Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Latest Mini PC for you.msg

Overview

General Information

Sample name:Latest Mini PC for you.msg
Analysis ID:1428516
MD5:48c158b2bc4c351cd6972a602e75da28
SHA1:beb1b41dae2ea8f02f1c130f2e6f2638314dd393
SHA256:fdad9b4daf6f76ced8be23656f546112ed17c69dca59a13fba99daf5b5a35114
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification

Classification

Process Tree

  • System is w10x64
  • OUTLOOK.EXE (PID: 8028 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Latest Mini PC for you.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 8156 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AB5B3ECB-BB1F-4695-B57F-9945AD581AA1" "715E7412-B00F-45E7-9BC6-6F22A2BDE2F9" "8028" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 8028, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: Latest Mini PC for you.msgString found in binary or memory: http://schema.org
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.aadrm.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.aadrm.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.cortana.ai
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.microsoftstream.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.office.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.onedrive.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://api.scheduler.
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://augloop.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://augloop.office.com/v2
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://cdn.entity.
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://clients.config.office.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://clients.config.office.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://config.edge.skype.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://cortana.ai
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://cortana.ai/api
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://cr.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://d.docs.live.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://dev.cortana.ai
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://devnull.onenote.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://directory.services.
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ecs.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://edge.skype.com/rps
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://graph.windows.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://graph.windows.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ic3.teams.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://invites.office.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://lifecycle.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://login.microsoftonline.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://login.windows.local
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://make.powerautomate.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://management.azure.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://management.azure.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messaging.action.office.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://messaging.office.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ncus.contentsync.
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://officeapps.live.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://officepyservice.office.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://onedrive.live.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://outlook.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://outlook.office.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://outlook.office365.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://outlook.office365.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://outlook.office365.com/connectors
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://powerlift.acompli.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://pushchannel.1drv.ms
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://res.cdn.office.net
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.39
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://settings.outlook.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://staging.cortana.ai
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://substrate.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://tasks.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://templatesmetadata.office.net/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://webshell.suite.office.com
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://wus2.contentsync.
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean1.winMSG@3/16@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240419T0451540902-8028.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Latest Mini PC for you.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AB5B3ECB-BB1F-4695-B57F-9945AD581AA1" "715E7412-B00F-45E7-9BC6-6F22A2BDE2F9" "8028" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AB5B3ECB-BB1F-4695-B57F-9945AD581AA1" "715E7412-B00F-45E7-9BC6-6F22A2BDE2F9" "8028" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: 40398340271.ttf.0.drBinary or memory string: ; )5=AIMQemuK@9BK
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory1
Process Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account Manager12
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1428516 Sample: Latest Mini PC for you.msg Startdate: 19/04/2024 Architecture: WINDOWS Score: 1 5 OUTLOOK.EXE 50 120 2->5         started        process3 7 ai.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://otelrules.svc.static.microsoft0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://my.microsoftpersonalcontent.com0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://d.docs.live.net0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
    		high
    https://login.microsoftonline.com/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
      		high
      https://shell.suite.office.com:1443A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
        		high
        https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
          		high
          https://autodiscover-s.outlook.com/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
            		high
            https://useraudit.o365auditrealtimeingestion.manage.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
              		high
              https://outlook.office365.com/connectorsA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                		high
                https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                  		high
                  https://cdn.entity.A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.addins.omex.office.net/appinfo/queryA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                    		high
                    https://clients.config.office.net/user/v1.0/tenantassociationkeyA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                      		high
                      https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                        		high
                        https://powerlift.acompli.netA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://rpsticket.partnerservices.getmicrosoftkey.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://lookup.onenote.com/lookup/geolocation/v1A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                          		high
                          https://cortana.aiA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                            		high
                            https://api.powerbi.com/v1.0/myorg/importsA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                              		high
                              https://cloudfiles.onenote.com/upload.aspxA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                		high
                                https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                  		high
                                  https://entitlement.diagnosticssdf.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                    		high
                                    https://api.aadrm.com/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://ofcrecsvcapi-int.azurewebsites.net/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://ic3.teams.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                      		high
                                      https://www.yammer.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                        		high
                                        https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                          		high
                                          https://api.microsoftstream.com/api/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                            		high
                                            https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                              		high
                                              https://cr.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                		high
                                                https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;hA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                  		low
                                                  https://messagebroker.mobile.m365.svc.cloud.microsoftA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://otelrules.svc.static.microsoftA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://portal.office.com/account/?ref=ClientMeControlA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                    		high
                                                    https://clients.config.office.net/c2r/v1.0/DeltaAdvisoryA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                      		high
                                                      https://edge.skype.com/registrar/prodA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                        		high
                                                        https://graph.ppe.windows.netA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                          		high
                                                          https://res.getmicrosoftkey.com/api/redemptioneventsA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://powerlift-frontdesk.acompli.netA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://tasks.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                            		high
                                                            https://officeci.azurewebsites.net/api/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://sr.outlook.office.net/ws/speech/recognize/assistant/workA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                              		high
                                                              https://api.scheduler.A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://my.microsoftpersonalcontent.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://store.office.cn/addinstemplateA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://api.aadrm.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://edge.skype.com/rpsA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                		high
