Windows Analysis Report
RE_ Whitney Walker shared _Insulation Supply Co Inc_ with you.eml

Overview

General Information

Sample name:	RE_ Whitney Walker shared _Insulation Supply Co Inc_ with you.eml
Analysis ID:	1469355
MD5:	1a8b2c53d991128791d9cdc19d279ffb
SHA1:	d74792d5f01b067db10ff78221a144a2ab274ba2
SHA256:	76feb5e90c0323dad344fa45f1c6aa1ee5380c8ee3fc20bb48cd5bec28e0cf5e
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Signatures

HTML body contains low number of good links

Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c&sso_reload=true	HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9

HTTP Parser: Base64 decoded: )\.\d+))/.test(navigator.userAgent) || /[?&]env=TeamsWebView/.test(location.search) || /Teams\/((?:(\d+)\.)?(?:(\d+)\.)?(?:(\d+)\.\d+))(?:\/(\\d+))?/.test(navigator.userAgent) || window.name =...

HTML title does not match URL

Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.18:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.18:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.18:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.126.37.153:443 -> 192.168.2.18:49762 version: TLS 1.2

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: insulationsupply-my.sharepoint.com to https://login.microsoftonline.com:443/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5fid=00000003%2d0000%2d0ff1%2dce00%2d000000000000&response%5fmode=form%5fpost&response%5ftype=code%20id%5ftoken&resource=00000003%2d0000%2d0ff1%2dce00%2d000000000000&scope=openid&nonce=6b27dc79dceafb004d9295529e50e7f230ba64a102531292%2d9d0da855bae1339d31461f2044b5f5af4a71fd72b83ace9319e0048f6b4fd73f&redirect%5furi=https%3a%2f%2finsulationsupply%2dmy%2esharepoint%2ecom%2f%5fforms%2fdefault%2easpx&state=od0w&claims=%7b%22id%5ftoken%22%3a%7b%22xms%5fcc%22%3a%7b%22values%22%3a%5b%22cp1%22%5d%7d%7d%7d&wsucxt=1&cobrandid=11bd8083%2d87e0%2d41b5%2dbb78%2d0bc43c8a8e8a&client%2drequest%2did=3a5b3aa1%2df0b9%2d6000%2d1224%2d96a69ca47b8c

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.136.10 13.107.136.10
Source: Joe Sandbox View	IP Address: 207.211.31.106 207.211.31.106
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 152.199.21.175 152.199.21.175

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.97
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.164.97
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.37.153
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.37.153
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.37.153
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.37.153
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.37.153
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.37.153
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.37.153

