Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FW Important Security Policy Update.msg

Overview

General Information

Sample name:FW Important Security Policy Update.msg
Analysis ID:1555939
MD5:8c67225141833c42886cfddd3e8de4fd
SHA1:2b26f82f7aeabcd3ea6dd807b0bceabb7d75bb64
SHA256:9bce3500938ba5e5cfd908127fac74ff84f33e80701e4e9284212ce50b55c398
Infos:

Detection

KnowBe4
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected KnowBe4 simulated phishing
AI detected potential phishing Email
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6880 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW Important Security Policy Update.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7112 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "9C0B6627-2B38-403D-879F-4A9B582726E5" "FB034C2D-0FA9-472D-A388-667D3E8EC4B6" "6880" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 5856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/qG95CL9mjxiRpjD5uBfgHy_mcS?domain=guru.phishing.guru MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 1036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1776,i,13163897212217618910,718162321116714265,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/chromecache_102JoeSecurity_KnowBe4Yara detected KnowBe4 simulated phishingJoe Security

    Sigma Signatures

    Sigma detected: Office Autorun Keys Modification
    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6880, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
    Sigma detected: Suspicious Office Outbound Connections
    Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.17, DestinationIsIpv6: false, DestinationPort: 49698, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 6880, Protocol: tcp, SourceIp: 185.15.59.240, SourceIsIpv6: false, SourcePort: 443

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    Phishing

    barindex
    Yara detected KnowBe4 simulated phishing
    Source: Yara matchFile source: dropped/chromecache_102, type: DROPPED
    AI detected potential phishing Email
    Source: EmailJoe Sandbox AI: Detected potential phishing email: The sender email 'noreply@updates-microsoft365.com' is suspicious and not a legitimate Microsoft domain
    Source: https://secured-login.net/pages/6ed3313ca504/XSUYzMVYwc2t4bjNlQ1R3WDRvTE94bVpNdWdwK3A3dC95eUt0K2xuYit2SmxwQVpTZVFKVlNhOFVVbHMzMWVkNXNXTGc2eDc1OUlhY3dndkYzVG9Fem5ZNzJKamkwQVFBT1pqK1JDYmd5MW55NXRXS1Y0WFNrSkgxRGR0RDJtSDBqTDJQUFg1YkFzdEhtblU0VzgxelErT28zeFlBK1NBQlU5aGw2WGxtdE5oNGlzT09laC9BcmkrV3VRPT0tLWJuNkYzYnZSNXF6dnlzTnUtLWtzbFZOV09uR3ZENlU0blNRaEVBY3c9PQ==HTTP Parser: No favicon
    Source: unknownHTTPS traffic detected: 185.15.59.240:443 -> 192.168.2.17:49698 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 52.7.5.107:443 -> 192.168.2.17:49699 version: TLS 1.2
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
    Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
    Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
    Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
    Source: global trafficDNS traffic detected: DNS query: upload.wikimedia.org
    Source: global trafficDNS traffic detected: DNS query: guru.phishing.guru
    Source: global trafficDNS traffic detected: DNS query: url.us.m.mimecastprotect.com
    Source: global trafficDNS traffic detected: DNS query: secured-login.net
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
    Source: global trafficDNS traffic detected: DNS query: s3.amazonaws.com
    Source: global trafficDNS traffic detected: DNS query: cdn2.hubspot.net
    Source: global trafficDNS traffic detected: DNS query: i.imgur.com
    Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
    Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
    Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
    Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
    Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
    Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49690
    Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
    Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
    Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
    Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
    Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
    Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49690 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49698 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
    Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
    Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
    Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
    Source: unknownHTTPS traffic detected: 185.15.59.240:443 -> 192.168.2.17:49698 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 52.7.5.107:443 -> 192.168.2.17:49699 version: TLS 1.2
    Source: classification engineClassification label: mal52.phis.winMSG@19/38@30/238
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241114T1101540920-6880.etl
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW Important Security Policy Update.msg"
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "9C0B6627-2B38-403D-879F-4A9B582726E5" "FB034C2D-0FA9-472D-A388-667D3E8EC4B6" "6880" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "9C0B6627-2B38-403D-879F-4A9B582726E5" "FB034C2D-0FA9-472D-A388-667D3E8EC4B6" "6880" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/qG95CL9mjxiRpjD5uBfgHy_mcS?domain=guru.phishing.guru
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1776,i,13163897212217618910,718162321116714265,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/qG95CL9mjxiRpjD5uBfgHy_mcS?domain=guru.phishing.guru
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1776,i,13163897212217618910,718162321116714265,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\InprocServer32
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
    Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
    Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
    Browser Extensions    		1
    Process Injection    		1
    Masquerading    		OS Credential Dumping1
    Process Discovery    		Remote ServicesData from Local System2
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/Job1
    DLL Side-Loading    		1
    DLL Side-Loading    		1
    Modify Registry    		LSASS Memory13
    System Information Discovery    		Remote Desktop ProtocolData from Removable Media1
    Non-Application Layer Protocol    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAt1
    Registry Run Keys / Startup Folder    		1
    Registry Run Keys / Startup Folder    		1
    Process Injection    		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
    Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
    DLL Side-Loading    		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    ⊘No Antivirus matches

