Windows Analysis Report
Re_ ITT-Glass_Vendors Registration (13).msg

Overview

General Information

Sample name:	Re_ ITT-Glass_Vendors Registration (13).msg
Analysis ID:	1431484
MD5:	76fbe38d38030893d0ae0f1d9581a0e2
SHA1:	a6cca0322b847a5c9482d35e3fc13788aebdbba1
SHA256:	a3d40a30f9880ab069148355d313997a7a5efdbeac71bb767776ba64001c4543
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Phishing site detected (based on OCR NLP Model)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Classification

Signatures

Phishing site detected (based on OCR NLP Model)

Source: MSG / EML

ML Model on OCR Text: Matched 80.3% probability on "971 4771 3600 DUBAI PROPERTIES Good Morning Sir ! !! Please find the attach bank transfer details for the refundable security deposit. Regards, MUSTAFA RAJPURWALA MANAGER-PROJECTS & BUSINESS DEVELOPMENT ebjJl Jl..c .p.ro..uiJ ul-.clil Office No.12, A1 Awazel Building +971 4 333 3606 GIOSS wort-D Ras al Khor Industrial Area-2 +971 55 226 6027 InDUSTRlES L.L.C. Dubai, U.A.E. 23 yearJ q Taye//enee info@glassworld.ae www.glassworld.ae Good Morning ! !! We have received the your bank account details and will be transferring security deposits amount today. Once its done will update you accordingly. Regards, "

Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.aadrm.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.aadrm.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.cortana.ai
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.microsoftstream.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.office.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.onedrive.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://api.scheduler.
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://augloop.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://augloop.office.com/v2
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://cdn.entity.
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://clients.config.office.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://clients.config.office.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://config.edge.skype.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://cortana.ai
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://cortana.ai/api
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://cr.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://d.docs.live.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://dev.cortana.ai
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://devnull.onenote.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://directory.services.
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ecs.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://edge.skype.com/rps
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 27231098576.ttf.1.dr	String found in binary or memory: https://github.com/itfoundry/Poppins)PoppinsRegularITFO;
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://graph.windows.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://graph.windows.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ic3.teams.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 27231098576.ttf.1.dr	String found in binary or memory: https://indiantypefoundry.comThis
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://invites.office.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://lifecycle.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://login.windows.local
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://make.powerautomate.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://management.azure.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://management.azure.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messaging.action.office.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://messaging.office.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ncus.contentsync.
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://officeapps.live.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://officepyservice.office.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://onedrive.live.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://outlook.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://outlook.office.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://outlook.office365.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://outlook.office365.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://powerlift.acompli.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://res.cdn.office.net
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.39
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 27231098576.ttf.1.dr	String found in binary or memory: https://scripts.sil.org/OFLhttps://scripts.sil.org/OFL
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://settings.outlook.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://staging.cortana.ai
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://substrate.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://tasks.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://webshell.suite.office.com
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://wus2.contentsync.
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: E4333BAB-F940-4150-9AAE-5C215C9C1D6B.1.dr	String found in binary or memory: https://www.yammer.com

Source: classification engine

Classification label: clean1.winMSG@3/26@0/0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Re_ ITT-Glass_Vendors Registration (13).msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4C91DE6C-012E-40FA-B6E4-4A916357AA90" "AB6D7A72-3249-4203-8659-587BA1FE438F" "2228" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4C91DE6C-012E-40FA-B6E4-4A916357AA90" "AB6D7A72-3249-4203-8659-587BA1FE438F" "2228" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