                                                                https://outlook.office.com/autosuggest/api/v1/init?cvid=A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                  		high
                                                                  https://globaldisco.crm.dynamics.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                    		high
                                                                    https://messaging.engagement.office.com/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                      		high
                                                                      https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                        		high
                                                                        https://dev0-api.acompli.net/autodetectA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://www.odwebp.svc.msA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://api.diagnosticssdf.office.com/v2/feedbackA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                          		high
                                                                          https://api.powerbi.com/v1.0/myorg/groupsA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                            		high
                                                                            https://web.microsoftstream.com/video/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                              		high
                                                                              https://api.addins.store.officeppe.com/addinstemplateA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://graph.windows.netA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                		high
                                                                                https://dataservice.o365filtering.com/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://officesetup.getmicrosoftkey.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://analysis.windows.net/powerbi/apiA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                  		high
                                                                                  https://prod-global-autodetect.acompli.net/autodetectA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                  • URL Reputation: safe
                                                                                  		unknown
                                                                                  https://substrate.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                    		high
                                                                                    https://outlook.office365.com/autodiscover/autodiscover.jsonA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                      		high
                                                                                      https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                        		high
                                                                                        https://consent.config.office.com/consentcheckin/v1.0/consentsA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                          		high
                                                                                          https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                            		high
                                                                                            https://learningtools.onenote.com/learningtoolsapi/v2.0/GetvoicesA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                              		high
                                                                                              https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                		high
                                                                                                https://d.docs.live.netA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalseunknown
                                                                                                https://safelinks.protection.outlook.com/api/GetPolicyA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                  		high
                                                                                                  https://ncus.contentsync.A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                  • URL Reputation: safe
                                                                                                  		unknown
                                                                                                  https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                    		high
                                                                                                    https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                      		high
                                                                                                      http://weather.service.msn.com/data.aspxA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                        		high
                                                                                                        https://apis.live.net/v5.0/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                        • URL Reputation: safe
                                                                                                        		unknown
                                                                                                        https://officepyservice.office.net/service.functionalityA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                          		high
                                                                                                          https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                            		high
                                                                                                            https://templatesmetadata.office.net/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                              		high
                                                                                                              https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                		high
                                                                                                                https://messaging.lifecycle.office.com/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                  		high
                                                                                                                  https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                    		high
                                                                                                                    https://pushchannel.1drv.msA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                      		high
                                                                                                                      https://management.azure.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                        		high
                                                                                                                        https://outlook.office365.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                          		high
                                                                                                                          https://wus2.contentsync.A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          		unknown
                                                                                                                          https://incidents.diagnostics.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                            		high
                                                                                                                            https://clients.config.office.net/user/v1.0/iosA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                              		high
                                                                                                                              https://make.powerautomate.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              https://api.addins.omex.office.net/api/addins/searchA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                		high
                                                                                                                                https://insertmedia.bing.office.net/odc/insertmediaA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                  		high
                                                                                                                                  https://outlook.office365.com/api/v1.0/me/ActivitiesA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                    		high
                                                                                                                                    https://api.office.netA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                      		high
                                                                                                                                      https://incidents.diagnosticssdf.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                        		high
                                                                                                                                        https://asgsmsproxyapi.azurewebsites.net/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        		unknown
                                                                                                                                        https://clients.config.office.net/user/v1.0/android/policiesA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                          		high
                                                                                                                                          https://entitlement.diagnostics.office.comA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                            		high
                                                                                                                                            https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                              		high
                                                                                                                                              https://substrate.office.com/search/api/v2/initA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                                		high
                                                                                                                                                https://outlook.office.com/A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                                  		high
                                                                                                                                                  https://storage.live.com/clientlogs/uploadlocationA5FA57A6-F7AB-4B4D-A12A-DB38764A10C2.0.drfalse
                                                                                                                                                    		high

