Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
EXTERNAL .msg

Overview

General Information

Sample name:EXTERNAL .msg
Analysis ID:1431792
MD5:bf27dab819ddd1111c45e0e6c12bdee0
SHA1:e0134d3997295e6afcc792af1e56ba532677bbb4
SHA256:b3eada106e8859587088d4ed92f9535d0b44300da04a6fac8a6b5fb7753ed816
Infos:

Detection

Score:2
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Phishing site detected (based on OCR NLP Model)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6760 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\EXTERNAL .msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6860 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "63ED5AB2-2F5D-4683-907E-2F29691C3407" "2B0A5043-B5FF-418B-89DD-6FDA9FAB4E85" "6760" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6760, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Outlook Security Settings Updated - Registry
Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IZ5MOODG\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6760, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: MSG / EMLML Model on OCR Text: Matched 94.7% probability on "This email ori inated from OUTSIDE of Desert Diamond. Do not click links oro en attachments unless ou reco nize the sender and know the content is safe. If in doubt click the Re ort Phish button at to ri ht of the Outlook Home Ribbon . "
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.aadrm.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.aadrm.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.addins.store.office.com/app/query
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.cortana.ai
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.diagnostics.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.diagnosticssdf.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.microsoftstream.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.microsoftstream.com/api/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.office.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.onedrive.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://api.scheduler.
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://apis.live.net/v5.0/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://augloop.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://augloop.office.com/v2
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://autodiscover-s.outlook.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://cdn.entity.
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://clients.config.office.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://clients.config.office.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://config.edge.skype.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://cortana.ai
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://cortana.ai/api
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://cr.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://d.docs.live.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://dataservice.o365filtering.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://dataservice.o365filtering.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://dev.cortana.ai
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://devnull.onenote.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://directory.services.
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ecs.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://edge.skype.com/registrar/prod
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://edge.skype.com/rps
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://entitlement.diagnostics.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://graph.ppe.windows.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://graph.ppe.windows.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://graph.windows.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://graph.windows.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ic3.teams.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://incidents.diagnostics.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://invites.office.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://lifecycle.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://login.microsoftonline.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://login.microsoftonline.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://login.windows.local
Source: OUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etl.1.drString found in binary or memory: https://login.windows.localMiR
Source: OUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etl.1.drString found in binary or memory: https://login.windows.localR
Source: OUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etl.1.drString found in binary or memory: https://login.windows.localnull
Source: OUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etl.1.drString found in binary or memory: https://login.windows.localnullD
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://make.powerautomate.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://management.azure.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://management.azure.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messaging.action.office.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messaging.engagement.office.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messaging.lifecycle.office.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://messaging.office.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ncus.contentsync.
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ncus.pagecontentsync.
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://officeapps.live.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://officepyservice.office.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://onedrive.live.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://onedrive.live.com/embed?
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://otelrules.azureedge.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://otelrules.svc.static.microsoft
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://outlook.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://outlook.office.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://outlook.office365.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://outlook.office365.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://outlook.office365.com/connectors
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://pages.store.office.com/review/query
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://powerlift.acompli.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://pushchannel.1drv.ms
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://res.cdn.office.net
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.39
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://settings.outlook.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://shell.suite.office.com:1443
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://skyapi.live.net/Activity/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://staging.cortana.ai
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://store.office.cn/addinstemplate
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://store.office.de/addinstemplate
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://substrate.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://tasks.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://templatesmetadata.office.net/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://web.microsoftstream.com/video/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://webshell.suite.office.com
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://wus2.contentsync.
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://wus2.pagecontentsync.
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://www.odwebp.svc.ms
Source: 0F95D951-E92D-4328-8307-1343382D8CDC.1.drString found in binary or memory: https://www.yammer.com
Source: classification engineClassification label: clean2.winMSG@3/21@0/0
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmpJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etlJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.iniJump to behavior
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\EXTERNAL .msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "63ED5AB2-2F5D-4683-907E-2F29691C3407" "2B0A5043-B5FF-418B-89DD-6FDA9FAB4E85" "6760" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "63ED5AB2-2F5D-4683-907E-2F29691C3407" "2B0A5043-B5FF-418B-89DD-6FDA9FAB4E85" "6760" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
Source: EXTERNAL .msgStatic file information: File size 2718208 > 1048576
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformationJump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Modify Registry		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account Manager12
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431792 Sample: EXTERNAL    .msg Startdate: 25/04/2024 Architecture: WINDOWS Score: 2 5 OUTLOOK.EXE 508 146 2->5         started        process3 7 ai.exe 5->7         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.entity.0%URL Reputationsafe
https://cdn.entity.0%URL Reputationsafe
https://powerlift.acompli.net0%URL Reputationsafe
https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
https://cortana.ai0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://api.aadrm.com/0%URL Reputationsafe
https://ofcrecsvcapi-int.azurewebsites.net/0%URL Reputationsafe
https://messagebroker.mobile.m365.svc.cloud.microsoft0%URL Reputationsafe
https://login.windows.localnull0%Avira URL Cloudsafe
https://otelrules.svc.static.microsoft0%URL Reputationsafe
https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
https://powerlift-frontdesk.acompli.net0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://officeci.azurewebsites.net/api/0%URL Reputationsafe
https://api.scheduler.0%URL Reputationsafe
https://my.microsoftpersonalcontent.com0%URL Reputationsafe
https://store.office.cn/addinstemplate0%URL Reputationsafe
https://api.aadrm.com0%URL Reputationsafe
https://dev0-api.acompli.net/autodetect0%URL Reputationsafe
https://www.odwebp.svc.ms0%URL Reputationsafe
https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
https://dataservice.o365filtering.com/0%URL Reputationsafe
https://officesetup.getmicrosoftkey.com0%URL Reputationsafe
https://prod-global-autodetect.acompli.net/autodetect0%URL Reputationsafe
https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h0%Avira URL Cloudsafe
https://ncus.contentsync.0%URL Reputationsafe
https://apis.live.net/v5.0/0%URL Reputationsafe
https://wus2.contentsync.0%URL Reputationsafe
https://make.powerautomate.com0%URL Reputationsafe
https://asgsmsproxyapi.azurewebsites.net/0%URL Reputationsafe
https://login.windows.localnullD0%Avira URL Cloudsafe
https://login.windows.localR0%Avira URL Cloudsafe
https://d.docs.live.net0%Avira URL Cloudsafe
https://d.docs.live.net0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://api.diagnosticssdf.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
    		high
    https://login.microsoftonline.com/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
      		high
      https://shell.suite.office.com:14430F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
        		high
        https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
          		high
          https://autodiscover-s.outlook.com/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
            		high
            https://useraudit.o365auditrealtimeingestion.manage.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
              		high
              https://outlook.office365.com/connectors0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                		high
                https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                  		high
                  https://cdn.entity.0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  https://api.addins.omex.office.net/appinfo/query0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                    		high
                    https://clients.config.office.net/user/v1.0/tenantassociationkey0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                      		high
                      https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                        		high
                        https://login.windows.localnullOUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etl.1.drfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://powerlift.acompli.net0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://rpsticket.partnerservices.getmicrosoftkey.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://lookup.onenote.com/lookup/geolocation/v10F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                          		high
                          https://cortana.ai0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                            		high
                            https://api.powerbi.com/v1.0/myorg/imports0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                              		high
                              https://cloudfiles.onenote.com/upload.aspx0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                		high
                                https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                  		high
                                  https://entitlement.diagnosticssdf.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                    		high
                                    https://api.aadrm.com/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    https://ofcrecsvcapi-int.azurewebsites.net/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://ic3.teams.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                      		high