    Dropped Files

    ⊘No Antivirus matches

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    cdn2.hubspot.net
    		104.18.90.62
    		truefalse
      		high
      a.nel.cloudflare.com
      		35.190.80.1
      		truefalse
        		high
        url.us.m.mimecastprotect.com
        		207.211.31.64
        		truefalse
          		high
          s3.amazonaws.com
          		52.217.118.144
          		truefalse
            		high
            cdnjs.cloudflare.com
            		104.17.24.14
            		truefalse
              		high
              www.google.com
              		142.250.186.164
              		truefalse
                		high
                upload.wikimedia.org
                		185.15.59.240
                		truefalse
                  		high
                  secured-login.net
                  		52.201.152.49
                  		truefalse
                    		high
                    landing.training.knowbe4.com
                    		52.7.5.107
                    		truefalse
                      		high
                      ipv4.imgur.map.fastly.net
                      		199.232.192.193
                      		truefalse
                        		high
                        guru.phishing.guru
                        		unknown
                        		unknownfalse
                          		unknown
                          i.imgur.com
                          		unknown
                          		unknownfalse
                            		high

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            https://secured-login.net/pages/6ed3313ca504/XSUYzMVYwc2t4bjNlQ1R3WDRvTE94bVpNdWdwK3A3dC95eUt0K2xuYit2SmxwQVpTZVFKVlNhOFVVbHMzMWVkNXNXTGc2eDc1OUlhY3dndkYzVG9Fem5ZNzJKamkwQVFBT1pqK1JDYmd5MW55NXRXS1Y0WFNrSkgxRGR0RDJtSDBqTDJQUFg1YkFzdEhtblU0VzgxelErT28zeFlBK1NBQlU5aGw2WGxtdE5oNGlzT09laC9BcmkrV3VRPT0tLWJuNkYzYnZSNXF6dnlzTnUtLWtzbFZOV09uR3ZENlU0blNRaEVBY3c9PQ==false
                              		unknown