                                                                                                                                                    World Map of Contacted IPs

                                                                                                                                                    ⊘No contacted IP infos

                                                                                                                                                    General Information

                                                                                                                                                    Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                    Analysis ID:1428516
                                                                                                                                                    Start date and time:2024-04-19 04:50:54 +02:00
                                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                                    Overall analysis duration:0h 4m 51s
                                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                                    Report type:full
                                                                                                                                                    Cookbook file name:default.jbs
                                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                    Number of analysed new started processes analysed:6
                                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                                    Technologies:
                                                                                                                                                    • HCA enabled
                                                                                                                                                    • EGA enabled
                                                                                                                                                    • AMSI enabled
                                                                                                                                                    Analysis Mode:default
                                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                                    Sample name:Latest Mini PC for you.msg
                                                                                                                                                    Detection:CLEAN
                                                                                                                                                    Classification:clean1.winMSG@3/16@0/0
                                                                                                                                                    EGA Information:Failed
                                                                                                                                                    HCA Information:
                                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                                    • Number of executed functions: 0
                                                                                                                                                    • Number of non-executed functions: 0
                                                                                                                                                    Cookbook Comments:
                                                                                                                                                    • Found application associated with file extension: .msg

                                                                                                                                                    Warnings

                                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                                                    • Excluded IPs from analysis (whitelisted): 52.109.6.53, 52.113.194.132, 23.33.136.127, 20.42.73.25, 40.79.167.8
                                                                                                                                                    • Excluded domains from analysis (whitelisted): ecs.office.com, fs.microsoft.com, slscr.update.microsoft.com, prod.configsvc1.live.com.akadns.net, onedscolprdaue02.australiaeast.cloudapp.azure.com, s-0005-office.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, e16604.g.akamaiedge.net, onedscolprdeus06.eastus.cloudapp.azure.com, eus2-azsc-config.officeapps.live.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, prod.fs.microsoft.com.akadns.net, mobile.events.data.trafficmanager.net
                                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                                                                    Simulations

                                                                                                                                                    Behavior and APIs

                                                                                                                                                    ⊘No simulations

                                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                                    IPs

                                                                                                                                                    ⊘No context

                                                                                                                                                    Domains

                                                                                                                                                    ⊘No context

                                                                                                                                                    ASNs

                                                                                                                                                    ⊘No context

                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                    ⊘No context

                                                                                                                                                    Dropped Files

                                                                                                                                                    ⊘No context

                                                                                                                                                    Created / dropped Files

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):231348
                                                                                                                                                    Entropy (8bit):4.390586913794703
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:1536:KUwYLw8vgsLeOypEM9/NTiD8H/gs2G5NcAz79ysQqt2P9YFFw8qoQY2arcm0FvzY:Jbg/1Jg+miGu2CqoQgrt0Fv4zy30Do4
                                                                                                                                                    MD5:F1A47071FE2479AE7F58163050A0B0AC
                                                                                                                                                    SHA1:FA675FECB877420C12A59F5B0688877476D18748
                                                                                                                                                    SHA-256:0383776B570CEFC266A59BE68FA3B4A312BB9735A6D0246E3D798B148372B8BB
                                                                                                                                                    SHA-512:C3215BD176E0F407FB054A81B1B6A70F1861F1347D69AFFEE0018F49B8F6DDFA577B9409315D0441F999D395B8AC20CDC30054F9CB5EE48FA6B590B4C0AFFC8D
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview:TH02...... .p...........SM01X...,...................IPM.Activity...........h...............h............H..h..o.......w4...h............H..h\jon ...ppDa...h@...0.....o....h..`^...........h........_`.j...h].`^@...I..v...h....H...8..j...0....T...............d.........2h...............k..D...........!h.............. hO.Xy.... .o...#h....8.........$h........8....."h`.......@.....'h..............1h..`^<.........0h....4.....j../h....h......jH..h...p.....o...-h .......L.o...+h..`^......o................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with very long lines (2006), with no line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):2006
                                                                                                                                                    Entropy (8bit):5.097663728754286
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:48:cGEhJFnzyr3InzysWkSyrpednzyrXHnzyMySyKUdSyqIASyPodyDhdyBkJdyVYdz:0F27I2sVbded2rH2MybKUdbqIAbPoEDh
                                                                                                                                                    MD5:12134065C6B82BE83DF58680EA16D0B9
                                                                                                                                                    SHA1:77C3B0F78E2727F8B8B9CD6DEAFD4F9A9CF173B4
                                                                                                                                                    SHA-256:AA9475227979757A76CDC17C0843C71D98D93B4A67648CABF07D1A57280EEC64
                                                                                                                                                    SHA-512:EFB043F5DC6FE234095CE230FF7B545A5BA8BFA050DD2C6002311146307829225E83E18AE59D3E5C3C78700979921DC584C85DA186D7517BD57AD27A56DE2FFC
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>13</Count><Resource><Id>Aptos Display_45876482</Id><LAT>2023-10-04T10:58:38Z</LAT><key>29442803203.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-04T10:58:38Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215426</Id><LAT>2023-10-04T10:58:38Z</LAT><key>37262344671.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-04T10:58:38Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-04T10:58:38Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-04T10:58:38Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:JSON data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):520156
                                                                                                                                                    Entropy (8bit):4.907666742859367
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3072:9omubOSb3F2Fq9VMjNYof+pmpnGDubTxZO7aYb6f5780K2:+bOq3OjNymtGyT
                                                                                                                                                    MD5:036628E3E3F0728DAA7D53AC1B3EF8CC
                                                                                                                                                    SHA1:65327D9039335E1BAF9E14639AE355195766C9EC
                                                                                                                                                    SHA-256:2CAEC4D00BD356241B8B405B1B74386C677D501A7A23CE6EF916EAF912541544
                                                                                                                                                    SHA-512:C6524E4C732E1827B4FA8DA07DFF92F3024E15822578C6945B8A076498A85FF0D0C933E01F2AF98BA90A3E6A24DAB1601C07BE9D8D7193F4FB48A8E63FA75821
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview:{"MajorVersion":4,"MinorVersion":39,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Gulim\40398340271.ttf