                                      https://www.yammer.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                        		high
                                        https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                          		high
                                          https://api.microsoftstream.com/api/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                            		high
                                            https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                              		high
                                              https://cr.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                		high
                                                https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                • Avira URL Cloud: safe
                                                		low
                                                https://messagebroker.mobile.m365.svc.cloud.microsoft0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://otelrules.svc.static.microsoft0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://portal.office.com/account/?ref=ClientMeControl0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                  		high
                                                  https://clients.config.office.net/c2r/v1.0/DeltaAdvisory0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                    		high
                                                    https://edge.skype.com/registrar/prod0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                      		high
                                                      https://graph.ppe.windows.net0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                        		high
                                                        https://res.getmicrosoftkey.com/api/redemptionevents0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://powerlift-frontdesk.acompli.net0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://tasks.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                          		high
                                                          https://login.windows.localROUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etl.1.drfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://officeci.azurewebsites.net/api/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                          • URL Reputation: safe
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://sr.outlook.office.net/ws/speech/recognize/assistant/work0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                            		high
                                                            https://api.scheduler.0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://my.microsoftpersonalcontent.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://store.office.cn/addinstemplate0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://api.aadrm.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://edge.skype.com/rps0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                              		high
                                                              https://outlook.office.com/autosuggest/api/v1/init?cvid=0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                		high
                                                                https://globaldisco.crm.dynamics.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                  		high
                                                                  https://messaging.engagement.office.com/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                    		high
                                                                    https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                      		high
                                                                      https://dev0-api.acompli.net/autodetect0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://www.odwebp.svc.ms0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://api.diagnosticssdf.office.com/v2/feedback0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                        		high
                                                                        https://api.powerbi.com/v1.0/myorg/groups0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                          		high
                                                                          https://web.microsoftstream.com/video/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                            		high
                                                                            https://api.addins.store.officeppe.com/addinstemplate0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://graph.windows.net0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                              		high
                                                                              https://dataservice.o365filtering.com/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://login.windows.localnullDOUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etl.1.drfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://officesetup.getmicrosoftkey.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://analysis.windows.net/powerbi/api0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                		high
                                                                                https://prod-global-autodetect.acompli.net/autodetect0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://substrate.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                  		high
                                                                                  https://outlook.office365.com/autodiscover/autodiscover.json0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                    		high
                                                                                    https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                      		high
                                                                                      https://consent.config.office.com/consentcheckin/v1.0/consents0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                        		high
                                                                                        https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                          		high
                                                                                          https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                            		high
                                                                                            https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                              		high
                                                                                              https://d.docs.live.net0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                              • 0%, Virustotal, Browse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://safelinks.protection.outlook.com/api/GetPolicy0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                		high
                                                                                                https://ncus.contentsync.0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                • URL Reputation: safe
                                                                                                		unknown
                                                                                                https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                  		high
                                                                                                  https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                    		high
                                                                                                    http://weather.service.msn.com/data.aspx0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                      		high
                                                                                                      https://apis.live.net/v5.0/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://officepyservice.office.net/service.functionality0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                        		high
                                                                                                        https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                          		high
                                                                                                          https://templatesmetadata.office.net/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                            		high
                                                                                                            https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                              		high
                                                                                                              https://messaging.lifecycle.office.com/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                		high
                                                                                                                https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                  		high
                                                                                                                  https://pushchannel.1drv.ms0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                    		high
                                                                                                                    https://management.azure.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                      		high
                                                                                                                      https://outlook.office365.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                        		high
                                                                                                                        https://wus2.contentsync.0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        		unknown
                                                                                                                        https://incidents.diagnostics.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                          		high
                                                                                                                          https://clients.config.office.net/user/v1.0/ios0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                            		high
                                                                                                                            https://make.powerautomate.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            		unknown
                                                                                                                            https://api.addins.omex.office.net/api/addins/search0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                              		high
                                                                                                                              https://insertmedia.bing.office.net/odc/insertmedia0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                                		high
                                                                                                                                https://outlook.office365.com/api/v1.0/me/Activities0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                                  		high
                                                                                                                                  https://api.office.net0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                                    		high
                                                                                                                                    https://incidents.diagnosticssdf.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                                      		high
                                                                                                                                      https://asgsmsproxyapi.azurewebsites.net/0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                                      • URL Reputation: safe
                                                                                                                                      		unknown
                                                                                                                                      https://clients.config.office.net/user/v1.0/android/policies0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                                        		high
                                                                                                                                        https://entitlement.diagnostics.office.com0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                                          		high
                                                                                                                                          https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json0F95D951-E92D-4328-8307-1343382D8CDC.1.drfalse
                                                                                                                                            		high