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hdL8vSy+ghpG68M&MD=FTPLUMaD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /s/faDOCrklP5s18YV7f7MnA7?domain=insulationsupply-my.sharepoint.com HTTP/1.1Host: url.us.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/65YLcSRpz4vdw3BEyqGXmQ_zglEV2Stv0oPNwQPoUO_mgs6kodJvKURwhsiYeY3mPWg7MCj_ZZY5-WmJeQiy6sA_2YWxdVxO7Lb21bnylgVBXqhitA6oN8uQ8ChGyooL168kHSgifp4RXooYgMyN9aBprdSX9JM1zdpcZMc_QS30RXhDueBRU7uXMyvxFSqiQJMQ61e8-CW1JxQ_ieMI882Ikka2xNOqqTZNbA35zZ-GSkELSPRcJuGZymo-GzMNam7Mne8CCAhjzuIuv1gr2YU83HtTbVFt5B1l7SA2Qa0rvHgQGVfI37S23KstyQ4oTbQtC6_kpDO6O41AGrNbeLOtLox-uWWXuNZHI2q73skaAcAVsJV48rAZYl2pVFXfUXnnAEub_90jSAJciHg0J9hu9mq85L6o6kGE5vyUbArTxmN65A5ul8BmyfMYgBPkZ7BGWlqPl9yKTg3hbMHRk7PgoLi7kuyxfyWWNSWgq2652zR2s1XY4-sXaRvSdGE_sOXyqgwB3_YgyOnhvYQfMv9DgUWcEioDd0EalSpfvOoTAbU9QBZNqhuoQ8WyCU6KMqibDXY6D_eiMqvXS4t33Yk4-YA9YYv17wmBKt8lExzSgvGgrQqY4Oc1nVoJkYZRqYdIOYk2rfws5I-0bw2psGPXcwc32ifDWqjRRiclRlaIk3GlaNOmWmdnXxwmC1vqr3cqHOoncXPTj4kmLnhb2QXdD9_c5eDY3HYHGY8MwUEBrW7CWbK36DVO_um2NhG96Zbg732g8hn8FxE_P_nVpKEUssysxqhazkOjsXk_WB3sWtQh69jxMn-UhOrISMjGKSXpshDICJGeiqGl-RC-s69iwRB5K6tINBqNOiOaFqk6kFLaurswjTmeYX1fjalgTCqOjG9hJZYO6oerrj0fwoRNxg6VU_UljsbiKnF7YXxM3_AU8KDq2YJ8v4VPh8xJcJEbW7UfTyafD2t42uu7zObjDrs5jI0mOyb2hf_OopN1TCcuFMG1o9U9EM_D0mlsW1QwcuL5G3iKFqrtyALKVxXEqgdrYBGtVWQQov7VKG552YZHM_KtwERyh8Bd16FQyQOG_4tf726gCEGVIOW1SEZ4jpDqjL5om9_v-5hedavW3Jb3qlxvPmy5WAarg8gpplld01HsXASeJsW2ctJvN4_V5rIXCc2znoOdcqKIHDIdrkEiynqta68eGUP9G-kcc-10qZzPZ0tI14ItapNOVBVux6G0uv_TnF3fH2E2ZoIKztovyTCw3oToGWtZ2xQiMHAZip_RbXsHUKA-X-RJ6dDG_YwsLvBikUGRnQ7ZiCZ_Df1X52pXDLs5qpHIdGXWMONSnJqY4rSV72F1wgV0Z-5Y80q-YSgGds0do1Db7YR_z5Ao96QBCt_YOzaobcv-mMH8udYEt5Y-XUxd5y6nb4W5Ihx4Ekap41whVXSzBQigbrVMdtn10cCP8wPtzVOyM3kPxUw8LGpQYf0AgW8zvmxEsymD0AeyXKBKDmBhmZhF1NrgoEyvkXbVdYEIsTmnyjK3_2eAjZJLYc3Jsd9btXsRVbfB4xD5Et5FAVVvOeZoSALhHVzrEF1y_sDd2UkCJUoWs41EawMbKS9ZAMqFA_jymgZrV3r7DpwHjjgJQbbJijAOH23Y4P9N--kj83Q2QregpkN4TdWAs60bpIk_2h3p5vnIHoYBiBKhPY3_KuGO3WWdg8lr079M7x0l9ZPn9nlxH90HnvFhDXZsbfg2wI2-7v1TE85BXDlmGB-UScVauwlpS5KGAqamwTcoDz7sbavADwAHkSx0TU5y1eKleYccAo-L92OxR9h4Uja9H11Gghrtiknnx3nzOcl_8zFPjJXYzDxhsjTxiK3avqnOmofSJtX3H-qkZG_GgR2TUwLkXI2evGJTaXSjqYw2o39uipogmt9InBRJpfrQbELNfQwvnYCHCvnyxQJ5FP5p-60XBBqcsUqRxTejV-Dkvi0CUH02cbMn2ge94flGW0LoW0NJ_1wcx_kWVm10cPXAWCDomGu0DUV4jfvto_bhfy_u1tyP80GMRJMD5SO1OijIPnBZENIlHgw9Fj2d_5Da1aYjyc_2JoychkZqLkG-mkqz_ai7S-S8bHBO3hDRgP3Z8iY3KM3EDdb7JAzUhwjnn4Vb8q1yo6pe4jvJ0n_99YcH0IkA2EFdkyLV9eM_BY6nHT4Nz8SWcQEeu7mKfrlkP1N8e39zc05i-7zzfP2wvwPqBkL2clOcRGc_cWHU6tDZdCZY8jcYgKWQohOT6PWAC72jG7PCg9Yd6i8AOYNy8artUjdZb8A2w-Z9tNhwg6xFYpPm9oYG_wqzYVsMFocO8CbN2dfkqiVJdyUR8Oevt16hIwc2TOS4w2VITG81jQSuJQe7njyNRPentgHBg8gezoPJSrTDr3hWh9-uldjssiHIrYnVqjeaxMgjO825rDJhxu_pc81-Xh66HWXrcplwaobbnljlGgfD9TuiAoxoO43aAM-yeUBjlz_QEq-IuUg1S_PWu4Ob97_M34u8Wz3o71cvNAocuOqxffEC_FhVyIsghHI57FUGqzsn1rrbDkL5OizJdAU9Q-DAGAJEs2P0MYlMMDTl5YuJ8TxNm_dM8e0ik8B2CKPM-sZ7JSi3D62NB466ao5pqYL4VV78aR-l55R4cObKuESvlPYqCkJOuQsyzj9DRfw91VLuVN2uTrY0Ad2Tj-ZZTf9UqykCynBKWNNVIcRm_CEmlHSFQMudqPISaprwYz8NwOmYtfIQCcergRLW6-nnXFf_GlOyb6m_SjKxLu12ICHBgcE0us3suJC00IBhji9yZ6p9m51VOSw08eDZy6yVvFPwzHFfYq6shO7UP-YV7e3FXTBJCjpr_EDFS5Lq8Vdww8rn8wg1XcavVVpw0uUkPl_URXhg5v0rljZN5R_u1zG06zEoFGKXEmYv2992RsVvzIrLO2yJ70GJ56SeZx3XNn4q1U6fkIDuZmLlXp2cf
