Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
HATFIELD SHAWNA L-Docking Letter.eml (3.43 KB).msg

Overview

General Information

Sample name:HATFIELD SHAWNA L-Docking Letter.eml (3.43 KB).msg
Analysis ID:1431120
MD5:e9321dda5f76f4b356f5eea3a780c2fb
SHA1:bde7070a336de8455a45e62db5dbe6f32c568935
SHA256:90a1e458dea52985436143637e01799f3a28b3d3363f8b9ab15bfbbfa8133d4f
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64
  • OUTLOOK.EXE (PID: 2936 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\HATFIELD SHAWNA L-Docking Letter.eml (3.43 KB).msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 4592 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ADA74FCB-84C0-4E48-BFCC-2AE070C9135C" "2243F897-73EF-4BBE-918D-79BD9FEBA809" "2936" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\AddinsData\ColleagueImport.ColleagueImportAddin\LoadCount

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.aadrm.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.aadrm.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.cortana.ai
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.diagnostics.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.microsoftstream.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.office.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.onedrive.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://api.scheduler.
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://augloop.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://augloop.office.com/v2
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://cdn.entity.
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://clients.config.office.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://clients.config.office.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://config.edge.skype.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://cortana.ai
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://cortana.ai/api
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://cr.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://d.docs.live.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://dev.cortana.ai
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://devnull.onenote.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://directory.services.
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ecs.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://edge.skype.com/rps
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://graph.ppe.windows.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://graph.windows.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://graph.windows.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ic3.teams.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://invites.office.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://lifecycle.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://login.microsoftonline.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://login.microsoftonline.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://login.windows.local
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://make.powerautomate.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://management.azure.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://management.azure.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messaging.action.office.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messaging.engagement.office.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://messaging.office.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ncus.contentsync.
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ncus.pagecontentsync.
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://officeapps.live.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://officepyservice.office.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://onedrive.live.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://otelrules.azureedge.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://outlook.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://outlook.office.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://outlook.office365.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://outlook.office365.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://outlook.office365.com/connectors
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://pages.store.office.com/review/query
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://powerlift.acompli.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://pushchannel.1drv.ms
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://res.cdn.office.net
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.39
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://settings.outlook.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://staging.cortana.ai
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://substrate.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://tasks.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://templatesmetadata.office.net/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://webshell.suite.office.com
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://wus2.contentsync.
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://wus2.pagecontentsync.
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://www.odwebp.svc.ms
Source: 17D692C7-3108-448B-B740-692875DECC5C.0.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean1.winMSG@3/11@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240424T1559530669-2936.etlJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\HATFIELD SHAWNA L-Docking Letter.eml (3.43 KB).msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ADA74FCB-84C0-4E48-BFCC-2AE070C9135C" "2243F897-73EF-4BBE-918D-79BD9FEBA809" "2936" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ADA74FCB-84C0-4E48-BFCC-2AE070C9135C" "2243F897-73EF-4BBE-918D-79BD9FEBA809" "2936" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Modify Registry		LSASS Memory12
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431120 Sample: HATFIELD SHAWNA L-Docking L... Startdate: 24/04/2024 Architecture: WINDOWS Score: 1 5 OUTLOOK.EXE 45 103 2->5         started        process3 7 ai.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://otelrules.svc.static.microsoft0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://my.microsoftpersonalcontent.com0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://ncus.contentsync.0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h0%Avira URL Cloudsafe
https://d.docs.live.net0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
    		high
    https://login.microsoftonline.com/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
      		high
      https://shell.suite.office.com:144317D692C7-3108-448B-B740-692875DECC5C.0.drfalse
        		high
        https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
          		high
          https://autodiscover-s.outlook.com/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
            		high
            https://useraudit.o365auditrealtimeingestion.manage.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
              		high
              https://outlook.office365.com/connectors17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                		high
                https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                  		high
                  https://cdn.entity.17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://api.addins.omex.office.net/appinfo/query17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                    		high
                    https://clients.config.office.net/user/v1.0/tenantassociationkey17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                      		high
                      https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                        		high
                        https://powerlift.acompli.net17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://rpsticket.partnerservices.getmicrosoftkey.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://lookup.onenote.com/lookup/geolocation/v117D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                          		high
                          https://cortana.ai17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                            		high
                            https://api.powerbi.com/v1.0/myorg/imports17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                              		high
                              https://cloudfiles.onenote.com/upload.aspx17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                		high
                                https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                  		high
                                  https://entitlement.diagnosticssdf.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                    		high
                                    https://api.aadrm.com/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://ofcrecsvcapi-int.azurewebsites.net/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://ic3.teams.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                      		high
                                      https://www.yammer.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                        		high
                                        https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                          		high
                                          https://api.microsoftstream.com/api/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                            		high
                                            https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                              		high
                                              https://cr.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                		high
                                                https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                • Avira URL Cloud: safe
                                                		low
                                                https://messagebroker.mobile.m365.svc.cloud.microsoft17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://otelrules.svc.static.microsoft17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://portal.office.com/account/?ref=ClientMeControl17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                  		high
                                                  https://clients.config.office.net/c2r/v1.0/DeltaAdvisory17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                    		high
                                                    https://edge.skype.com/registrar/prod17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                      		high
                                                      https://graph.ppe.windows.net17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                        		high
                                                        https://res.getmicrosoftkey.com/api/redemptionevents17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://powerlift-frontdesk.acompli.net17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://tasks.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                          		high