ID:	1431484
Product:	CloudBasic
Start time:	09:57:40
Start date:	25.04.2024
Sample:	Re_ ITT-Glass_Vendors Registration (13).msg
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	76fbe38d38030893d0ae0f1d9581a0e2
SHA1:	a6cca0322b847a5c9482d35e3fc13788aebdbba1
SHA256:	a3d40a30f9880ab069148355d313997a7a5efdbeac71bb767776ba64001c4543
Filetype:	Outlook Message (71009/1) 45.36%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT	data	877DEEF5EEFC14F2EDA81AFFB5F6B5B0	12C5C5B14DA00AA11E0CC85DDC53ED22B3AC3601	A1771B43AF30C070E722C8A6E7CD0D80E8A18B8937AC002A36CC8E32BA1F4C64
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml	XML 1.0 document, ASCII text, with very long lines (2010), with no line terminators	A4A9DF56B452211A555E571D28C5B539	97FC6DB4896918312CF938DD9698913E7EE1F71E	EEEF7238A1F4533297B344AD9349293CF665EB175D920F65DF7F6FE252CBE6DC
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Poppins\27231098576.ttf	TrueType Font data, digitally signed, 14 tables, 1st "DSIG", 17 names, Microsoft, language 0x409, Copyright 2020 The Poppins Project Authors (https://github.com/itfoundry/Poppins)PoppinsRegularI	09ACAC7457BDCF80AF5CC3D1116208C5	86A425BE5A919D86729B85B2BC1D07DA5CE413D4	7E65201E9B79159E2300267CC885E16C8DCEF2424CDFA09A29BFB0980A94A7BA
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin	ASCII text, with very long lines (65536), with no line terminators	CC90D669144261B198DEAD45AA266572	EF164048A8BC8BD3A015CF63E78BDAC720071305	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin	ASCII text, with no line terminators	7C02BC12A7F8332FE8FAE703BA6CB161	E0C3C42A63688FA9108E32578AA9D1D35C2BF942	11449701C9EC192DC1672FE42EE027706064A171DF5187EDCF433C921F70B9DF
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E4333BAB-F940-4150-9AAE-5C215C9C1D6B	XML 1.0 document, ASCII text, with CRLF line terminators	37463467BA1384D06893930F40C0B7A2	11EF52D4A1B1C8C3C51206310536B11F5B81170D	8B1D082B74D0CBCA55BE6DEA14EB4B62028AE51A5967A7C7B8109199D78E7F92
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db	SQLite 3.x database, last written using SQLite version 3034001, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2	D0DE7DB24F7B0C0FE636B34E253F1562	6EF2957FDEDDC3EB84974F136C22E39553287B80	B6DC74E4A39FFA38ED8C93D58AADEB7E7A0674DAC1152AF413E9DA7313ADE6ED
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal	SQLite Rollback Journal	82AEECB60E84CC20B31263A6D1C5BE65	6AB57EDA11D9345729F989E480662C3E17BF462C	202232B70C432A3E9FEF72242225817F48383FFF3BF293C334243AA7E9823F48
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	DA9BCCC40BD7ECBCCB559E95FBA4AD2B	9906CE1418AA2BD31CD96E580B27D52D1E85F066	6D548E89EEE47AC410FE62AFA5502FBCA63F8B2D50C391530356BC969A2A7DCE
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	B3AFF29ABD04B56D03498F543446047F	7A5C011AA43217CAE230DB59384613C38A341EC9	73B357503972C9AF6C163F471FD510BECAF47F3B0D2FA45EF8DF87F6BFDC80A4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\277D1562.dat	PNG image data, 323 x 210, 8-bit/color RGBA, non-interlaced	ABC808D97D2A240FE0C612FC88488EDC	36962DEA0B92D7203EFA17A4CF20B032F2D18E7E	86D82D53B9EC1E5C5520B90E7533727F02374A64642FBC9267C33031F2E696A2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\557ACBA5.dat	PNG image data, 2501 x 834, 8-bit/color RGBA, non-interlaced	1710260961464DFD7AAEC4FA9E9BE701	2BFF6FD5AE03EBC5909A538709A4CE9F9A996E0F	