Source: global traffic	HTTP traffic detected: GET /:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9 HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG212 HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG212 HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=0yYPTd-lhHN_094swnZz29modwe3FSeZ43AMczOMaFx7lQqU7iNx93jGN_7I4puv8EmzPB9dQYLJERqpFo_HM0IQNGVDn1-KkTFQEgsYFHJpbt40kxFjb4w7uiM2tBgOcb9ILArAZB6v1t_Jt4QvZfdebAkUmIdJtZrmHsDa0I_kMtGA46jGkbQsTTHY5goF0&t=74258c30 HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=SbTurKDYnoyQCY9p1rxEngnDZZRUXX2qdEVYLBe8WF2pIvWQUzJqZDY3qXExUFChSPtta_3UmHA1FEA37OjpccZyy8AF0njjttSlPGxBx8_qqb3Tt7afJQeXaeAvQZTRiOcw2G5vDZxPCcugg-2vLqRJCIiDYXh87BGU-WdL6MoDUjuaGKGeQCnUAgwoQztH0&t=74258c30 HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=aO_lnINnnjiGheJzvkW13uuF0yM-aVwgwJImRWMgq8LQTeX5F2iopT1O0XW-vqGs9ZYUtMQ496vZaHexVO99-lES1ow7Skoh9GMgmRsuL2c1&t=638533172441064469 HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/wwalker_insulationsupply_net HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false
Source: global traffic	HTTP traffic detected: GET /personal/wwalker_insulationsupply_net/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fwwalker%5Finsulationsupply%5Fnet HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2fwwalker_insulationsupply_net%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fwwalker%255Finsulationsupply%255Fnet&Source=cookie HTTP/1.1Host: insulationsupply-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGd3dhbGtlciU1Rmluc3VsYXRpb25zdXBwbHklNUZuZXQ=
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hdL8vSy+ghpG68M&MD=FTPLUMaD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A410900B03DX-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAegZ5/A3wmRh/XDwMnnuhhJf22e3drHFIfc/H8lbfi81Cj%2Bm3v2jUg1xYxoNJQCN7d2WbPMJCB7wMAPLzOKRh6bGyq2X78oriXOryB9MMk4aMoQIj4%2BcmtcUqyF/qmU7xmPlpDe7321pPml%2B9R9aWBh2PVGTfeGrxdozcft%2BA0/VGmw6D3RHNdqjf3mKmM5LtEOGs3xUQZktjg7PeHxYIfXh4rYntG5mKx4ABF9YN3Ld9zAvwHXNe7A27KMDZX1yHT2pcJWz6OSO1zCGESsaVkfSPYlYzYVVlx7zxkOPfoufYYJU%2BqBIXiVYuod5%2BCcH0US1prnVsNzHYeZNklbn9ZIDZgAACKJyM7eZEmRTqAGiZq%2BZTFMoQB/azvof4Y3dw4Xh49y4xdRq4AQsBEo/5oB4i12w/KD6pObMZes6yrYOQlDK700yLiN4CJTIqi6tDGKTDl6zLG0qYk/MC3aWE4YgdgqRtw2LAdo8nGTXHmoZ5pZ6yXRmxoUtk90b9D7o8P6wSUm6pj4aJrLgRUcIyeuQCSv8TDhgUV6L%2BeWJhLxAdNTsiTl%2BKuQqQeYGIsWed7WNbjT4k2w4HdAY7RvPJVFzn2iLGanBij8r2YDy%2Bwiz/nmeQGz5QNwUrh8zHc6zz4hwQ8asVl8njyqD1evblKC/VDVavrLAl1NO0NajXR6rU3tRVLkWsF5JMpj6X0CrlJ4vMMDKJcFhPRfX41FSt/cf8J%2B%2BJwFjp/JlmvAhu/qwUH9y7NpTqMfv80NcRZXmfOYknK9Yuz82XURJmIKB35m%2BRRn1XzxNqXZSg%2Bt4QlTHmX/tOJj0M3pl/kqC7ZKe4ZKbqVAMdRixS1vHjIfEh5Js4%2BQaqzWIxNUysKwtDz6EthleoiJPmOB2iGwUbqFFL5nK7IV3IATlcGTZfPI13vhJEoSZHddX1wE%3D%26p%3DX-Agent-DeviceId: 01000A410900B03DX-BM-CBT: 1720462029User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 45A44FAEF497460694BACB6080D04E20X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=B4BB39E5F80E411D94C438C0FA7ACF94&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&LUT=1707317051026&IPMH=6b344233&IPMID=1707317270835&HV=1707317277; ANON=A=680C1B1A649CBD64DD40EBFCFFFFFFFF; MUID=BC76BB0020D345C1A049A4820CB4C03C; MUIDB=BC76BB0020D345C1A049A4820CB4C03C