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:TrueType Font data, 20 tables, 1st "EBDT", name offset 0x5fbd78
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):13374712
                                                                                                                                                    Entropy (8bit):6.026436576335274
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:98304:q01rMzxtAzpnESUVLqpVPoZ3khni6J3HclG1Tni8p:5wzxtAZUYPoZ3kPclG1TX
                                                                                                                                                    MD5:424C81AF232C2C1D852FFA64C4552463
                                                                                                                                                    SHA1:9806E6A6463159F32BC5FE7A1A6AD6C04E482BCA
                                                                                                                                                    SHA-256:BEA71C7E17AC18C4316152D38603D56D3A5A46C210D889664841E558A4ED83D0
                                                                                                                                                    SHA-512:A6667339FD2FF560EB3FD6A6BE63F355F6A1680A3ACB9B57F34E13D18F3523E6EBC40E9B3AABAD29B566D8F509306CCA78223A2505DF3B45457ECCCBC1E83C7B
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview:...........@EBDT....._.H.`1@EBLC...$.......XGSUB...%.......OS/2...........Vcmap.Vf...v(...lcvt mbv.../d...$fpgm......+.....gasp."..._.8....glyf........Z..head.3.....L...6hhea..........$hmtx.@..... ..t.loca"..B..0...t.maxp.q......... meta...r..d...fnamev..._.x....post...C._..... prep............vhea.b.6......$vmtx.g.h.....t........=...C_.<..........dI...........f...t.................o.o.........i.........................r.2.h.......0.<.....................................3..................i.|....0....HY .@.....o.o...o..@.................................... ...b...f...@...!... ...C...E...=...<.......?.......Z...O...N.......I...I.......!...........;...:.......................................6.......!... ...C...E...=...<.......>.......'...O...N.......B...A...q...u...........@...?...@...?...4.....................U...U.w...f...3.d.7...H...A.".}...k...F...B...9.V.k...B.V.u...-.L.?.L...L.=.L.=.L.'.L.9.L.>.L.G.L.5.L.>.V.u.V.k...8...;...6.+.G...=.......`...?...`...`.b.`...?...`...l....

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_39.ttf

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_39RegularVersion 4.39;O365
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):767532
                                                                                                                                                    Entropy (8bit):6.559103097590493
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:12288:zn84XUdLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/yLQ/zlm1kjFKy6Nyjbqq+:j8XNDs5+ivOXgm1kYvyz2
                                                                                                                                                    MD5:1BE236301B686323302632C0EACCFD6F
                                                                                                                                                    SHA1:7EF18B642DBFA9FB6E8AFABACB50F6CA6BD73BB4
                                                                                                                                                    SHA-256:90200D640623BFB0518B18D72C3F9828BC6EDA63EAB2DA90FBC27A08AAD165D7
                                                                                                                                                    SHA-512:BA6763BDB0C19103E417D808939739EF61FC15C7C4E7A8D10BB0120DC461D028054FF20A54BCB9A98FA9702B412D14CDC0270F2147F6C3FF5CB22A711934F276
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                    Preview:........... OS/29....(...`cmap.s.(.......pglyf..&?...\....head2'.........6hheaE.@r.......$hmtxr..........0loca.+.....(...4maxp........... name.X+.........post...<....... .........Z.9_.<...........<........$....Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N......*...!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................l......$A...,.......g...&...=.......X..&........*......&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q...............*...{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...*p..

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A5FA57A6-F7AB-4B4D-A12A-DB38764A10C2

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):166203
                                                                                                                                                    Entropy (8bit):5.340914945815574
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:1536:w+C7FPgOsB3U9guwwJQ9DQA+zqzhQik4F77nXmvYd8XRTEwreOR6g:lIQ9DQA+zqzMXeMJ
                                                                                                                                                    MD5:AE601831C82FADCFAF08649F34F0A26F
                                                                                                                                                    SHA1:2901265ED203057100883F14C973EF74970009FC
                                                                                                                                                    SHA-256:82EABE425E420870D692346482B14467614701872C9A8FD44F1CD85BE68946B3
                                                                                                                                                    SHA-512:280A5CD47464158A53B6149A457BBD004C9F6C7304F7BD64AFE3DF8CA29E73B3C0ADB82D386A5FE7C71437AF40763AD416D7DCCAA4ABEA7C65CDDDDC4E06346B
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-04-19T02:51:56">.. Build: 16.0.17609.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):32768
                                                                                                                                                    Entropy (8bit):0.04591939678467531
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:6:GtjCvKnRx4jCvKnRpXt9X01PH4l942wU:HvKnR7vKnRp0G3L
                                                                                                                                                    MD5:A2F135C09E572353AF52E76E0FAD9AED
                                                                                                                                                    SHA1:049BD61442A4AF52782376858F6CF411BF7A95E5
                                                                                                                                                    SHA-256:9BD2928FEF23381169F5941320D49096D70265516B179ACF05FAA0CD3F5E4384
                                                                                                                                                    SHA-512:9F409B2E39E73E663419B9A547E78FF7A359A892268B5E586AAF9DFBA2D224165B2D82EFF1B2AFB870BCF50FCD363FF151B57E1591F7E706D316E4F3F1FCAFFA
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview:..-.........................gmQ.)a.#..aLu}4.......-.........................gmQ.)a.#..aLu}4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                    Category:modified
                                                                                                                                                    Size (bytes):49472
                                                                                                                                                    Entropy (8bit):0.4824487397689746
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:48:F30Y1qQ18huq22ZUll7DYM8MAmzO8VFDYM8Gtv+BO8VFDYML:Fk2dW8q22Wll43MAGjVG3Gtv0jVGC
                                                                                                                                                    MD5:3CE6AFD8319A1344B989F3FCEE8629E3
                                                                                                                                                    SHA1:7C0A00BA675611EB0B29B86286CA8722EBF1872B
                                                                                                                                                    SHA-256:4D750AC54D3720A0511A565F1C96964023674B181AAED0EEB57A99E6AABF9A56
                                                                                                                                                    SHA-512:8A4E06FFA955E62F81745F52C37EE983F553B2A34A26DB6BB1A72D67C9DC4342AE7C7DD75D0AA05C16303ED77F294AC48AF86C43CD4D2804CBBF5172A5B285A9
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview:7....-..........)a.#..aL.zd<............)a.#..aL..[*>.<.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D6F37FFE-BCFC-4ACD-9797-5CC3213599FF}.tmp