                              World Map of Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public IPs

                              IPDomainCountryFlagASNASN NameMalicious
                              142.250.185.99
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              142.250.186.170
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              52.178.17.3
                              		unknownUnited States
                              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                              52.109.89.18
                              		unknownUnited States
                              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                              172.217.18.14
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              52.7.5.107
                              		landing.training.knowbe4.comUnited States
                              		14618AMAZON-AESUSfalse
                              104.18.90.62
                              		cdn2.hubspot.netUnited States
                              		13335CLOUDFLARENETUSfalse
                              142.250.185.227
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              52.109.68.129
                              		unknownUnited States
                              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                              52.205.64.62
                              		unknownUnited States
                              		14618AMAZON-AESUSfalse
                              185.15.59.240
                              		upload.wikimedia.orgNetherlands
                              		14907WIKIMEDIAUSfalse
                              207.211.31.64
                              		url.us.m.mimecastprotect.comUnited States
                              		14135NAVISITE-EAST-2USfalse
                              2.19.126.160
                              		unknownEuropean Union
                              		16625AKAMAI-ASUSfalse
                              52.111.243.42
                              		unknownUnited States
                              		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                              142.250.186.131
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              35.190.80.1
                              		a.nel.cloudflare.comUnited States
                              		15169GOOGLEUSfalse
                              52.201.152.49
                              		secured-login.netUnited States
                              		14618AMAZON-AESUSfalse
                              52.217.118.144
                              		s3.amazonaws.comUnited States
                              		16509AMAZON-02USfalse
                              52.113.194.132
                              		unknownUnited States
                              		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                              104.17.24.14
                              		cdnjs.cloudflare.comUnited States
                              		13335CLOUDFLARENETUSfalse
                              1.1.1.1
                              		unknownAustralia
                              		13335CLOUDFLARENETUSfalse
                              74.125.133.84
                              		unknownUnited States
                              		15169GOOGLEUSfalse
                              199.232.192.193
                              		ipv4.imgur.map.fastly.netUnited States
                              		54113FASTLYUSfalse
                              104.18.91.62
                              		unknownUnited States
                              		13335CLOUDFLARENETUSfalse
                              239.255.255.250
                              		unknownReserved
                              		unknownunknownfalse
                              142.250.186.164
                              		www.google.comUnited States
                              		15169GOOGLEUSfalse
                              184.28.90.27
                              		unknownUnited States
                              		16625AKAMAI-ASUSfalse

                              Private

                              IP
                              192.168.2.17

                              General Information

                              Joe Sandbox version:41.0.0 Charoite
                              Analysis ID:1555939
                              Start date and time:2024-11-14 17:01:16 +01:00
                              Joe Sandbox product:CloudBasic
                              Overall analysis duration:
                              Hypervisor based Inspection enabled:false
                              Report type:full
                              Cookbook file name:defaultwindowsinteractivecookbook.jbs
                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                              Number of analysed new started processes analysed:21
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:0
                              Technologies:
                              • EGA enabled
                              Analysis Mode:stream
                              Analysis stop reason:Timeout
                              Sample name:FW Important Security Policy Update.msg
                              Detection:MAL
                              Classification:mal52.phis.winMSG@19/38@30/238
                              Cookbook Comments:
                              • Found application associated with file extension: .msg

                              Warnings

                              • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
                              • Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.109.68.129, 2.19.126.160, 2.19.126.151, 184.28.90.27, 52.113.194.132, 52.111.243.42, 52.111.243.41, 52.111.243.43, 52.111.243.40, 52.178.17.3
                              • Excluded domains from analysis (whitelisted): omex.cdn.office.net, slscr.update.microsoft.com, weu-azsc-config.officeapps.live.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, login.live.com, e16604.g.akamaiedge.net, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, a1864.dscd.akamai.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, prod-eu-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, s-0005.s-msedge.net, config.officeapps.live
                              • Not all processes where analyzed, report is missing behavior information
                              • Report size getting too big, too many NtQueryValueKey calls found.
                              • Report size getting too big, too many NtReadVirtualMemory calls found.
                              • VT rate limit hit for: FW Important Security Policy Update.msg