Source: global traffic	DNS traffic detected: DNS query: url.us.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: insulationsupply-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: chromecache_112.12.dr	String found in binary or memory: http://feross.org
Source: chromecache_102.12.dr, chromecache_105.12.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_102.12.dr, chromecache_105.12.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_102.12.dr, chromecache_123.12.dr, chromecache_112.12.dr, chromecache_105.12.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_98.12.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_98.12.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_99.12.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12009/1033/initstrings.js
Source: chromecache_99.12.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12009/blank.js
Source: chromecache_99.12.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12009/init.js
Source: chromecache_99.12.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25019.12009/theming.js
Source: chromecache_99.12.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/2.21.0/js/MicrosoftTeams.min.js
Source: ~WRS{FA5A59C5-A007-461C-AB44-E8C7C66A1B10}.tmp.0.dr	String found in binary or memory: https://url.us.m.mimecastprotect.com/s/1cOcCv2pW5s275NqcXVdDT?domain=aka.ms
Source: ~WRS{FA5A59C5-A007-461C-AB44-E8C7C66A1B10}.tmp.0.dr	String found in binary or memory: https://url.us.m.mimecastprotect.com/s/faDOCrklP5s18YV7f7MnA7?domain=insulationsupply-my.sharepoint.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.18:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.18:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.18:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.126.37.153:443 -> 192.168.2.18:49762 version: TLS 1.2