                                                                                                                                            World Map of Contacted IPs

                                                                                                                                            ⊘No contacted IP infos

                                                                                                                                            General Information

                                                                                                                                            Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                            Analysis ID:1431792
                                                                                                                                            Start date and time:2024-04-25 19:23:46 +02:00
                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                            Overall analysis duration:0h 4m 39s
                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                            Report type:full
                                                                                                                                            Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                            Number of analysed new started processes analysed:19
                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                            Number of injected processes analysed:0
                                                                                                                                            Technologies:
                                                                                                                                            • HCA enabled
                                                                                                                                            • EGA enabled
                                                                                                                                            • AMSI enabled
                                                                                                                                            Analysis Mode:default
                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                            Sample name:EXTERNAL .msg
                                                                                                                                            Detection:CLEAN
                                                                                                                                            Classification:clean2.winMSG@3/21@0/0
                                                                                                                                            EGA Information:Failed
                                                                                                                                            HCA Information:
                                                                                                                                            • Successful, ratio: 100%
                                                                                                                                            • Number of executed functions: 0
                                                                                                                                            • Number of non-executed functions: 0
                                                                                                                                            Cookbook Comments:
                                                                                                                                            • Found application associated with file extension: .msg

                                                                                                                                            Warnings

                                                                                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, Microsoft.Photos.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                                            • Excluded IPs from analysis (whitelisted): 52.109.56.128, 52.113.194.132, 52.109.6.63, 104.76.210.92, 104.76.210.89, 52.111.227.28, 13.69.239.79
                                                                                                                                            • Excluded domains from analysis (whitelisted): omex.cdn.office.net, us1.odcsm1.live.com.akadns.net, odc.officeapps.live.com, slscr.update.microsoft.com, eus2-azsc-000.roaming.officeapps.live.com, osiprod-eus2-buff-azsc-000.eastus2.cloudapp.azure.com, asia.configsvc1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, login.live.com, officeclient.microsoft.com, osiprod-cus-bronze-azsc-000.centralus.cloudapp.azure.com, a1864.dscd.akamai.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, onedscolprdneu12.northeurope.cloudapp.azure.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, cus-azsc-000.odc.officeapps.live.com, fe3cr.delivery.mp.microsoft.com, us1.roaming1.live.com.akadns.net, s-0005.s-msedge.net, config.officeapps.live.com, inc-azsc-config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, prod.odcsm1.l
                                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                            • Report size getting too big, too many NtSetValueKey calls found.

                                                                                                                                            Simulations

                                                                                                                                            Behavior and APIs

                                                                                                                                            ⊘No simulations

                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                            IPs

                                                                                                                                            ⊘No context

                                                                                                                                            Domains

                                                                                                                                            ⊘No context

                                                                                                                                            ASNs

                                                                                                                                            ⊘No context

                                                                                                                                            JA3 Fingerprints

                                                                                                                                            ⊘No context

                                                                                                                                            Dropped Files

                                                                                                                                            ⊘No context

                                                                                                                                            Created / dropped Files

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):231348
                                                                                                                                            Entropy (8bit):4.397009775557836
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:1536:YVYL0Vgs/9Y+kMMSngsd9NcAz79ysQqt2f9ezqoQeVrcm0Fve3/y2S86C5bP4Fkz:rKgm75g4miGu2kqoQYrt0FvfINkkCeN
                                                                                                                                            MD5:E6E2489118B97B9A86ECF3FC986702B7
                                                                                                                                            SHA1:6E33FAF1BC18DA637A3AFC064D41E0066E51EEEF
                                                                                                                                            SHA-256:6EB415F8A1FAC00421AC987F2D4C68E8B4F744E230C3B4A9A888578EFF62BA34
                                                                                                                                            SHA-512:91B22E1397055D60BEB14C8A120FC633783EBEC865C303AE85E5DE8BBA125983A3C59006294B6BFF3A53C6E56CEC02F010495805D82B34F885CD8D9D537AF0FE
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview:TH02...... .P.ua5.......SM01X...,....mga5...........IPM.Activity...........h...............h............H..h..W......f.....h........0q..H..h\cal ...pDat...hh...0...P.W....h,`c...x........h........_`wj...h`ac.@...I.lw...h....H...8.|j...0....T...............d.........2h...............k..............!h.............. hTcB.....h.W...#h....8.........$h0q......8....."h.r......(n....'h..............1h,`c.<.........0h....4....|j../h....h.....|jH..h..x.p.....W...-h .........W...+h.`c......W......... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):322260
                                                                                                                                            Entropy (8bit):4.000299760592446
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
                                                                                                                                            MD5:CC90D669144261B198DEAD45AA266572
                                                                                                                                            SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                                                                                                                                            SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                                                                                                                                            SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                                            Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):10
                                                                                                                                            Entropy (8bit):2.6464393446710153
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3:LoTIfn:MAn
                                                                                                                                            MD5:C8422458C97A285315D41C1D0B33D586
                                                                                                                                            SHA1:D6E5782D6E54840180E921DC0E6A6F517379C1A1
                                                                                                                                            SHA-256:F7945358D081F7AD7A8582475A8B7A2640655C016F05F63377C21A20EB60FFBA
                                                                                                                                            SHA-512:8975AFE6950ECE782DE2E8DDD4F8C8B116440336914CA77F41E6B6A649502DB840A85E7EDF1C766556A6648F07E5C9AA7FC19817FB370F54702634B6764F6A5C
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview:1714065866