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):2948
                                                                                                                                                    Entropy (8bit):2.9136311362353475
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:48:qrAcLO5iiaCwpQf+hEZMi8nLO2N8m2gigRE:qrAc6YiaCuQfZM5
                                                                                                                                                    MD5:BACD75A2006F187A9E1277AE477D4A3A
                                                                                                                                                    SHA1:837B77F16DF6F52060748DCA64DE670F2A3DFC62
                                                                                                                                                    SHA-256:9A255B92E1BD927BE502DDAD1C21448857182ED3BEE46B4D8D24B3121DB8F195
                                                                                                                                                    SHA-512:55AC653817110FA24972D7C6EFD6382FA92AAED0311EB2C0367221C82E3129EA50F3DDDF765B00087DC1E00F9DF4F108A5AA966050275AEC028C6BFB831CE30D
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview:....D.e.a.r. .f.r.i.e.n.d.,.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713495115148779100_FA261C1E-69C0-47E4-A203-5A456072F548.log

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:ASCII text, with very long lines (28766), with CRLF line terminators
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):20971520
                                                                                                                                                    Entropy (8bit):0.16446618061788595
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:1536:rT5cBAGnTq3KTHaoj71nfod+hPH7m9hqsWA8g06xVYDLbctQJDj9AX9Hn+VHraBZ:iAEoKT6v2j
                                                                                                                                                    MD5:C16A4A70D19F398D4767F5D7A997C8D6
                                                                                                                                                    SHA1:7FCBD25E6FC1C76330111F9046F920A241F3EB86
                                                                                                                                                    SHA-256:56845E5FA24BA4C8161723C660CEA039B74FC1A0167320D28C70AD227A20D0F8
                                                                                                                                                    SHA-512:D07957AE02AA2E5E027730B058A9375007DB126E7E6FF04ACD26C9F10A9837C99B2A1577509629F6F3A5A219F592C556216A05FDD535D25E2DD932BAD41CEFA5
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:low
                                                                                                                                                    Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..04/19/2024 02:51:55.199.OUTLOOK (0x1F5C).0x1F60.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-04-19T02:51:55.199Z","Contract":"Office.System.Activity","Activity.CV":"Hhwm+sBp5EeiA1pFYHL1SA.4.9","Activity.Duration":13,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...04/19/2024 02:51:55.215.OUTLOOK (0x1F5C).0x1F60.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-04-19T02:51:55.215Z","Contract":"Office.System.Activity","Activity.CV":"Hhwm+sBp5EeiA1pFYHL1SA.4.10","Activity.Duration":10632,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorV

                                                                                                                                                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713495115149707100_FA261C1E-69C0-47E4-A203-5A456072F548.log

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):20971520
                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3::
                                                                                                                                                    MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                                                                                                                                    SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                                                                                                                                    SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                                                                                                                                    SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                                                                                                                                    Malicious:false
                                                                                                                                                    Reputation:high, very likely benign file
                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240419T0451540902-8028.etl

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):94208
                                                                                                                                                    Entropy (8bit):4.446508455791683
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:768:dHmtEglaXnMLV2k84ifFY9udlRb0SX0YrojNseZaBFkYbEF9fE5CRM3DHUCyXVNA:8W4cW9udcSX0qOW
                                                                                                                                                    MD5:9F32C606BDA5EFC2811A6D93C74D393B
                                                                                                                                                    SHA1:A75ABA1DBA0349AEC35CD7F10F6FF988B7827C51
                                                                                                                                                    SHA-256:C7F3602B17005EA436C4D202CBD49C3507A3BED6F4E27087D60A77D0F1C801CD
                                                                                                                                                    SHA-512:15E2F484D40DFA0D2BD52DEBF9BFEBFE69465E68958C1E4B2A889C4A70E11A0A91EE0B03E53EAFDD3AA9565FD9561A6A1BA6D8F3627AEAF6C7FA270D0CF2C828
                                                                                                                                                    Malicious:false
                                                                                                                                                    Preview:............................................................................b...`...\...........................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1............................................................_..............................v.2._.O.U.T.L.O.O.K.:.1.f.5.c.:.f.0.e.0.7.e.2.4.4.4.0.1.4.1.c.9.9.9.a.a.a.e.1.9.9.a.8.1.a.6.8.b...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.4.1.9.T.0.4.5.1.5.4.0.9.0.2.-.8.0.2.8...e.t.l.............P.P.`...\...;!......................................................................................................................................................................................................................................................................................................

