8bit):4.462045902116319
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:768:XEUZGayE/TlXqCa4U/96GJSfjXtQ69WrWprjlmYX:XMH4U/96GJoX26vjJ
                                                                                                                                                  MD5:4E05870781CA95A950018193C1C7C9BF
                                                                                                                                                  SHA1:EB40F22378EF667B956BBFAC78DB4A89A4A7A5BD
                                                                                                                                                  SHA-256:63E485B4137F8F2B707AE5A12AAB68AE1C60BC1F164C786A69AC0F842E7E72BC
                                                                                                                                                  SHA-512:217100694D79AB2FE7AEC80D00A17CCC52E48D3D21975C4BAA116A8E3B175A651BDB7494277E432BF285854074A994FDF79D84466BCC08E4BE39E3EAF42294D6
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:............................................................................^...t...L....d.....................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1.............................................................I..Y...........d.............v.2._.O.U.T.L.O.O.K.:.4.4.c.:.d.6.e.2.2.1.1.0.6.4.7.b.4.0.2.1.9.9.4.d.e.2.2.4.8.b.8.5.4.7.a.0...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.3.2.9.T.1.5.3.3.1.2.0.0.9.0.-.1.1.0.0...e.t.l.........P.P.t...L....d.............................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\~DFFA4C3933A1E54023.TMP

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):163840
                                                                                                                                                  Entropy (8bit):0.32866108840431163
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:73nfXpgJKMtFaN7TcGeO2Xx8yNgz0XHWQOAIAbAFAqwNh/:Fg0XMO2KFz0XHOAIMu
                                                                                                                                                  MD5:E21F3B2E281ACB37385121622C5AE722
                                                                                                                                                  SHA1:D0AA90D3C2DC2C1D90FDC212070CA37D7B6DF447
                                                                                                                                                  SHA-256:ED18E565C72C7C8B045BA89C78B2E6BBBE8D084B237838E50B6966A9E2E7D062
                                                                                                                                                  SHA-512:E3EC246E256F550BA2D918A2D4FF7BF45CE9D29A4290B831B8B7DBC9FA17860C22FA5B5463F7B309D9810F1360A475E24EF3C9E8406056CC0DB2E5F80801A7DE
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):30
                                                                                                                                                  Entropy (8bit):1.2389205950315936
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:+HhlX:+T
                                                                                                                                                  MD5:730A48729A16F4DAEE8F2F96CA3D6DB7
                                                                                                                                                  SHA1:B3FB9F9B25206B4C5220FFC4767B5DD38739B16E
                                                                                                                                                  SHA-256:FFFBFED56F434EC6B5949F763D625CC2B2D528C566254156A36A7C7100D3765E
                                                                                                                                                  SHA-512:4C6FE477BEB34307DFA6A0BD5AA0811666365BB057D316487C9CC50972D8C6AE13298E751E1D5E10788823F9FB202B26977EC64798A80650302B71CF672661CC
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:....I.........................

                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):16384
                                                                                                                                                  Entropy (8bit):0.6697616067043693
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:12:rl3baFEsqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheCcpT:rrmnq1Py961ct
                                                                                                                                                  MD5:834B6679EC6423E2BF024ADD9D0A720A
                                                                                                                                                  SHA1:5EEF93499879E9C0BA73A4C8B677CB29F2CAD171
                                                                                                                                                  SHA-256:887BD68AE838F20B1AAB0794BA75E661863CCB67C34546B24F8FA1446D02283A
                                                                                                                                                  SHA-512:4C7A7367E4BC9FA89CCACA03489B11C727656AC303B4647ED3F85E750A11386A7E6FBD929E601C12ED85A5A6D52896BAED90E39C111FEE45DF0E8A8823F8E55F
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:Microsoft Outlook email folder (>=2003)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):271360
                                                                                                                                                  Entropy (8bit):1.3471922197351287
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:768:oQcAQ+vRuzcNumeAUTbO4HHx8lGeBTGt/S0z8IiKZgTIt+L:RXEzcN8bHx8l390z8LsBt
                                                                                                                                                  MD5:3BD94D0EF7038F3EE92B5B191447AE78
                                                                                                                                                  SHA1:59ECD818670097CA2B4963048A9889EFB1CBD8A6
                                                                                                                                                  SHA-256:F3AD29FC8D0208DFD2614D3F9FEF58AB6FFC052EB9DE179C8B56FE8C28612956
                                                                                                                                                  SHA-512:0EC63FBE757EB4FEB8E557CCD4DB75B2D8736F00C1E48005DB119D49E67AA3F9D5380A3D3C6B58F0EAB401BA9074BF7125B0DBB7B838261B97B82661EA6D59CD
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:!BDN !..SM......\.......................Y................@...........@...@...................................@...........................................................................$.......D.......C.......................................................................................................................................................................................................................................................................................................................... ......../iMIp......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):131072
                                                                                                                                                  Entropy (8bit):1.571401553245557
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:384:expS3hEUDtbTpMGN1F1pZ6Tjl7uod5nLrPTnxifSblAK8FjTItCwKNLGZSguwCnl:u+aGP25d9diKZgTIt+LWNuwCwzy4kZ
                                                                                                                                                  MD5:7EB5F81A330F395F19DC9D469D1085E5
                                                                                                                                                  SHA1:F53CCD349B83B480833633BA690C82767DE2963B
                                                                                                                                                  SHA-256:9C404ECD61F529365A1C16E2C38C254446B583716DDD3D5391CC8DE04C576548
                                                                                                                                                  SHA-512:FE29A0A0E9AFC00F1DE337CB63576944C7BA6426A05E12CE73C76A9E86F8B9BF8EA0B329B5700AF31D17EF1EDBC3BD563BB9FD9A40657B382C5E42D971A79EBC
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:8y..C...6.......L...sv.......................#.!BDN !..SM......\.......................Y................@...........@...@...................................@...........................................................................$.......D.......C.......................................................................................................................................................................................................................................................................................................................... ......../iMIp..sv..........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  Static File Info