                                                          https://officeci.azurewebsites.net/api/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://sr.outlook.office.net/ws/speech/recognize/assistant/work17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                            		high
                                                            https://api.scheduler.17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://my.microsoftpersonalcontent.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://store.office.cn/addinstemplate17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://api.aadrm.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://edge.skype.com/rps17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                              		high
                                                              https://outlook.office.com/autosuggest/api/v1/init?cvid=17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                		high
                                                                https://globaldisco.crm.dynamics.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                  		high
                                                                  https://messaging.engagement.office.com/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                    		high
                                                                    https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                      		high
                                                                      https://dev0-api.acompli.net/autodetect17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://www.odwebp.svc.ms17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://api.diagnosticssdf.office.com/v2/feedback17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                        		high
                                                                        https://api.powerbi.com/v1.0/myorg/groups17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                          		high
                                                                          https://web.microsoftstream.com/video/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                            		high
                                                                            https://api.addins.store.officeppe.com/addinstemplate17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://graph.windows.net17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                              		high
                                                                              https://dataservice.o365filtering.com/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://officesetup.getmicrosoftkey.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://analysis.windows.net/powerbi/api17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                		high
                                                                                https://prod-global-autodetect.acompli.net/autodetect17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://substrate.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                  		high
                                                                                  https://outlook.office365.com/autodiscover/autodiscover.json17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                    		high
                                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                      		high
                                                                                      https://consent.config.office.com/consentcheckin/v1.0/consents17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                        		high
                                                                                        https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                          		high
                                                                                          https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                            		high
                                                                                            https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                              		high
                                                                                              https://d.docs.live.net17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://safelinks.protection.outlook.com/api/GetPolicy17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                		high
                                                                                                https://ncus.contentsync.17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                • URL Reputation: safe
                                                                                                		unknown
                                                                                                https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                  		high
                                                                                                  https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                    		high
                                                                                                    http://weather.service.msn.com/data.aspx17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                      		high
                                                                                                      https://apis.live.net/v5.0/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://officepyservice.office.net/service.functionality17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                        		high
                                                                                                        https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                          		high
                                                                                                          https://templatesmetadata.office.net/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                            		high
                                                                                                            https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                              		high
                                                                                                              https://messaging.lifecycle.office.com/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                		high
                                                                                                                https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                  		high
                                                                                                                  https://pushchannel.1drv.ms17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                    		high
                                                                                                                    https://management.azure.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                      		high
                                                                                                                      https://outlook.office365.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                        		high
                                                                                                                        https://wus2.contentsync.17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        		unknown
                                                                                                                        https://incidents.diagnostics.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                          		high
                                                                                                                          https://clients.config.office.net/user/v1.0/ios17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                            		high
                                                                                                                            https://make.powerautomate.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            		unknown
                                                                                                                            https://api.addins.omex.office.net/api/addins/search17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                              		high
                                                                                                                              https://insertmedia.bing.office.net/odc/insertmedia17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                		high
                                                                                                                                https://outlook.office365.com/api/v1.0/me/Activities17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                  		high
                                                                                                                                  https://api.office.net17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                    		high
                                                                                                                                    https://incidents.diagnosticssdf.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                      		high
                                                                                                                                      https://asgsmsproxyapi.azurewebsites.net/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      		unknown
                                                                                                                                      https://clients.config.office.net/user/v1.0/android/policies17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                        		high
                                                                                                                                        https://entitlement.diagnostics.office.com17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                          		high
                                                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                            		high
                                                                                                                                            https://substrate.office.com/search/api/v2/init17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                              		high
                                                                                                                                              https://outlook.office.com/17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                                		high
                                                                                                                                                https://storage.live.com/clientlogs/uploadlocation17D692C7-3108-448B-B740-692875DECC5C.0.drfalse
                                                                                                                                                  		high