Source: classification engine

Classification label: clean4.winEML@19/84@20/7

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\RE_ Whitney Walker shared _Insulation Supply Co Inc_ with you.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "EBFDD2CB-C307-46EC-8396-4181E0112239" "86A4C594-244D-4797-BA44-4DB8E1522AA4" "1096" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/faDOCrklP5s18YV7f7MnA7?domain=insulationsupply-my.sharepoint.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1964,i,1538280598631933597,18167589036323333541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "EBFDD2CB-C307-46EC-8396-4181E0112239" "86A4C594-244D-4797-BA44-4DB8E1522AA4" "1096" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/faDOCrklP5s18YV7f7MnA7?domain=insulationsupply-my.sharepoint.com	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1964,i,1538280598631933597,18167589036323333541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: Google Drive.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
207.211.31.106	url.us.m.mimecastprotect.com	United States	14135	NAVISITE-EAST-2US	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Name	IP	Active
dual-spo-0005.spo-msedge.net	13.107.136.10	true
url.us.m.mimecastprotect.com	207.211.31.106	true
sni1gl.wpc.omegacdn.net	152.199.21.175	true
www.google.com	172.217.18.4	true
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true
insulationsupply-my.sharepoint.com	unknown	unknown
identity.nel.measure.office.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown
login.microsoftonline.com	unknown	unknown