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\0F95D951-E92D-4328-8307-1343382D8CDC

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):166208
                                                                                                                                            Entropy (8bit):5.34092956186635
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:1536:z+C7FPgOsB3U9guwwJQ9DQA+zqzhQik4F77nXmvYd8XRTEwreOR6Y:iIQ9DQA+zqzMXeMT
                                                                                                                                            MD5:00169F3191C3B453E53874BC6617F69D
                                                                                                                                            SHA1:286E26D8646C0A542617DFC4549B64D24DB243E6
                                                                                                                                            SHA-256:70B1CA83A3A704605F867BE93A8989EA38B7117A41A9260E02B8F003E5B42D60
                                                                                                                                            SHA-512:981304E68430EC910CFCFF58A71D6FED3A7EA22810B72743B1A17C1E1EAAB05C70F51242C9BB779155C7B08AC7FD105BDA82B273F878A860D0A7D31028B2BF10
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-04-25T17:24:24">.. Build: 16.0.17619.40127-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):4096
                                                                                                                                            Entropy (8bit):0.09216609452072291
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3:lSWFN3l/klslpF/4llfll:l9F8E0/
                                                                                                                                            MD5:F138A66469C10D5761C6CBB36F2163C3
                                                                                                                                            SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
                                                                                                                                            SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
                                                                                                                                            SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                                            Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:SQLite Rollback Journal
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):4616
                                                                                                                                            Entropy (8bit):0.13760166725504608
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3:7FEG2l+TS/FllkpMRgSWbNFl/sl+ltlslVlllfllB:7+/lFg9bNFlEs1EP/x
                                                                                                                                            MD5:F9993C1D1C23ABB83475C3F01C5097D9
                                                                                                                                            SHA1:B540A4D8215E604E9E9D0CE89BF56ADAD1614B0E
                                                                                                                                            SHA-256:D9A770D8702A508ED132A38B4CF44BE800BE7B7DBE57A9717FCE3B7AEC914768
                                                                                                                                            SHA-512:5A7A52C9EFD97381CBF588664F73F07D7B1F2D3D8510B41ACA2C4C3E6B97AE6AF1A082A92FA9D19A97566327457AAC09C7320802678B0AA15C3C6C6C6B909E0C
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview:.... .c.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):32768
                                                                                                                                            Entropy (8bit):0.04474441261042196
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3:G4l21bNiXKV2/lYll4l21bNiXKV2//mlL9//Xlvlll1lllwlvlllglbXdbllAlla:G4l2KXbull4l2KXbCL9XXPH4l942U
                                                                                                                                            MD5:4BAA01BB1B1C7C37AB311B66C0C94C3C
                                                                                                                                            SHA1:A5D55ECDF4BC555B9312722C2EFA25E859D38F67
                                                                                                                                            SHA-256:4073C0507550EB7B64C4780AF6758B97E40FFA6B9E3EA00500BDB23AA2156B3C
                                                                                                                                            SHA-512:9C4546D3F220A5F9DF0BB8FE75729109993B8D03FC8E3EF0B141E12EA91D33D90F12BBBFF54EE46544B25AA72F1C7268995208FE1BF6003945802A739348A6EF
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview:..-.......................G.l.`u.F..og."__..8i0...-.......................G.l.`u.F..og."__..8i0.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):45352
                                                                                                                                            Entropy (8bit):0.3938662033332444
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:24:KCr+Q3zRDMBuUll7DBtDi4kZERDPXzqt8VtbDBtDi4kZERD6:5r+Q1PUll7DYMzXzO8VFDYMe
                                                                                                                                            MD5:39E6115C1A31ABCDB0848B8673D9459A
                                                                                                                                            SHA1:21F732551FB03C04013BB5CCA080C1029A24F11D
                                                                                                                                            SHA-256:0011F53FD0A111B00F815557DC18A2546E76D993A192CB74F5DEF5D7E1EC8B14
                                                                                                                                            SHA-512:829247C975C3F1DE582D56BED360830C61C0F5D0881BF1FB2C9CC8E72AA49827B68CF2E71629C56DAA30A2BFB162A4B91EB7183054EE30C70F6CEEFA427FDFA9
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview:7....-...........F..og."..I.a............F..og."......&'SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IZ5MOODG\INVOICE INFO #4095049584958 (002).jpg