                              LLM Input / Output

                              InputOutput
                              URL: Model: Joe Sandbox AI
                              {
    "explanation": [
        "The sender email 'noreply@updates-microsoft365.com' is suspicious and not a legitimate Microsoft domain",
        "The email contains phishing-like URLs (guru.phishing.guru in the links)",
        "The message creates urgency by requiring immediate action for 'security policy updates'"
    ],
    "phishing": true,
    "confidence": 10
}
                              {
    "date": "Thu, 14 Nov 2024 01:21:17 +0100", 
    "subject": "FW: Important Security Policy Update", 
    "communications": [
        "External Sender:\n\n________________________________\n\n\nIm wondering if other staff receive these as well and if staff should apply update or should we send out an email that its done in another way?\n\n \n\nTammy Busch\n\nAssistant Superintendent of Business Services\n\nCertified School Risk Manager\n\nRiver Delta Unified School District\n\n707-374-1715\n\ntbusch@rdusd.org <mailto:tbusch@rdusd.org> \n\n \n\n", 
        "From: Microsoft 365 <noreply@updates-microsoft365.com> \nSent: Wednesday, November 13, 2024 3:18 PM\nTo: Tammy Busch <tbusch@rdusd.org>\nSubject: Important Security Policy Update\n\n \n\n <https://upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/1024px-Microsoft_logo_%282012%29.svg.png> \n\nImportant Security Policy Update\n\nHi Tammy Busch,\n\nA new update was recently released for one or more Microsoft services currently active in your account tbusch@rdusd.org <mailto:tbusch@rdusd.org> .\n\nVersion Release Date: November 13, 2024\nVersion Release Code: 23407142\n\nYou're required to accept the updated policy changes to continue using your account securely.\n\n \n\nApply Update <https://url.us.m.mimecastprotect.com/s/qG95CL9mjxiRpjD5uBfgHy_mcS?domain=guru.phishing.guru> \n\n \n\nMicrosoft 365 Mobile & Desktop Apps Security Patch\n\nWe've released a major security patch to the following update channels for Microsoft 365 Apps: Azure SSL/TLS Security Certificate. When will this happen: We'll be gradually rolling out this update of Microsoft 365 Apps to users on the update channel.\n\nIf you have any questions about this update, please let us know <https://url.us.m.mimecastprotect.com/s/qG95CL9mjxiRpjD5uBfgHy_mcS?domain=guru.phishing.guru> .\n\nThank you,\nMicrosoft 365 Security Team\n\n <https://guru.phishing.guru/XZUd2ZXlxLzNlUGc1d0NKWkJBYWo5YmFEYSt0ZzM2R3djTm5iS1JYdS93YW5hN1p6ZGlkeVcyRGV0VnJadjNpbVl1V0JmTUcxREJuRHUvbUVCK1c1dGdtRnlZbEQ1S2thZi8rOUtRekcraVJwSXJOWS9zRHl1dz09LS1VNmdTRHNPTEh2YUYxeWQ5LS05RFcwVktJSkhHQU94alBBdmlpNXlRPT0=?cid=2279533539> \n\n"
    ], 
    "from": "Tammy Busch <tbusch@rdusd.org>", 
    "to": "Gabriel Espinoza <gespinoza@mydatapath.com>", 
    "attachements": []
}
                              URL: Email Model: Joe Sandbox AI
                              ```json
{
  "contains_trigger_text": true,
  "trigger_text": "You're required to accept the updated policy changes to continue using your account securely.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false
}
                              URL: Email Model: Joe Sandbox AI
                              ```json
{
  "brands": [
    "Microsoft"
  ]
}
                              URL: Model: Joe Sandbox AI
                              {
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}
                              URL: https://secured-login.net