                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                  ⊘No contacted IP infos

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                  Analysis ID:1431120
                                                                                                                                                  Start date and time:2024-04-24 15:59:00 +02:00
                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 4m 18s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:full
                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                  Number of analysed new started processes analysed:5
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                  Sample name:HATFIELD SHAWNA L-Docking Letter.eml (3.43 KB).msg
                                                                                                                                                  Detection:CLEAN
                                                                                                                                                  Classification:clean1.winMSG@3/11@0/0
                                                                                                                                                  EGA Information:Failed
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  • Number of executed functions: 0
                                                                                                                                                  • Number of non-executed functions: 0
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Found application associated with file extension: .msg

                                                                                                                                                  Warnings

                                                                                                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.109.8.89, 52.113.194.132, 20.42.72.131
                                                                                                                                                  • Excluded domains from analysis (whitelisted): ecs.office.com, slscr.update.microsoft.com, prod.configsvc1.live.com.akadns.net, cus-config.officeapps.live.com, s-0005-office.config.skype.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, onedscolprdeus00.eastus.cloudapp.azure.com, officeclient.microsoft.com, ecs.office.trafficmanager.net, mobile.events.data.trafficmanager.net
                                                                                                                                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                  • VT rate limit hit for: HATFIELD SHAWNA L-Docking Letter.eml (3.43 KB).msg

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  ⊘No simulations

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  ⊘No context

                                                                                                                                                  Domains

                                                                                                                                                  ⊘No context

                                                                                                                                                  ASNs

                                                                                                                                                  ⊘No context

                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                  ⊘No context