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4]
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):2606889
                                                                                                                                            Entropy (8bit):7.436811225094701
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:49152:FgXmw36jj1A9pVY7QxrPW3toFS7CsDZO8XUJFsyybwrhY+A:FBw36jBA9pq7QxuGFS7CQpGFs5bwWj
                                                                                                                                            MD5:2F9886F2AA69A915BDA82ACE5D7CC242
                                                                                                                                            SHA1:3BD92D0E7A5EE8A4D339EDFD39AB29954E48D20E
                                                                                                                                            SHA-256:91C45D3802070383E799F9D5245D3B61BDA6C719526701231F5D19A5CA8AAC41
                                                                                                                                            SHA-512:1EAE0C363F017977BE25083E9C93F933B60E19B15172E8B81F7182EF78DC934287CFCFC3DD5E85510CB0D8DB2CC2C09EF0BD67B8304C411E4ACB31BF839F0461
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview:......JFIF.....,.,......Adobe.d.........Exif..MM.*.......;.........J.i.........R.......................>................................................................................................................................................................................................................................................................................lenovo....................................35..........35..............................................................................................................................................................................................................................................................................................2024:04:24 19:08:52.2024:04:24 19:08:52...l.e.n.o.v.o.......ICC_PROFILE.......HDM .@..prtrCMYKLab ............acsp.......................................-HDM ....e.aU.5....................................cprt... ...gwtpt........A2B0.......4B2A0......q<gamt.......0A2B1...<...4B2A1

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IZ5MOODG\INVOICE INFO #4095049584958 (002).jpg:Zone.Identifier

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                            Category:modified
                                                                                                                                            Size (bytes):26
                                                                                                                                            Entropy (8bit):3.95006375643621
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3:gAWY3n:qY3n
                                                                                                                                            MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                                                                                                            SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                                                                                                            SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                                                                                                            SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:high, very likely benign file
                                                                                                                                            Preview:[ZoneTransfer]..ZoneId=3..

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IZ5MOODG\INVOICE INFO #4095049584958.jpg

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4]
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):2606889
                                                                                                                                            Entropy (8bit):7.436811225094701
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:49152:FgXmw36jj1A9pVY7QxrPW3toFS7CsDZO8XUJFsyybwrhY+A:FBw36jBA9pq7QxuGFS7CQpGFs5bwWj
                                                                                                                                            MD5:2F9886F2AA69A915BDA82ACE5D7CC242
                                                                                                                                            SHA1:3BD92D0E7A5EE8A4D339EDFD39AB29954E48D20E
                                                                                                                                            SHA-256:91C45D3802070383E799F9D5245D3B61BDA6C719526701231F5D19A5CA8AAC41
                                                                                                                                            SHA-512:1EAE0C363F017977BE25083E9C93F933B60E19B15172E8B81F7182EF78DC934287CFCFC3DD5E85510CB0D8DB2CC2C09EF0BD67B8304C411E4ACB31BF839F0461
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:......JFIF.....,.,......Adobe.d.........Exif..MM.*.......;.........J.i.........R.......................>................................................................................................................................................................................................................................................................................lenovo....................................35..........35..............................................................................................................................................................................................................................................................................................2024:04:24 19:08:52.2024:04:24 19:08:52...l.e.n.o.v.o.......ICC_PROFILE.......HDM .@..prtrCMYKLab ............acsp.......................................-HDM ....e.aU.5....................................cprt... ...gwtpt........A2B0.......4B2A0......q<gamt.......0A2B1...<...4B2A1

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IZ5MOODG\INVOICE INFO #4095049584958.jpg:Zone.Identifier

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):26
                                                                                                                                            Entropy (8bit):3.95006375643621
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3:gAWY3n:qY3n
                                                                                                                                            MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                                                                                                            SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                                                                                                            SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                                                                                                            SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:[ZoneTransfer]..ZoneId=3..

                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{94455415-ACB0-4273-8F58-F440E7C67408}.tmp

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):2018
                                                                                                                                            Entropy (8bit):1.5963367221861473
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:12:vR10jWWS4Vi4V5zwe5jsjyjS+iNSi3Yh3NxsW0QYkCYcrGc5:vwqWS4Vi4V5kOTjS+iNZmoW0QYKgn
                                                                                                                                            MD5:510803D48B946CECA74AFC915D19C4C6
                                                                                                                                            SHA1:04627990769CC270689434588322F066305636C0
                                                                                                                                            SHA-256:840EC7B1512479366C04192A72C28756365F61AB1BE8CA5C0C68CE218267E43A
                                                                                                                                            SHA-512:BA1708E6228774FC23D2FD426FA10BAF636D6E65802A8A3599CEF6A477A150AD2CBA7FFAC06130239950320DD22614207F1520965E39AC46C3EDD262543F4F9D
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1714065861390053800_C0EB6D2F-C9CE-498D-B3AE-341DBA809993.log

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):20971520
                                                                                                                                            Entropy (8bit):0.004821342729682406
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:96:vFNtZkrBuML1RKd/Q8dum7KZBKTwKaeQ8dO4h1K01Q8dmzaMmidKnuQ8d/wnbsRQ:bzEBTxPKTThI2ji+AHjy4qNZyNStKBQ
                                                                                                                                            MD5:1A1CA83211BBD5A19C466713492C3906
                                                                                                                                            SHA1:3FAF1AFA660E751959D3EA400732016F35683B08
                                                                                                                                            SHA-256:7080DE6B90D7BDF396F82BC9D1DD0D23F996F00AF11B3EA5F021CDC34A705D08
                                                                                                                                            SHA-512:B98A0AFF2E51D0F3DF246F986F775D25B695C691BDAE07C94D19D1D6F5180FFA476937890E1DB6FA69814E87E5982A0C24642D2BC8AB0F53D8BCB3352409C9B6
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..04/25/2024 17:24:21.421.OUTLOOK (0x1A68).0x18E8.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-04-25T17:24:21.421Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"675D7A92-06BE-4F30-B09A-88FF4E55C622","Data.PreviousSessionInitTime":"2024-04-25T17:24:07.517Z","Data.PreviousSessionUninitTime":"2024-04-25T17:24:10.595Z","Data.SessionFlags":4,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...04/25/2024 17:24:21.468.OUTLOOK (0x1A68).0x1A58.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"