                                                                                                                                                    C:\Users\user\AppData\Local\Temp\~DFDF3BD7E81B60FF99.TMP

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):163840
                                                                                                                                                    Entropy (8bit):0.4185421472215047
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:192:kLR1m4cTb1/YlIc4h+4i85oRkMn4UUz1hwAkNgiXHWJOuqAbAW+Nh/:C3QVYlIAvuMn4UUQUiXHxuqM
                                                                                                                                                    MD5:C39C39D0C745959199165D032795E91B
                                                                                                                                                    SHA1:F54AE6C540BE967D7E2223D18DE277C747FE95BA
                                                                                                                                                    SHA-256:2FB134652DCE350F07935D69978E45FF3A37C713E41B642D19805E3466819A66
                                                                                                                                                    SHA-512:45C345AF3B84F1B870601B8207A637847C4942558F2FBFD98DE257A3913303CA0EF87A497DFCA1A2DB51C5E82A2C5AFFCA0DC2D8703C01F96B2FEB97E21B5CC3
                                                                                                                                                    Malicious:false
                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):30
                                                                                                                                                    Entropy (8bit):1.2389205950315936
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:3:JBZ:
                                                                                                                                                    MD5:68699E4114D966281B1197F9CB73006F
                                                                                                                                                    SHA1:21BC699773B0814A1BF7AC7890241DC3A42545D6
                                                                                                                                                    SHA-256:7AB0EA17286EA0942E45B37B562E4B8740954E31DC53F2BED1EE369DFDD09369
                                                                                                                                                    SHA-512:E76D2CE849C78B4F456A11564851A92F1325CAC0E4F676040618532927116F07BAFAEF76CEBC960E331C8BC1E64DC12C8B4B5E36143B7D4FD69F67DA21684D14
                                                                                                                                                    Malicious:false
                                                                                                                                                    Preview:..............................

                                                                                                                                                    C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:Microsoft Outlook email folder (>=2003)
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):271360
                                                                                                                                                    Entropy (8bit):1.3315594800846062
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:768:O1Qcio72S4w4/d/MG1Jvq8jiZkdOjGbHBfB8BUTIZ:flSgvT+ZKhfBeNZ
                                                                                                                                                    MD5:F7F240D5BD685DD04E454B1B8CB1CB07
                                                                                                                                                    SHA1:0D336D433B89BB69C4E82E9797BA1038041D00DB
                                                                                                                                                    SHA-256:180F2AD99C9029D40032864746DC83C75BE0CBFE5B538181CDCD20B751E933D4
                                                                                                                                                    SHA-512:35CFD764AC286E08EE62CC57C8351C9414D1B4ED58509B29397364BBFC457F31E92009A98D7F9AA259CC8073E209CCE5EB16DF37648E5FC0C6A7450DC2A090B6
                                                                                                                                                    Malicious:false
                                                                                                                                                    Preview:!BDNT...SM......\...9...........J.......U................@...........@...@...................................@...........................................................................$.......D......@N..............9...............I......................................................................................................................................................................................................................................................................................................O.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                    C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                                                                                                                                    Download File
                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    File Type:data
                                                                                                                                                    Category:dropped
                                                                                                                                                    Size (bytes):131072
                                                                                                                                                    Entropy (8bit):1.0616407407305466
                                                                                                                                                    Encrypted:false
                                                                                                                                                    SSDEEP:384:93cjTIXJvmCgEGNfFA15WBZG0yO4rpWPZg47V1RAy:aTIZuGGBGBfYCe
                                                                                                                                                    MD5:5C8B553BFE1A7D63CA92B4BE9D9EF742
                                                                                                                                                    SHA1:B0600AE7419492E4F75AAB2210E30A84311680BC
                                                                                                                                                    SHA-256:37D42943F4AB6766FC335B44B4EA4CE7280C8A8BFB9480510BA3067A477B83CC
                                                                                                                                                    SHA-512:E1C66769C13D828E627E5E84E5784BAC781C8382C422EAB8ADCE302D63D449023BB2F9F7BB64D2D3FCAE81E358C2713FB7FB3022AAEE7FA26BE23C3C2625A49A
                                                                                                                                                    Malicious:false
                                                                                                                                                    Preview:..V.0...Y.......\...o...........D............#...........?...............................................................?...........................................................................................................................................................................................................................................................................................................................................................................................................................................r.D......@...0...Z.......\...o...........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                    Static File Info

                                                                                                                                                    General

                                                                                                                                                    File type:CDFV2 Microsoft Outlook Message
                                                                                                                                                    Entropy (8bit):3.8126845049566236
                                                                                                                                                    TrID:
                                                                                                                                                    • Outlook Message (71009/1) 58.92%
                                                                                                                                                    • Outlook Form Template (41509/1) 34.44%
                                                                                                                                                    • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                                                                                                                                    File name:Latest Mini PC for you.msg
                                                                                                                                                    File size:94'720 bytes
                                                                                                                                                    MD5:48c158b2bc4c351cd6972a602e75da28
                                                                                                                                                    SHA1:beb1b41dae2ea8f02f1c130f2e6f2638314dd393
                                                                                                                                                    SHA256:fdad9b4daf6f76ced8be23656f546112ed17c69dca59a13fba99daf5b5a35114
                                                                                                                                                    SHA512:9f65325411048642b5783eb31d32452b333c8db86bc3af44cf6d1b1a58294ece2c9d602f281afcd68981aea80fed3e05df13d47052b41ffc8d0b4d77696ec9cf
                                                                                                                                                    SSDEEP:1536:0pwix1j8LUuirIyVWQW7WWWrhybMzWN6RKlbXb:Iwix1s9WrhPS
                                                                                                                                                    TLSH:B79300253AFA0109F3B79F354BE690AB8536FC92AD35975F2191330E0A72941DC61B3B
                                                                                                                                                    File Content Preview:........................>.......................................................r..............................................................................................................................................................................