                                                                                                                                                  Dropped Files

                                                                                                                                                  ⊘No context

                                                                                                                                                  Created / dropped Files

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):231348
                                                                                                                                                  Entropy (8bit):4.388795631607554
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:bYYL3Vgs0/HGwpugGgsEiNcAz79ysQqt2ziWvqoQUgrcm0FvKKiy9HNkZTkBk0ju:/lg+CUgwmiGu2fqoQ7rt0FvR3wpJoqF
                                                                                                                                                  MD5:34C69ED52B1D1A5182709A54F576E876
                                                                                                                                                  SHA1:ECDCF5FA4E9276431E7943E47DE16B94543140C6
                                                                                                                                                  SHA-256:6FA3D61BB276CF00CEF71FFDC32A9D942056BDA15BABF8390EF9D5B5E891EC6E
                                                                                                                                                  SHA-512:38AA6A7D76FBD143D7CFFCD8C54A1757BB5C33128AE73DE39C751B6EF6B0223B929BD49EC89D162CE66AD3E69592FD4080C39C90D604B45C7BA08E7565DE154C
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:TH02...... ...].O.......SM01X...,...0.Q.O...........IPM.Activity...........h...............h............H..ht.s.......u....h...........H..h\eng ...r\Ap...hx...0....s....h...............h........_`9j...h....@...I.6w...h....H...8.>j...0....T...............d.........2h...............k6.E.....3.5...!h.............. hb.j......s...#h....8.........$h.......8....."hH......h....'h..............1h....<.........0h....4....>j../h....h.....>jH..h..p...t.s...-h .........s...+h|......h.s................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\17D692C7-3108-448B-B740-692875DECC5C

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):166203
                                                                                                                                                  Entropy (8bit):5.340929156521529
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:/+C7FPgOsB3U9guwwJQ9DQA+zqzhQik4F77nXmvYd8XRTEwreOR6g:eIQ9DQA+zqzMXeMJ
                                                                                                                                                  MD5:3617C98237601CD319DB50C2A9C41E21
                                                                                                                                                  SHA1:35F057CDFB0C8A6BFB6579911C106C414B1DF945
                                                                                                                                                  SHA-256:D442F915286D9376BD2B17C1A47A8C80C434B065A1573C9789EFF38F83DF14A1
                                                                                                                                                  SHA-512:3FD47CCA9A049B9127AFDD7BDDC1EA507579A315C9D2036ACBD1F9C7F1A01BEDB8B35F28846588F8472B25522DCD48737E4601801C43948809465E7C1C818BEF
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-04-24T13:59:55">.. Build: 16.0.17609.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):32768
                                                                                                                                                  Entropy (8bit):0.04562918148302959
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:GtlxtjlsmhZ+2hylxtjlsmhZ+2htR9//8l1lvlll1lllwlvlllglbelDbllAlldc:GtMz5Mzm9X01PH4l942wU
                                                                                                                                                  MD5:B4A8706EB07F11CFCF58099ED858D7FB
                                                                                                                                                  SHA1:8A10CB1390AFC16C6EA66F1CAC19EEBFAA986EEC
                                                                                                                                                  SHA-256:CB9DD1BB2C7CBE767661B535D8FAB587B6233BADFAABFF49554D63BA7BDEAA1E
                                                                                                                                                  SHA-512:D5819FE27F312CC6A4251D836BE36E4FC2A102FC965FC0B0210C17F3F0ED1E506F74356EAF02FD9DF1CEABA3B07ECCE18C93287F4F75550261107CDFE3774FE7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:..-.......................'..[..?.d.z.|.k.....$-..-.......................'..[..?.d.z.|.k.....$-........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                  Category:modified
                                                                                                                                                  Size (bytes):49472
                                                                                                                                                  Entropy (8bit):0.48394693076295997
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:oMqpQ1zGUll7DYMKipzO8VFDYM3BO8VFDYML:oo1hll4NiFjVG2jVGC
                                                                                                                                                  MD5:FD456C5DC1842E6A175A5B293297F0F4
                                                                                                                                                  SHA1:A90DAD9FD5EAF4678937B14120259E90609CEDF8
                                                                                                                                                  SHA-256:065B06732267AF1CBD620EA87428D2CA408DE0F91342A43A9B70C53C44938A5F
                                                                                                                                                  SHA-512:58F2256184EE3AFDFBD1515CABFB742B995DABB1AD1F14D218393D4E8E27DA44969550AB88EA0B128EF3A68577FC893A8994CDA2BF65DE9C0B9E8E5C03A438CD
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:7....-..........?.d.z.|..K.R..@q........?.d.z.|.@Ja..0.CSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713967193891562700_B8905FBF-46EC-4C90-B0B3-07BB0A9AE80F.log