                                                                                                                                            C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1714065861390836300_C0EB6D2F-C9CE-498D-B3AE-341DBA809993.log

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):20971520
                                                                                                                                            Entropy (8bit):0.0
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3::
                                                                                                                                            MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                                                                                                                                            SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                                                                                                                                            SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                                                                                                                                            SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240425T1924210168-6760.etl

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):118784
                                                                                                                                            Entropy (8bit):4.66674809100979
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3072:LhGoQda5HK7uQVrjle8xbkapt7jyPd2ox4JPXHJeX/+:5G
                                                                                                                                            MD5:F67C2BEBB7C9ABFC502572AA98A3FD14
                                                                                                                                            SHA1:9A1264D1807185E7EF48BB37A916266337F063EA
                                                                                                                                            SHA-256:58D45EE0791E543E3311E035244C061BF5368DB5EDA96E3612861181ED04B1E1
                                                                                                                                            SHA-512:447DA73AC9EDA4B33358F64D8327884A23C5D586E61EBC9FCFBC4609AB72EB2AEBE97D6438F9B8AF7F6A056C37885B5D2AC5526F29783DA93995DD94B5E16B93
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:............................................................................`.......h...E{.i5...................eJ..............Zb..2.......................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...............................................................Y..........E{.i5...........v.2._.O.U.T.L.O.O.K.:.1.a.6.8.:.7.a.d.b.b.7.5.e.1.7.f.8.4.9.e.c.b.e.b.6.0.7.e.a.9.5.d.f.d.3.b.5...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.4.2.5.T.1.9.2.4.2.1.0.1.6.8.-.6.7.6.0...e.t.l.......P.P.....h......i5...........................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\AppData\Local\Temp\~DFCD77189CF064D632.TMP

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):163840
                                                                                                                                            Entropy (8bit):0.408245581639992
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:192:VTDPgRE938MlkhcXBrGKTglll/JC4ywQGih4NgiXHWQOuqAbAn/:tIROJlkyX5LiHJC4FQGihniXHOuqM
                                                                                                                                            MD5:62C2D9E77CDE902FED748790FDE8C6BD
                                                                                                                                            SHA1:B90EBBB2BB6BE20AFE75FD5FC1B6AFEF2492CCC3
                                                                                                                                            SHA-256:A970251DC6E0EAA52A1D7BD52BB8A6EFD02D6307CDE7A30FA88FAF326661026F
                                                                                                                                            SHA-512:8C07875F138CB6067A2CA653A83E5D9A6BE051D6739A3B981CF2CE21507DCB02873890AB9429C936B292AAA58A026D7BFA8F36829666C65D522C38626C81473F
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):30
                                                                                                                                            Entropy (8bit):1.2389205950315936
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:3:mShtt:mSr
                                                                                                                                            MD5:F6AFE4EA0292FF47526864B76989FE3C
                                                                                                                                            SHA1:157841B7705A6A3A8B6DF55BBD2A421BAB54FCE9
                                                                                                                                            SHA-256:221C869A8DEB448E17B65FF96454E9C2F173B4D7AE68BA44BA4D2D6D1ABDF99E
                                                                                                                                            SHA-512:5635057945163AD314C81C41B9BDDBA47FA6C33085206A496E8425AE1417F23B5DF71AFB5492A6245D55B6B579755191857677F29062791CC8BA0A6D8A579D2D
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:..............................

                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):16384
                                                                                                                                            Entropy (8bit):0.670299540857104
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:12:rl3baFYsqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheC3bm:rDmnq1Py9613C
                                                                                                                                            MD5:086AAA2F6DA27EE4E638AE0F2FA7F912
                                                                                                                                            SHA1:789DB9CAF089AD197BB290515F93C5C9CBA914EE
                                                                                                                                            SHA-256:B31439F1A58954A54D5602BF6AB72A825F0612C2E488900BDE809111D5F72D59
                                                                                                                                            SHA-512:E11918603348CF97DBE013075EA43793648EBFC21646DEB550D537B6218891B40B3C92D3ED9867B9C754FBDA4BC9302927FBDD7BEF687CE384F9F148F61DF0FD
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:Microsoft Outlook email folder (>=2003)
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):271360
                                                                                                                                            Entropy (8bit):1.5433635221690822
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:768:3QcCcSfptDmN5rLFphnJyBygIB4UxckLGMP88BUTIZP:83mvr5/nJn4khP8eNZP
                                                                                                                                            MD5:D54C8E605C340AF8AACC219F048FF81B
                                                                                                                                            SHA1:D055656C1CC853B484FC09185D0DB99AF488FC34
                                                                                                                                            SHA-256:CB9C635F52113EC9928C218CA5673A0EB26BAE79059CC2BFE8A9CEC076DD5A95
                                                                                                                                            SHA-512:65AF9DEF666856C43E8BC3141CB043E9C8F9DDC2C907BF24DB7E182E21EB837938609B3EB36CD6838A0F361666C15C4C66B08D0DB7B93532221FE1C546D4421C
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:!BDNt...SM......\...%...................\................@...........@...@...................................@...........................................................................$.......D.......:..........................................................................................................................................................................................................................................................................................................................H.......m....".....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                                                                                                                            Download File
                                                                                                                                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            File Type:data
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):131072
                                                                                                                                            Entropy (8bit):0.9484168388695461
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:192:k0DwjTIoOJMlDehMrzTJsHUfLyy8HIDKMvoVqwff4Hi1R43440Wz:QjTIXJYDe4qHUj95wfr1Rw
                                                                                                                                            MD5:D0C294B2EA1E2DC424DAA71A92E9A3F2
                                                                                                                                            SHA1:E4C846B3CCE86D6EA2EDF3E9A8623B00CD7F1257
                                                                                                                                            SHA-256:1CAAA709679703BEB3000822339C407DC7D4E1906C1161F71ABCECA468DFFA0B
                                                                                                                                            SHA-512:C99AD10FC158A463A04976A8B3BDB48112302FC2E09E07BF04877FEDDF0DC300F863DB36FBC70CDD304A70DBFEEB9E68EE3DC5AE143911A305CF868BE1C9548C
                                                                                                                                            Malicious:false
                                                                                                                                            Preview:....C...J.......h......h5.....................#.!BDNt...SM......\...%...................\................@...........@...@...................................@...........................................................................$.......D.......:..........................................................................................................................................................................................................................................................................................................................H.......m...."....h5........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                            Static File Info