3E8E1309726E35B26819623B33EBBBBF663C0FABD07780CB1B526FB34F376BD6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CB8E9649.dat	PNG image data, 323 x 210, 8-bit/color RGBA, non-interlaced	ABC808D97D2A240FE0C612FC88488EDC	36962DEA0B92D7203EFA17A4CF20B032F2D18E7E	86D82D53B9EC1E5C5520B90E7533727F02374A64642FBC9267C33031F2E696A2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D33FB7B6.dat	PNG image data, 2501 x 834, 8-bit/color RGBA, non-interlaced	30F11FDCBF3ACA711869AF197D9B9A45	4A5CFDC015473B8F2BA2B7B552A1C7981ACD7FC9	90AC84B2EEB900C8E1EA157C5F9BD6A6A6D67A4C5279E8D092BCA9BE0657F53C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E34D83F.dat	PNG image data, 2501 x 834, 8-bit/color RGBA, non-interlaced	30F11FDCBF3ACA711869AF197D9B9A45	4A5CFDC015473B8F2BA2B7B552A1C7981ACD7FC9	90AC84B2EEB900C8E1EA157C5F9BD6A6A6D67A4C5279E8D092BCA9BE0657F53C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E4FF1534.dat	PNG image data, 323 x 210, 8-bit/color RGBA, non-interlaced	ABC808D97D2A240FE0C612FC88488EDC	36962DEA0B92D7203EFA17A4CF20B032F2D18E7E	86D82D53B9EC1E5C5520B90E7533727F02374A64642FBC9267C33031F2E696A2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EE7121FB.dat	PNG image data, 323 x 210, 8-bit/color RGBA, non-interlaced	ABC808D97D2A240FE0C612FC88488EDC	36962DEA0B92D7203EFA17A4CF20B032F2D18E7E	86D82D53B9EC1E5C5520B90E7533727F02374A64642FBC9267C33031F2E696A2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E529D7BF-311F-4C8D-902F-D79A43824280}.tmp	data	F004A7151837B0FF02AA6797A76E6FA7	51F777827BF2FA74045215221E81C1D239BED143	9B6F986E10E25CA0AFD4E012F697AF314AEAF0B46944A193BA285D4176DA280A
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1714031913683916500_9C10FFF9-BB17-4FCF-8893-760E04944A56.log	ASCII text, with very long lines (28725), with CRLF line terminators	05E1BA40E46D7653A2043E2A86732627	DA46537E7425820818EC374FBDF67A255292D882	0D449885136A78FDC5E5C6498D4FA50A0FC3FB4C380751B7ECB604D0777C7826
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1714031913685318000_9C10FFF9-BB17-4FCF-8893-760E04944A56.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240425T0958330464-2228.etl	data	10DC08D0C995C37C27D979BDB1F20893	6F2E77ACD8C16ADFB4369A6AE7348C54D480F4F6	C9CF4DB703ACC9F0F3663FDE0C1E6D54040545F67D3CC73743B186634F88B480
C:\Users\user\AppData\Local\Temp\~DF78A832B4DF2ED1A6.TMP	data	7EB40CA6473CEB3BCED75C6CF45F711A	6B8BBB63D5DC5F3EFFCB8B99D6BAB54EDF3FA8DB	0CDD46AC824F28D435AF6EFDBF2C2D7B9B64E84B68924F2C4CA802AEF694C663
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	E39D34C8D5AFD4DF97518DC362311632	74486E3319B9D138D95F381A9D94FD617E83DC81	B31BFE441F1830951B5E088D9E0A54B917C679F0583979B6686FDC0F702CC1B4
C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs	Composite Document File V2 Document, Cannot read section info	99F8A9514EFCF8DF817E8D981D5C2C3D	CD050D453D71CF65DBB0F6F6CBB2CD1EFD1E04E5	B8D3A1A861D3041F3B03A9AA95CB4A16DED0E6287337518FD45641BC9752A2C0
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	EB341F8EEF7ACC808A414A1D00B64F82	A399A67DA4A315638998F7EB24085DE73299EE2A	875FFCA5B52F3A8D16AC2E6D232C59175F0FE3775239AA926B2728E7D796A304
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	80905D1A0FB466F4BBC3A32328DC2958	54E107A752957BFE98FCDC207D5CCA8E935EC515	57BC7AF05052D8CE24113922AFDEDE5BA5B296E844B3D0FE47A9A24128CADEFB

Windows Analysis Report Re_ ITT-Glass_Vendors Registration (13).msg

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Re_ ITT-Glass_Vendors Registration (13).msg