Name	Malicious	Antivirus Detection	Reputation
https://insulationsupply-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG212	false	Avira URL Cloud: safe	unknown
https://insulationsupply-my.sharepoint.com/personal/wwalker_insulationsupply_net	false	Avira URL Cloud: safe	unknown
https://url.us.m.mimecastprotect.com/s/faDOCrklP5s18YV7f7MnA7?domain=insulationsupply-my.sharepoint.com	false	Avira URL Cloud: safe	unknown
https://insulationsupply-my.sharepoint.com/personal/wwalker_insulationsupply_net/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fwwalker%5Finsulationsupply%5Fnet	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js	false	Avira URL Cloud: safe	unknown
https://insulationsupply-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=tMQyIYuqg6gA5d4OhqkBpg%3D%3DTAG212	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_Kjlmc42uL0ATl_21eYcwVg2.js	false	Avira URL Cloud: safe	unknown
https://insulationsupply-my.sharepoint.com/:b:/g/personal/wwalker_insulationsupply_net/EdwjXVLSQNRLvin0lNqp0O0BuL6jRKHY8m3T_tVdeRGtJQ?e=4%3aE3pUkl&at=9	false		unknown
https://insulationsupply-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	false	Avira URL Cloud: safe	unknown
https://insulationsupply-my.sharepoint.com/WebResource.axd?d=aO_lnINnnjiGheJzvkW13uuF0yM-aVwgwJImRWMgq8LQTeX5F2iopT1O0XW-vqGs9ZYUtMQ496vZaHexVO99-lES1ow7Skoh9GMgmRsuL2c1&t=638533172441064469	false	Avira URL Cloud: safe	unknown
https://insulationsupply-my.sharepoint.com/ScriptResource.axd?d=0yYPTd-lhHN_094swnZz29modwe3FSeZ43AMczOMaFx7lQqU7iNx93jGN_7I4puv8EmzPB9dQYLJERqpFo_HM0IQNGVDn1-KkTFQEgsYFHJpbt40kxFjb4w7uiM2tBgOcb9ILArAZB6v1t_Jt4QvZfdebAkUmIdJtZrmHsDa0I_kMtGA46jGkbQsTTHY5goF0&t=74258c30	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js	false	Avira URL Cloud: safe	unknown
https://insulationsupply-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fwwalker_insulationsupply_net%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fwwalker%255Finsulationsupply%255Fnet&Source=cookie	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_fo8rkc18qnhjh4wnzabsdg2.js	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/b378f2e9-fb8e-4a4f-803c-eab93005a235/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6B27DC79DCEAFB004D9295529E50E7F230BA64A102531292%2D9D0DA855BAE1339D31461F2044B5F5AF4A71FD72B83ACE9319E0048F6B4FD73F&redirect%5Furi=https%3A%2F%2Finsulationsupply%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=3a5b3aa1%2Df0b9%2D6000%2D1224%2D96a69ca47b8c&sso_reload=true	false		unknown