                                                                                                                                            General

                                                                                                                                            File type:CDFV2 Microsoft Outlook Message
                                                                                                                                            Entropy (8bit):7.385082385840065
                                                                                                                                            TrID:
                                                                                                                                            • Outlook Message (71009/1) 58.92%
                                                                                                                                            • Outlook Form Template (41509/1) 34.44%
                                                                                                                                            • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                                                                                                                            File name:EXTERNAL .msg
                                                                                                                                            File size:2'718'208 bytes
                                                                                                                                            MD5:bf27dab819ddd1111c45e0e6c12bdee0
                                                                                                                                            SHA1:e0134d3997295e6afcc792af1e56ba532677bbb4
                                                                                                                                            SHA256:b3eada106e8859587088d4ed92f9535d0b44300da04a6fac8a6b5fb7753ed816
                                                                                                                                            SHA512:007439abc4e42c7636ff0e1d5f649c0daa1af560096c3524f19d02c3610d09fda224e4985c133098cf89c0cca698ab259c4b1c898c8c84d30d04302c09fb027f
                                                                                                                                            SSDEEP:49152:ygXmw36jj1A9pVY7QxrPW3toFS7CsDZO8XUJFsyybwrhY+:yBw36jBA9pq7QxuGFS7CQpGFs5bwW
                                                                                                                                            TLSH:B6C5691E2BCA95D4F12D82714C924F062EDCACF31512790B72AF7E9D17B2D1BAB87106
                                                                                                                                            File Content Preview:........................>...................*..................................................................................................................................................................................................................

                                                                                                                                            Static Mail

                                                                                                                                            General

                                                                                                                                            Subject:[EXTERNAL]
                                                                                                                                            From:Presley Priestleye <priestleyehpresleytt@gmail.com>
                                                                                                                                            To:undisclosed-recipients:;
                                                                                                                                            Cc:
                                                                                                                                            BCC:
                                                                                                                                            Date:Wed, 24 Apr 2024 16:25:41 +0200
                                                                                                                                            Communications:
                                                                                                                                            • This email originated from OUTSIDE of Desert Diamond. Do not click links or open attachments unless you recognize the sender and know the content is safe. If in doubt click the Report Phish button at top right of the Outlook Home Ribbon . ________________________________
                                                                                                                                            Attachments:
                                                                                                                                            • INVOICE INFO #4095049584958.jpg