                                                                                                                                                  General

                                                                                                                                                  File type:CDFV2 Microsoft Outlook Message
                                                                                                                                                  Entropy (8bit):3.3283208756097675
                                                                                                                                                  TrID:
                                                                                                                                                  • Outlook Message (71009/1) 58.92%
                                                                                                                                                  • Outlook Form Template (41509/1) 34.44%
                                                                                                                                                  • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                                                                                                                                  File name:I RECORDED YOU! (1.97 KB).msg
                                                                                                                                                  File size:8'704 bytes
                                                                                                                                                  MD5:256182511dab8545923eb5bf63cb0980
                                                                                                                                                  SHA1:6808b0efdd6e36bb137bb7ca6cf14931ae3821b4
                                                                                                                                                  SHA256:6617ec557d7431df4f2a9832d223bdcce2678380d88c1de77aa650bac1f058cb
                                                                                                                                                  SHA512:7c0fdf4a4d3c145d164b6b286b4a8dc6c6319566a3d09821109274f83a439b1a5ca7667297d0c4522e129edcee787b8aecd2d375e829b7f3aeaf1792220b1434
                                                                                                                                                  SSDEEP:96:ng8c7mQxvjlnMmnETj8sUUePRiAU1Iv1ky9XmCgGmuZdh:gNmQ91Mmoj8KePRZx1h9XKxuZd
                                                                                                                                                  TLSH:0B02762438DA510EF1BBDF702DD894E7CA5ABDA3BE05912B2081334F1B71A44ED9163C
                                                                                                                                                  File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                                                                                  Static Mail

                                                                                                                                                  General

                                                                                                                                                  Subject:
                                                                                                                                                  From:
                                                                                                                                                  To:
                                                                                                                                                  Cc:
                                                                                                                                                  BCC:
                                                                                                                                                  Date:
                                                                                                                                                  Communications:
                                                                                                                                                    Attachments:

                                                                                                                                                      Headers

                                                                                                                                                      Key Value
                                                                                                                                                      datePCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMDEgVHJhbnNpdGlvbmFs

                                                                                                                                                      File Icon

                                                                                                                                                      Icon Hash:c4e1928eacb280a2

                                                                                                                                                      Network Behavior

                                                                                                                                                      ⊘No network behavior found

                                                                                                                                                      Statistics

                                                                                                                                                      CPU Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      Memory Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                      Behavior

                                                                                                                                                      Click to jump to process

                                                                                                                                                      System Behavior

                                                                                                                                                      General

                                                                                                                                                      Target ID:0
                                                                                                                                                      Start time:15:33:11
                                                                                                                                                      Start date:29/03/2024
                                                                                                                                                      Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\I RECORDED YOU! (1.97 KB).msg"
                                                                                                                                                      Imagebase:0x750000
                                                                                                                                                      File size:34'446'744 bytes
                                                                                                                                                      MD5 hash:91A5292942864110ED734005B7E005C0
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:2
                                                                                                                                                      Start time:15:33:13
                                                                                                                                                      Start date:29/03/2024
                                                                                                                                                      Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "70FDBBC0-0AB7-40AD-88BC-07CDFF1497AF" "E608BE7A-C199-4627-A222-2F3B67DC1148" "1100" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                                                                                                                                                      Imagebase:0x7ff70f300000
                                                                                                                                                      File size:710'048 bytes
                                                                                                                                                      MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:false

                                                                                                                                                      Disassembly

                                                                                                                                                      ⊘No disassembly