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:ASCII text, with very long lines (28758), with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):20971520
                                                                                                                                                  Entropy (8bit):0.15899122148423586
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:1536:mcy0r05cPHZDTWQn/8gFAHb0IJ8gDxPzLDmIhDF72gBLRz5xjuA+hji8SYRZo/bI:/PlN/8dDv2F
                                                                                                                                                  MD5:F63DC61D3AD955052941F8963DFA90F6
                                                                                                                                                  SHA1:555B65E509B6A762091919079210529BA8E96548
                                                                                                                                                  SHA-256:2E3463120B75F0C5DCBE553795D76DB50DAECB8DF8AFCBA56EE7CEF583471661
                                                                                                                                                  SHA-512:63B545E4246DD7080AF04F41DB5FF876D8B2D282147272D673321BC902E476443CB05E88D1C55EA989CA82934C5EFA875E0C782D5878199A6D26BA64AAF05A47
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..04/24/2024 13:59:53.935.OUTLOOK (0xB78).0x684.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":22,"Time":"2024-04-24T13:59:53.935Z","Contract":"Office.System.Activity","Activity.CV":"v1+QuOxGkEywswe7CproDw.4.9","Activity.Duration":14,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...04/24/2024 13:59:53.951.OUTLOOK (0xB78).0x684.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-04-24T13:59:53.951Z","Contract":"Office.System.Activity","Activity.CV":"v1+QuOxGkEywswe7CproDw.4.10","Activity.Duration":10845,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersi

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1713967193892693200_B8905FBF-46EC-4C90-B0B3-07BB0A9AE80F.log

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):20971520
                                                                                                                                                  Entropy (8bit):0.0
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3::
                                                                                                                                                  MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                                                                                                                                  SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                                                                                                                                  SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                                                                                                                                  SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240424T1559530669-2936.etl

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):94208
                                                                                                                                                  Entropy (8bit):4.4453529143035135
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:768:miPZfTYhIL6zzLIOYn+JRv+f7dHsJonHFzcWF6+Z/RSpnuUkkyPo1XCJY5jWd04R:XzcWF6+9m47E91IVwuxrX0a5
                                                                                                                                                  MD5:30BE896D7437ED8A18223530ED4F7A6D
                                                                                                                                                  SHA1:3E0AD5FA0A22F8EF756F66E1F841852CDEB09990
                                                                                                                                                  SHA-256:5283399F06FDF0D6240166846D38C34E60ACB517C3763416A5891E8FD08F7AE2
                                                                                                                                                  SHA-512:BE19E3E36F83E6FE0E3114E42D2F7830CF18B1DA5E4EFE716BAA450D81BA7D968946498814C7065E4A60A67E5EA40B453EF6AD41D9D15686537FC9F5A707B616
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:............................................................................f.......x.......O...................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................@..L...............O...........v.2._.O.U.T.L.O.O.K.:.b.7.8.:.c.2.1.3.4.9.c.1.0.1.7.f.4.d.e.d.b.5.4.5.a.3.f.e.f.2.f.b.b.9.1.b...C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.4.2.4.T.1.5.5.9.5.3.0.6.6.9.-.2.9.3.6...e.t.l.........P.P.....x.......O...................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\~DF08893FE18BC13EB2.TMP