                                                                                                                                            Headers

                                                                                                                                            Key Value
                                                                                                                                            Receivedby mail-lf1-f66.google.com with SMTP id 2adb3069b0e04-518a3e0d2ecso10390224e87.3
                                                                                                                                            via Mailbox Transport; Wed, 24 Apr 2024 0726:06 -0700
                                                                                                                                            15.2.1544.4; Wed, 24 Apr 2024 0726:05 -0700
                                                                                                                                            via Frontend Transport; Wed, 24 Apr 2024 0726:05 -0700
                                                                                                                                            Received-SPFNone (mailb.desertdiamondcasino.com: no sender
                                                                                                                                            x-record-text="v=spf1 ip435.190.247.0/24 ip4:64.233.160.0/19
                                                                                                                                            ip4209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19
                                                                                                                                            Authentication-Resultsmailb.desertdiamondcasino.com; spf=Pass smtp.mailfrom=priestleyehpresleytt@gmail.com; spf=None smtp.helo=postmaster@mail-lf1-f66.google.com; dkim=pass (signature verified) header.i=@gmail.com; dmarc=pass (p=none dis=none) d=gmail.com
                                                                                                                                            IronPort-SDR6629167b_B00OKJY70rCgY1NBczCqsRQFcQ/ckwN68onAqRpG21NAQ+A
                                                                                                                                            IronPort-DataA9a23:bVWYOK+hg3aKhOGs1c9mDrUDq3WTJUtcMsCJ2f8bNWPdYAuW74E1v
                                                                                                                                            IronPort-HdrOrdrA9a23:iSQRnqrJyJNk40oaozp86b4aV5oKeYIsimQD101hICF9WcaT/v
                                                                                                                                            X-Talos-CUID9a23:XZm1lG3WSug4IKxXTcG7u7xfIPB8LGPSln3rG0K2G2VHWbeSdV6P0fYx
                                                                                                                                            X-Talos-MUID9a23:5ora8Ao1AmxnBxpfdvkezwtEE810xa+2MVAQtJIooturNy5pZijI2Q==
                                                                                                                                            X-IronPort-AVE=Sophos;i="6.07,226,1708412400";
                                                                                                                                            X-Amp-ResultUNKNOWN
                                                                                                                                            X-Amp-Original-VerdictFILE UNKNOWN
                                                                                                                                            X-Amp-File-UploadedFalse
                                                                                                                                            X-IronPort-Outbreak-StatusNo, level 0, Unknown - Unknown
                                                                                                                                            by mailb.desertdiamondcasino.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Apr 2024 0725:59 -0700
                                                                                                                                            for <fcampa@desertdiamondcasino.com>; Wed, 24 Apr 2024 0725:59 -0700 (PDT)
                                                                                                                                            DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed;
                                                                                                                                            h=tosubject:message-id:date:from:mime-version:x-gm-message-state
                                                                                                                                            from:to:cc:subject:date:message-id:reply-to;
                                                                                                                                            X-Google-DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed;
                                                                                                                                            X-Forwarded-Encryptedi=1; AJvYcCUsd9IfAbwRYam5bVgBS/LDEv90EiX4t6MqsrEf1mIj6dsgQiXGjXZw0B2AMTiLgvQFBBaOK65dPcVq/qv3iL0+qIx+O8SVuBioyYr5jt4=
                                                                                                                                            X-Gm-Message-StateAOJu0Yw0/S1OYEWziZ5JyH9xU+zOIQV6VB+kA5sBOa47NJdR1szV1584
                                                                                                                                            X-Google-Smtp-SourceAGHT+IHGXQxJNIhHMisCmJKNw5tFP8/otJdBkUai+yrvcvoVxFi5ZGSMqGYhbXbELpy+o/fkrppcAJP0cAAb9rFBVSM=
                                                                                                                                            X-Receivedby 2002:a05:6512:34cf:b0:518:c59b:4fa9 with SMTP id
                                                                                                                                            Apr 2024 0725:53 -0700 (PDT)
                                                                                                                                            MIME-Version1.0
                                                                                                                                            FromPresley Priestleye <priestleyehpresleytt@gmail.com>
                                                                                                                                            DateWed, 24 Apr 2024 19:55:41 +0530
                                                                                                                                            Message-ID<CALED9zVJO7m86Vop8sgq9n57YdfsNtdi=MesSXbvdhcknnkBFw@mail.gmail.com>
                                                                                                                                            Subject[EXTERNAL]
                                                                                                                                            Toundisclosed-recipients:;
                                                                                                                                            Content-Typemultipart/mixed; boundary="000000000000bac52a0616d87237"
                                                                                                                                            BCC<fcampa@desertdiamondcasino.com>
                                                                                                                                            Return-Pathpriestleyehpresleytt@gmail.com
                                                                                                                                            X-MS-Exchange-Organization-Network-Message-Ida92fcc4e-5f6e-4af0-7e38-08dc646a79c5
                                                                                                                                            X-MS-Exchange-Organization-AVStamp-MailboxSYMANTEC;1;0;info
                                                                                                                                            X-MS-Exchange-Organization-AuthSourcepExch01.desertdiamondcasino.com
                                                                                                                                            X-MS-Exchange-Organization-AuthAsAnonymous
                                                                                                                                            X-MS-Exchange-Transport-EndToEndLatency00:00:01.0279592
                                                                                                                                            X-MS-Exchange-Processed-By-BccFoldering15.02.1544.004
                                                                                                                                            dateWed, 24 Apr 2024 16:25:41 +0200

                                                                                                                                            File Icon

                                                                                                                                            Icon Hash:c4e1928eacb280a2

                                                                                                                                            Network Behavior

                                                                                                                                            ⊘No network behavior found

                                                                                                                                            Statistics

                                                                                                                                            CPU Usage

                                                                                                                                            Click to jump to process

                                                                                                                                            Memory Usage

                                                                                                                                            Click to jump to process

                                                                                                                                            High Level Behavior Distribution

                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                            Behavior

                                                                                                                                            Click to jump to process

                                                                                                                                            System Behavior

                                                                                                                                            General

                                                                                                                                            Target ID:1
                                                                                                                                            Start time:19:24:21
                                                                                                                                            Start date:25/04/2024
                                                                                                                                            Path:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\EXTERNAL .msg"
                                                                                                                                            Imagebase:0x100000
                                                                                                                                            File size:34'446'744 bytes
                                                                                                                                            MD5 hash:91A5292942864110ED734005B7E005C0
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Reputation:moderate
                                                                                                                                            Has exited:false

                                                                                                                                            General

                                                                                                                                            Target ID:3
                                                                                                                                            Start time:19:24:24
                                                                                                                                            Start date:25/04/2024
                                                                                                                                            Path:C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                            Commandline:"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "63ED5AB2-2F5D-4683-907E-2F29691C3407" "2B0A5043-B5FF-418B-89DD-6FDA9FAB4E85" "6760" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
                                                                                                                                            Imagebase:0x7ff79e6b0000
                                                                                                                                            File size:710'048 bytes
                                                                                                                                            MD5 hash:EC652BEDD90E089D9406AFED89A8A8BD
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Reputation:moderate
                                                                                                                                            Has exited:false

                                                                                                                                            Disassembly

                                                                                                                                            ⊘No disassembly