ID:	1469355
Product:	CloudBasic
Start time:	20:05:26
Start date:	08.07.2024
Sample:	RE_ Whitney Walker shared _Insulation Supply Co Inc_ with you.eml
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	1a8b2c53d991128791d9cdc19d279ffb
SHA1:	d74792d5f01b067db10ff78221a144a2ab274ba2
SHA256:	76feb5e90c0323dad344fa45f1c6aa1ee5380c8ee3fc20bb48cd5bec28e0cf5e
Filetype:	E-Mail message (Var. 5) (54515/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT	data	5FAAC81F1E83700B4EDD924BBFF77908	16D80173AE97959427B42DF5752E592BA1E1F877	5049ED54B800A0DEEE17723035459882CA21B617CF963F709D59C6573DF93EC0
C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators	761038FCC45B80B87190A39BF2E460A9	B9796B2AD50A5297335E695A97E8E7EF723966F6	6D24999F8E951936169D1934A5D717D16EFDEEE27BB50E33C8094B6AF1121B8D
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json	JSON data	C37972CBD8748E2CA6DA205839B16444	9834B46ACF560146DD7EE9086DB6019FBAC13B4E	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365	4296A064B917926682E7EED650D4A745	3953A6AA9100F652A6CA533C2E05895E52343718	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	E57E0FAF8DEC4958748C68A76E0F587D	E79B38AF8817BA8AC7D4AF0C507CBA7E9DD77E70	B6038B44CAFE441E40A69EB3B6EE53C4D5A1BB4691D28E86B070301F9F3C81BC
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	4100BC776109E8395B70D38671C09215	61F926B8051AF419461B61884AFE3BEF35BBA4E2	5DEA157A87664B0EC95A71FF391BB9F831F80BAAC9832A350AB6276E1CE8C53E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\16C56982.dat	PNG image data, 172 x 40, 8-bit/color RGBA, non-interlaced	10756BD9D810A0202CF4B5E7828160C0	42DFDBE0F7B69C4A1A37958F63A242C143209699	8BA923AECE3E1731B7CDF398D30EEE632B285A5CC91F3E6A062BB72713F38644
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B10E8845.dat	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	4DF1205B01187B26FF893615B19C65DE	13856C6DCE2C8C328153C9C6FD37643EDCC45B81	5931FFF65F3CF45DA0DDD4F29D39BA23063A3735A8F99868DF6C23E26BD61788
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C417F9D6.dat	PNG image data, 485 x 175, 8-bit/color RGBA, non-interlaced	7EF829656E80FBA89AE3B74E778DF510	AD12C000C0B3784F2B0BA33C02EA794F7BB142CB	04E6FA89EF4D6C1691138C783D5C40EAEBA18CA508D990F43AAA5B97E740DACA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E8A8F3DF.dat	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced	1E13EE0ED09C4AF1ADFB6C0D280879B0	1192A79F7B4C4FF814583743F8C66ACA7ECB8ACF	E2395FBA25D3FB8A971345CA65D144F7D9C9D933F70409165446E63D18C0958D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F2863C54.dat	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced	84F31C408E3CF06C02486DBB6BDA155C	CA98C2D676E88C2E6AB6A7B084F3C8EF958843BD	86DC33F753D461E6CC93AA4C846B3D9D2708171DCE9D0BB85163CB40961272C3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{FA5A59C5-A007-461C-AB44-E8C7C66A1B10}.tmp	data	E49D9E04A03F25228AE3CF37767ADA63	3F7E259EF5E8B5C5CA1E3B7ECBFD709C90F3B96A	96DA65F7458EC6EE391DA81BF5BA3E7CF4E29FD78984DF6CDFE2CB157428ADD2
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1720461956675925900_B2638275-83D5-4AD2-B4E3-173E9092AE38.log	ASCII text, with very long lines (28770), with CRLF line terminators	C74F266264971C3370FCED72AB238B5A	0DEA8CB0969B9D5077C70E970DB9AF123FF750CF	9370CD1577BFA3BCF988A15BEF112C275FA0B2D17DD97277105095C18FE6B68F
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1720461956676621200_B2638275-83D5-4AD2-B4E3-173E9092AE38.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240708T1405560458-1096.etl	data	C794E34CE6681626044E411E3336B88E	E3798E1C9A823E8828E8CAE5CDF18C63BFA2CCA3	0A94CA4730B13C57D267A0D75C308C30D67ED448F372D994EEBDBC0FEEBB5CCF
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	656D5EDDD3DEF45673194EE2F73145C7	813890C1B563BC94C34A30543B47D86FA811CDAE	B13BB5040D86EE224D4993C8B0689402D2E41FCF165E9A35C4089D99C33FF0A8
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Unicode text, UTF-16, little-endian text, with CRLF line terminators	3B16E9648F3B7DAFA340BCC881915BFB	F8C0B28679B0C71FAAE77BE7CE81FE796E7E6E51	0114438C2EB5EB5DCEF887D31DC2D717F237254E8E83AD1E949660BF41C6AD45
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 8 17:06:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	92DCC9EFED97B2D072FAF5C0C721FFFD	1286B0235310C20656CAE09855E31D06E0F5A40F	79F35E0EFEFDE4DACFD3B7AE7CA589CD24E4854EE8AD7F1070CC5E9A6C7954C1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 8 17:06:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	1BD51096EDA61CF4A3FCC524D01E355D	2DBC222212366FBD5511B12642FD52B764A978E9	0326E642868FCD23C0FE6AC481CEB35A8ABD256B93A7CCEFB36E0C9A1153C16F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	A02622A1EABD381DEC1BDDBB2FF3D9F6	CB669AB5F3DA3EE0BC496F2BFCCDF7A05C337CA9	49DA3F42C7CA21255E1050BE22C0694E8B7799D1DFE2C0F3C77DF80A3FBAF3DA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 8 17:06:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	2AF1C727659B13E7988753BC0FA612F9	3E2EC90A530BE4F1EE1ECB33DC04EC9346165AC4	42CF0D96E085440823D1432427C935B247862DCC36132945347990733B9ED1EB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 8 17:06:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	2A65E2E5A25379ECF4AC7C421B51F4D2	B3CE7041BBE7A0BB79F76673F8DD96865671E9F6	5DD56F81F4EFB072EE9039191147C0E140CAE30080BC12C9439CCE9317AD87E4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jul 8 17:06:10 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	E4DEAB4AFFFBA79F33A43B937DFF1896	5011308759C0286F76E2B661309C26D3E6F7EBB0	D965E103EE7C8BE8CE0B8CD2EFE8AE2C3C07B05B6285CC178601736C8845E208
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	B6FC13C8E099E20FC08216734E659EB5	91A0EB6C160F5F31B4E60C3AB4AB17291E158D92	47EADCE81C9B8EB1A73D5867B00025F7FF6AEEE0F8918A4AE493FB206E6ABF25
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	001D792BFC921983B93AA3A30D263CC9	BDCF1258AB52590BA91163B0C13C78A8F6D4101E	FF5D86346D018D9D2236C151EDA3B3408510E8C486CD38F4A7D42D89F89C0294
Chrome Cache Entry: 100	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 101	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 40329	027A7D52E1CEED8AEF7DC13505B81D36	33CF0BCE6A4C8B44B4A80B3116C978C12EE93FD0	29061464FB6FCE2326B952EACAA95C3C6183BFEA74C3851390E9838720D372A6