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):163840
                                                                                                                                                  Entropy (8bit):0.3558792646279195
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:oJHP7vaMcEnHB5CpJz41i9VYAVNgz0XHWQOAIAbAFAqwNh/:kP7vrUpJ0Yzoz0XHOAIMu
                                                                                                                                                  MD5:01D3E4F05A475AD9E59B6BEAE08D1299
                                                                                                                                                  SHA1:B101B07AC0F8B2295515710C10806CC9F698171B
                                                                                                                                                  SHA-256:F00AD7A5E3F47F4AF31DDD0DA8B43D807E0AC7A9122587F483E82D56F756C016
                                                                                                                                                  SHA-512:4B04186CD2DEBDD1E065225EA4287BBF49C9B79CE513C18AF80C5A2E4DAC6C97E3C39F98E4DDD56CFF9EC10EBC594D0B88B35D850D300883BF580512C175469E
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):30
                                                                                                                                                  Entropy (8bit):1.2389205950315936
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:3:Z5:
                                                                                                                                                  MD5:81177E25F349F2562F38157CC92E03AA
                                                                                                                                                  SHA1:559ACFFB1CC9995CAC22624B93BA8C517754DB0D
                                                                                                                                                  SHA-256:1F2C1F12004E838F9697A27FC136758795C0CA9B6B7263DCD880D02EA0FF313A
                                                                                                                                                  SHA-512:DFA5CF684A91FA43B7F5FF936C74310E14B0F6AD13D8C48B5C90D83F98E2374CD23710B4A79951A5B52719AE7CD60F850C87E51779B1BFFFF1785F69AC838CC4
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:....nI........................

                                                                                                                                                  C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:Microsoft Outlook email folder (>=2003)
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):271360
                                                                                                                                                  Entropy (8bit):1.3222414828255107
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:768:56Qc1mtk92B1r0sTRH6yQuHNEXHg0aGcrtdMnitBfk8BUTIZ:AsBVayuH6XMizfkeNZ
                                                                                                                                                  MD5:1C9C935E9423BF2C9C8AA010DCC25343
                                                                                                                                                  SHA1:245F6B6289AF5653B8DDAE46D4A11E38335C1910
                                                                                                                                                  SHA-256:546F7EF471E6B41C4B226ACEC872AEA25FDA3207585BD8217AE8C31D1029A678
                                                                                                                                                  SHA-512:20EF9A5D155D80C6E7D06B8FC1101F1869A40A316768D34E6C7F7BA75025EB3F3DFE86F6DADEFF8DF44F8E9DE863088E06EB5226155A0851340D1A7E659ED1D2
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:low
                                                                                                                                                  Preview:!BDN.^..SM......\....G..........E.......U................@...........@...@...................................@...........................................................................$.......D......@P..............A...............D....................................................................................................................................................................................................................................................................................................N.2.v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                  File Type:data
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):131072
                                                                                                                                                  Entropy (8bit):1.0661203382222955
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:384:P6jvvAUtDMYpPkIPiIfW0ZG0yO4rpW2Sg47f1R1Kr:PeQapsIzeBf9Zs
                                                                                                                                                  MD5:8E17EE190F20004FB28ECD5141E292B5
                                                                                                                                                  SHA1:70F0244A35343F3C2B438EC508D1184918EF43AA
                                                                                                                                                  SHA-256:D966A28A41758BB664414F85625D75511E87DBDD40D1F30145FDCB8A7F6F573D
                                                                                                                                                  SHA-512:30D3B5E90BAC3218C53B691F3CCB3A0E214CD4C8FD9491FC48764C0FA8E8CE1C03F7CA4E4DB4D2B4B3A6B316B42F3942E9BA266BBFF51704DFDDB41E476CE1CE
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:8"jwC...Z.......x.....q.O.....................#.!BDN.^..SM......\....G..........E.......U................@...........@...@...................................@...........................................................................$.......D......@P..............A...............D....................................................................................................................................................................................................................................................................................................N.2.v...q.O.....................#.......................p.................@...0.p.......................p..........s..........p.p..........^............p.........@a............p..........&............p.........@c............p.......................p.$........X......8...0.p.d........^..........0)p.h...............8....)p.l........u..........p*p.p........o...........+p.t........H...........+p.|...............n....,p.|.......