                                                                                                                                                    Static Mail

                                                                                                                                                    General

                                                                                                                                                    Subject:Latest Mini PC for you
                                                                                                                                                    From:Hannah Luo <sales21@hystouminipc.com>
                                                                                                                                                    To:<hanoung.lee@hyundaigb.com>
                                                                                                                                                    Cc:
                                                                                                                                                    BCC:
                                                                                                                                                    Date:Tue, 09 Apr 2024 15:37:02 +0200
                                                                                                                                                    Communications:
                                                                                                                                                    • Dear friend, This is Hannah from HYSTOU mini pc factory located in China. We Hystou has been producing and supplying Mini PC since 2014, we have passed ISO9001, and all our products has CE&ROHS certificate. Please allow me to introduce a product first: CPU: Intel Core i5-1340P/ i7-1360P RAM: 2*DDR5 max up to 64GB Storage: 2 x M.2 2280 SSD, 1* SATA 3.0 Slot for 2.5 inch HDD/SSD Graphics: Intel Iris Xe Graphics eligible Display port: 1*HD-MI <mailto:4096*2304@30H2(4K> @30HZ(4K) + 1*DP <mailto:4096*2304@60H2(4K> @30HZ(8K)/60HZ(4K) + 1*Type-C <mailto:4096*2304@60H2(4K> @60HZ(4K) 3 Display Output USB: 6*USB 3.2 port, 2*USB 2.0 port, 1*Type-c LAN: 2*2.5 GbE RJ45 intel I225-V Mini PC dimension: 68*38*52mm ? This is our new model, would you like to get more details and pictures of this PC? ? Your faithfully, Hannah Luo Sales II Hystou Technology Co., Limited Tel/WhatsApp?: (+86) 133-16546537 E-mail: sales21@hystou.com Web: www.hystou.com Supply Mini PC?- AIO Desktop PC?- Industrial Computer
                                                                                                                                                    Attachments:

                                                                                                                                                      Headers

                                                                                                                                                      Key Value
                                                                                                                                                      Receivedfrom DESKTOP-MCN9CQ0 (58.60.35.14) by mk.yourjold.top id h2l28o0e97co for <hanoung.lee@hyundaigb.com>; Tue, 9 Apr 2024 13:37:16 +0000 (envelope-from <mk7@mk.yourjold.top>)
                                                                                                                                                      1337:19 +0000
                                                                                                                                                      by SE2P216MB2225.KORP216.PROD.OUTLOOK.COM (26031096:101:11a::8) with
                                                                                                                                                      2024 1337:17 +0000
                                                                                                                                                      (26031096:101:117::17) with Microsoft SMTP Server (version=TLS1_2,
                                                                                                                                                      Transport; Tue, 9 Apr 2024 1337:17 +0000
                                                                                                                                                      Authentication-Resultsspf=none (sender IP is 20.47.90.108)
                                                                                                                                                      Received-SPFnone (localhost: domain at mk.yourjold.top does not designate permitted sender hosts)
                                                                                                                                                      15.20.7452.22 via Frontend Transport; Tue, 9 Apr 2024 1337:17 +0000
                                                                                                                                                      15.2.1118.7; Tue, 9 Apr 2024 2237:17 +0900
                                                                                                                                                      15.2.1118.15; Tue, 9 Apr 2024 2237:17 +0900
                                                                                                                                                      15.2.1118.15 via Frontend Transport; Tue, 9 Apr 2024 2237:17 +0900
                                                                                                                                                      Authentication-Results-Originalspam1.hyundaigroup.com; spf=none (localhost:
                                                                                                                                                      by 10.111.243.115 with ESMTP; 9 Apr 2024 2220:19 +0900
                                                                                                                                                      X-Original-SPFnone (localhost: domain at mk.yourjold.top does not designate permitted sender hosts)
                                                                                                                                                      X-Original-SENDERIP24.233.3.5
                                                                                                                                                      X-Original-SENDERCOUNTRYUS, United States
                                                                                                                                                      X-Original-MAILFROMmk7@mk.yourjold.top
                                                                                                                                                      X-Original-RCPTTOhanoung.lee@hyundaigb.com
                                                                                                                                                      FromHannah Luo <sales21@hystouminipc.com>
                                                                                                                                                      SubjectLatest Mini PC for you
                                                                                                                                                      To<hanoung.lee@hyundaigb.com>
                                                                                                                                                      Content-Typemultipart/alternative;
                                                                                                                                                      MIME-Version1.0
                                                                                                                                                      Sender<mk7@mk.yourjold.top>
                                                                                                                                                      Reply-To<sales21@hystouminipc.com>
                                                                                                                                                      DateTue, 9 Apr 2024 21:37:02 +0800
                                                                                                                                                      Message-ID<207c71b7-2327-41aa-ab7d-b88f0e7f2125@SVR-KR-EMB-01.hyundaigroup.site>
                                                                                                                                                      Return-Pathmk7@mk.yourjold.top
                                                                                                                                                      X-OrganizationHeadersPreservedSVR-KR-EMB-01.hyundaigroup.site
                                                                                                                                                      X-MS-Exchange-Organization-ExpirationStartTime09 Apr 2024 13:37:17.9384
                                                                                                                                                      X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                                                                                                                                                      X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                                                                                                                                                      X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                                                                                                                                                      X-MS-Exchange-Organization-Network-Message-Idd24b993e-1e43-4b35-97ae-08dc589a2cc9
                                                                                                                                                      X-EOPAttributedMessage0
                                                                                                                                                      X-MS-Exchange-Organization-MessageDirectionalityOriginating
                                                                                                                                                      X-MS-Exchange-Organization-SCL-1
                                                                                                                                                      X-CrossPremisesHeadersPromotedSE1PEPF00009E0A.KORP216.PROD.OUTLOOK.COM
                                                                                                                                                      X-CrossPremisesHeadersFilteredSE1PEPF00009E0A.KORP216.PROD.OUTLOOK.COM
                                                                                                                                                      X-MS-PublicTrafficTypeEmail
                                                                                                                                                      X-MS-TrafficTypeDiagnosticSE1PEPF00009E0A:EE_|SE2P216MB2225:EE_|PUWP216MB2466:EE_
                                                                                                                                                      X-MS-Exchange-Organization-AuthSourceSVR-KR-EMB-01.hyundaigroup.site
                                                                                                                                                      X-MS-Exchange-Organization-AuthAsAnonymous
                                                                                                                                                      X-OriginatorOrghyundaigroup.com
                                                                                                                                                      X-MS-Office365-Filtering-Correlation-Idd24b993e-1e43-4b35-97ae-08dc589a2cc9
                                                                                                                                                      X-Microsoft-AntispamBCL:0;
                                                                                                                                                      X-Forefront-Antispam-ReportCIP:20.47.90.108;CTRY:KR;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:email.hyundaigroup.com;PTR:edge3.hyundaigroup.com;CAT:NONE;SFS:;DIR:INB;
                                                                                                                                                      X-MS-Exchange-CrossTenant-OriginalArrivalTime09 Apr 2024 13:37:17.9228
                                                                                                                                                      X-MS-Exchange-CrossTenant-Network-Message-Idd24b993e-1e43-4b35-97ae-08dc589a2cc9
                                                                                                                                                      X-MS-Exchange-CrossTenant-Idf8d5ac98-8fa9-4355-8cd9-84f322fb0a78
                                                                                                                                                      X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIpTenantId=f8d5ac98-8fa9-4355-8cd9-84f322fb0a78;Ip=[20.47.90.108];Helo=[email.hyundaigroup.com]
                                                                                                                                                      X-MS-Exchange-CrossTenant-AuthSourceSVR-KR-EMB-01.hyundaigroup.site
                                                                                                                                                      X-MS-Exchange-CrossTenant-AuthAsAnonymous
                                                                                                                                                      X-MS-Exchange-CrossTenant-FromEntityHeaderHybridOnPrem
                                                                                                                                                      X-MS-Exchange-Transport-CrossTenantHeadersStampedSE2P216MB2225
                                                                                                                                                      X-MS-Exchange-Transport-EndToEndLatency00:00:01.2307544
                                                                                                                                                      X-MS-Exchange-Processed-By-BccFoldering15.20.7409.047
                                                                                                                                                      X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                                                                                                                                                      X-Microsoft-Antispam-Message-Info=?us-ascii?Q?UPwoJmTlKXi7b/UHmNK0d6CifKyyNFir6M3ic4QW29Q2mzLGJYELGEwiqSdy?=
                                                                                                                                                      dateTue, 09 Apr 2024 15:37:02 +0200

                                                                                                                                                      File Icon

                                                                                                                                                      Icon Hash:c4e1928eacb280a2

                                                                                                                                                      Network Behavior

                                                                                                                                                      ⊘No network behavior found

                                                                                                                                                      Statistics

                                                                                                                                                      CPU Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      Memory Usage

                                                                                                                                                      Click to jump to process

                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                      Behavior

                                                                                                                                                      Click to jump to process

                                                                                                                                                      System Behavior

                                                                                                                                                      General

                                                                                                                                                      Target ID:0
                                                                                                                                                      Start time:04:51:54
                                                                                                                                                      Start date:19/04/2024
                                                                                                                                                      Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                      Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Latest Mini PC for you.msg"
                                                                                                                                                      Imagebase:0x870000
                                                                                                                                                      File size:34'446'744 bytes
                                                                                                                                                      MD5 hash:91A5292942864110ED734005B7E005C0
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:false

                                                                                                                                                      General

                                                                                                                                                      Target ID:1
                                                                                                                                                      Start time:04:51:56
                                                                                                                                                      Start date:19/04/2024
                                                                                                                                                      Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                      Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AB5B3ECB-BB1F-4695-B57F-9945AD581AA1" "715E7412-B00F-45E7-9BC6-6F22A2BDE2F9" "8028" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                                                                                                                                                      Imagebase:0x7ff7cb9b0000
                                                                                                                                                      File size:710'048 bytes
                                                                                                                                                      MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                      Reputation:moderate
                                                                                                                                                      Has exited:false

                                                                                                                                                      Disassembly

                                                                                                                                                      ⊘No disassembly