Chrome Cache Entry: 102	ASCII text, with very long lines (45716)	B30F8CF0A915DFF9C1A2DF86D4899173	C25130FFF594491102820FB5AF395E15DD13F59E	23804C857C0F312172654571928D8945EB9585B94F6D4BE9C59A37EAE054C0FD
Chrome Cache Entry: 103	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
Chrome Cache Entry: 104	SVG Scalable Vector Graphics image	EE5C8D9FB6248C938FD0DC19370E90BD	D01A22720918B781338B5BBF9202B241A5F99EE4	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
Chrome Cache Entry: 105	ASCII text, with very long lines (64616)	2A3966738DAE2F401397FDB579873056	646C2AA679DE2C25E12BBBDFF0F6212BF7E4E35E	BA7BBEA9A5DD4776F3FA38C23A772CD97CC7A00A0F28D1D7232E10B2FF0655AD
Chrome Cache Entry: 106	ASCII text, with very long lines (35238), with no line terminators	C637DE6889D81964119BA1FD124E2454	5DB2B1681BE6FF9A7B26E269CD80D817D41A01BE	18E8366C8C5590C3D056BA6CA9691B7471D6970EE00D0E22A4B68E517B54F087
Chrome Cache Entry: 107	SVG Scalable Vector Graphics image	4E48046CE74F4B89D45037C90576BFAC	4A41B3B51ED787F7B33294202DA72220C7CD2C32	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
Chrome Cache Entry: 108	ASCII text, with CRLF line terminators	B45EDFC9FCDB690CCDA004A8483955E0	BAEDF73329EABB32504CAC640538EE3B6B31819F	E817BF53005172205995AA07E0021BD8254A0204A1177E925F365E838C32D069
Chrome Cache Entry: 109	ASCII text, with very long lines (456), with no line terminators	B51378EC459FA46F4EB3F8F9EF6F6282	96ADF1EC804C5FC4EE2CDC049BBDE92900930B81	5F193DCAF5DF3582A79AB0AC648A0899DF0F900276C5691F359583791C289BA8
Chrome Cache Entry: 110	ASCII text, with very long lines (65536), with no line terminators	EBEE9DDBDFEDA6929206BD7D1848774F	A5EF3CB32A42B2DA3B02734739593D9B4ACDC7AE	EA619681EF316E8DE1F670D2FF10A8148E3F22EC5A6C6077219031C2E4ACD536
Chrome Cache Entry: 111	ASCII text, with very long lines (23437), with CRLF line terminators	964FCB2BAF87049DC68975291AE89431	D0CD8C989D44BC531472B632868D3FB2DE4B3184	B8F7BD568E379502CF0C00027581D2761C7DC14B166F5D25FC048A0B56B7BFBB
Chrome Cache Entry: 112	ASCII text, with very long lines (43896)	13227E96A4880E89528DC59987588024	C117F18396FB045535A5335B0689EA80BC4212F4	81EFCD07A6D92AA2EC7EA10FAC13028E81070B271C8AD3DFC6B0BA572D501758
Chrome Cache Entry: 113	Unicode text, UTF-8 text, with very long lines (32049)	7E8F2B91CD7CAA78498785A7CC06EC0E	3C7A02EB6223223DFEE7FB94B53972DFEE7EA999	54EB78792CFC22E6B724ED2BE39DE23339022B2F044265FC98E3D437470C91C6
Chrome Cache Entry: 114	ASCII text, with no line terminators	06B313E93DD76909460FBFC0CD98CB6B	C4F9B2BBD840A4328F85F54873C434336A193888	B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA
Chrome Cache Entry: 115	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 116	SVG Scalable Vector Graphics image	4E48046CE74F4B89D45037C90576BFAC	4A41B3B51ED787F7B33294202DA72220C7CD2C32	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
Chrome Cache Entry: 117	ASCII text, with very long lines (65536), with no line terminators	DAC97EE30125293E65B392929458E642	78FE217D0EBCF11DDFDF3F47F9A80808468DBE92	954B7C4FFDC1F5D7762C6C53142116DF14B7E10A00AC21E3A875C1A836C969A0
Chrome Cache Entry: 118	ASCII text, with very long lines (2015), with no line terminators	63390150EFEBE2157A92B596B24B775C	0F2E0C3CDCE15A5EC6FBCAA5F91FBAD5F4288337	DF124BE49EE3C8B5403D7E3039F8FC2D5F790B96DC068BE636F11F48ECC93BA1
Chrome Cache Entry: 119	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759	3F98A175D5232F665BEFFC23352D7176	8413FCCF22CEBAAED144736F5415F09EFD45CE48	C6D80B97A3828280862163C72A94F5902F10D927FA1F6BDEAB5479B94F04F5AC
Chrome Cache Entry: 120	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	0B60F3C9E4DA6E807E808DA7360F24F2	9AFC7ABB910DE855EFB426206E547574A1E074B7	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
Chrome Cache Entry: 121	ASCII text, with very long lines (65536), with no line terminators	2DE2482829622DE740DB42E04CBCD047	2A88D65A01BDA232B97B24163F66BA7F90A63386	947D9E7117E8528021EC98FBBD6FE75A4D393A699DFFFFB3A2803EAE42845CEB
Chrome Cache Entry: 122	SVG Scalable Vector Graphics image	BC3D32A696895F78C19DF6C717586A5D	9191CB156A30A3ED79C44C0A16C95159E8FF689D	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
Chrome Cache Entry: 123	ASCII text, with very long lines (64612)	B6783C7717E4042517138D9C9A48C867	7A7D6B0F36C2A3B557F1A75461630D433E5F4942	4BE11C075187615ADAF493D54CB7B05556E76806AED2B3B082D72952D0025BE5
Chrome Cache Entry: 124	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 125	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 102804	B62553925BD98826C60457D2EB6B9A46	84DBBB6D9B36A587C21B5A56B1D9E587E33BA943	C58166FE4DF4BA8F25A960C21451EAF841D97F6F552F104E43431C9DB1C2E2CC
Chrome Cache Entry: 126	ASCII text, with CRLF line terminators	B4C432218BAA83A800E5DE0E86A901A6	F206E01A68EF8B57F48A24012D3610A83C2C08E8	CC89B306DA195769FEC7B1B648266DCCA5324A122EE407E3A60E93048E380FC2
Chrome Cache Entry: 127	ASCII text, with very long lines (61177)	302E4073AA25D25E03DA26AA4A94AD62	CBB8C69EC1FE0E5795DF9BD6C12B7837C61A81DC	8B81B6DBB9AF6502D78ABE8A85D135861848E0597989901DA42C62ECB841A07D
Chrome Cache Entry: 96	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	0B60F3C9E4DA6E807E808DA7360F24F2	9AFC7ABB910DE855EFB426206E547574A1E074B7	ADDEEDEEEF393B6B1BE5BBB099B656DCD797334FF972C495CCB09CFCB1A78341
Chrome Cache Entry: 97	ASCII text, with CRLF line terminators	90EA7274F19755002360945D54C2A0D7	647B5D8BF7D119A2C97895363A07A0C6EB8CD284	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
Chrome Cache Entry: 98	HTML document, ASCII text, with very long lines (3437), with CRLF line terminators	6635D7000669B3B00D3577DB7EE58F5D	7DB793D847EDC78B731185C85AD93BA4761D139B	4E52043A45804E7CDB6C9D09A0F64A4293082E6F32BB3D689BE4822A6E18BACB
Chrome Cache Entry: 99	HTML document, ASCII text, with very long lines (64257), with CRLF, LF line terminators	6D3FF525156FA41FF41214AF392B51F0	F13ED128AEA316ADB413205ED2EB0F31D51CC2D5	FC765A38C26319AB155CED8DAADBF643261287312FDD8AFE7648408401E0680F

Windows Analysis Report RE_ Whitney Walker shared _Insulation Supply Co Inc_ with you.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
RE_ Whitney Walker shared _Insulation Supply Co Inc_ with you.eml