                                                                                                                                                  Static File Info

                                                                                                                                                  General

                                                                                                                                                  File type:CDFV2 Microsoft Outlook Message
                                                                                                                                                  Entropy (8bit):3.4248700978113615
                                                                                                                                                  TrID:
                                                                                                                                                  • Outlook Message (71009/1) 58.92%
                                                                                                                                                  • Outlook Form Template (41509/1) 34.44%
                                                                                                                                                  • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                                                                                                                                  File name:HATFIELD SHAWNA L-Docking Letter.eml (3.43 KB).msg
                                                                                                                                                  File size:24'064 bytes
                                                                                                                                                  MD5:e9321dda5f76f4b356f5eea3a780c2fb
                                                                                                                                                  SHA1:bde7070a336de8455a45e62db5dbe6f32c568935
                                                                                                                                                  SHA256:90a1e458dea52985436143637e01799f3a28b3d3363f8b9ab15bfbbfa8133d4f
                                                                                                                                                  SHA512:85a7a85370e587e087f8423aa3abd092814c3cf17ae8fd264086e92995a3658e637db15c039bcce97d56ccee35c04d58b2d06af3e03144c39b3ddceee6b48794
                                                                                                                                                  SSDEEP:384:R42KIixdAiXjdgo3prA4FBHAmfEass3urC1D:R4dNN/FvfEps+r0D
                                                                                                                                                  TLSH:38B2C12439EE5609F27BDF321EE194D789267C92ED15D68F3181334F0A71980E971B2E
                                                                                                                                                  File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                                                                                  Static Mail

                                                                                                                                                  General

                                                                                                                                                  Subject:Undelivered Mail Returned to Sender
                                                                                                                                                  From:Mail Delivery System
                                                                                                                                                  To:me@u.com <me@u.com>
                                                                                                                                                  Cc:
                                                                                                                                                  BCC:
                                                                                                                                                  Date:Wed, 24 Apr 2024 14:58:22 +0200
                                                                                                                                                  Communications:
                                                                                                                                                  • This is the mail system at host sbo3-sa01-amx02.hosting.local. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <me@u.com>: Host or domain name not found. Name service error for name=u.com type=A: Host not found
                                                                                                                                                  Attachments:

                                                                                                                                                    Headers

                                                                                                                                                    Key Value
                                                                                                                                                    dateWed, 24 Apr 2024 14:58:22 +0200

                                                                                                                                                    File Icon

                                                                                                                                                    Icon Hash:c4e1928eacb280a2

                                                                                                                                                    Network Behavior

                                                                                                                                                    ⊘No network behavior found

                                                                                                                                                    Statistics

                                                                                                                                                    CPU Usage

                                                                                                                                                    Click to jump to process

                                                                                                                                                    Memory Usage

                                                                                                                                                    Click to jump to process

                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                    Behavior

                                                                                                                                                    Click to jump to process

                                                                                                                                                    System Behavior

                                                                                                                                                    General

                                                                                                                                                    Target ID:0
                                                                                                                                                    Start time:15:59:53
                                                                                                                                                    Start date:24/04/2024
                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\HATFIELD SHAWNA L-Docking Letter.eml (3.43 KB).msg"
                                                                                                                                                    Imagebase:0x290000
                                                                                                                                                    File size:34'446'744 bytes
                                                                                                                                                    MD5 hash:91A5292942864110ED734005B7E005C0
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:moderate
                                                                                                                                                    Has exited:false

                                                                                                                                                    General

                                                                                                                                                    Target ID:2
                                                                                                                                                    Start time:15:59:54
                                                                                                                                                    Start date:24/04/2024
                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "ADA74FCB-84C0-4E48-BFCC-2AE070C9135C" "2243F897-73EF-4BBE-918D-79BD9FEBA809" "2936" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                                                                                                                                                    Imagebase:0x7ff775350000
                                                                                                                                                    File size:710'048 bytes
                                                                                                                                                    MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                    Reputation:moderate
                                                                                                                                                    Has exited:false

                                                                                                                                                    Disassembly

                                                                                                                                                    ⊘No disassembly