                              Created / dropped Files

                              C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:data
                              Category:dropped
                              Size (bytes):231348
                              Entropy (8bit):4.393832477485484
                              Encrypted:false
                              SSDEEP:
                              MD5:B1897DD53D51B6F09E4FDF9D278E0395
                              SHA1:8BA0D0AEC584EC840BB40775F75F97221AD941FE
                              SHA-256:6EFB8B7567A884BE78B3454B60EFA77B133D03034CB74E361767EFB3C9D8E9E5
                              SHA-512:09A3057FF74AFDC1B6BEA0D6C4F7E3BE55BE557636B33BD427714EA4E6152AA2FF0674CC613447D3D08DCF1624DC473E6C7504056265387E8466ECACA00C1927
                              Malicious:false
                              Reputation:unknown
                              Preview:TH02...... ....x.6......SM01X...,......w.6..........IPM.Activity...........h...............h............H..h.o......k+k...h............H..h\tor ...AppD...h.s..0... .o....hWr*............h........_`.k...h.l*.@...I.+w...h....H...8..k...0....T...............d.........2h...............k..............!h.............. h..Z.....8.o...#h....8.........$h........8....."h........`.....'h..=...........1hWr*.<.........0h....4.....k../h....h......kH..h..p....o...-h .......d.o...+h.r*.......o................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                              C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
                              Category:modified
                              Size (bytes):1869
                              Entropy (8bit):5.088156953232603
                              Encrypted:false
                              SSDEEP:
                              MD5:773A03DBAA8EF4BFEAC942D3F9ECF997
                              SHA1:A967792CE67ECEABBC9D2986CF3BE61B5FD2C803
                              SHA-256:D8274EC73C45AA81FE8F1FD81B0E31B2251CD5DF3B624642B2024D05AD777E2F
                              SHA-512:9DFF78C9EA04BEEB89D8E3113D76269B8315EC5237018678BA62523DA05F99472000034B8697F792A8218912DC59B889D692BB271E13231CCF9212544399011D
                              Malicious:false
                              Reputation:unknown
                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-11-14T16:01:56Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:55:52Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:55:52Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215426</Id><LAT>2023-10-06T09:55:52Z</LAT><key>37262344671.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-06T09:55:52Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:55:52Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_

                              C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:JSON data
                              Category:dropped
                              Size (bytes):521377
                              Entropy (8bit):4.9084889265453135
                              Encrypted:false
                              SSDEEP:
                              MD5:C37972CBD8748E2CA6DA205839B16444
                              SHA1:9834B46ACF560146DD7EE9086DB6019FBAC13B4E
                              SHA-256:D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
                              SHA-512:02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
                              Malicious:false
                              Reputation:unknown
                              Preview:{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

                              C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
                              Category:modified
                              Size (bytes):773040
                              Entropy (8bit):6.55939673749297
                              Encrypted:false
                              SSDEEP:
                              MD5:4296A064B917926682E7EED650D4A745
                              SHA1:3953A6AA9100F652A6CA533C2E05895E52343718
                              SHA-256:E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
                              SHA-512:A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
                              Malicious:false
                              Reputation:unknown
                              Preview:........... OS/29....(...`cmap.s.,.......pglyf..&....|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N......*...!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&........*......&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q...............*...{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...*p..

                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:ASCII text, with very long lines (65536), with no line terminators
                              Category:dropped
                              Size (bytes):322260
                              Entropy (8bit):4.000299760592446
                              Encrypted:false
                              SSDEEP:
                              MD5:CC90D669144261B198DEAD45AA266572
                              SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                              SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                              SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                              Malicious:false
                              Reputation:unknown
                              Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:ASCII text, with no line terminators
                              Category:dropped
                              Size (bytes):10
                              Entropy (8bit):2.321928094887362
                              Encrypted:false
                              SSDEEP:
                              MD5:BF37BF1CD96CBC96B3CD26020ECAAC12
                              SHA1:B6AE00B7B51E7585D67861CE03FFF8EBE042B3DE
                              SHA-256:E0D1278238D93499BF2BCD30672023B1A2F39C01515C572B817BAD03C1F57F64
                              SHA-512:1396FFB7BE1625420712606F8F26B3C75915285C1B328571BC718F3220453F33B5265EC23F46F42FF2ACFEED4379B953AB92C76751900FC78161964C30A6D72B
                              Malicious:false
                              Reputation:unknown
                              Preview:1731600121

                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5710B3B5-1F67-422F-A65D-82411643EF22

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):180288
                              Entropy (8bit):5.291004143401601
                              Encrypted:false
                              SSDEEP:
                              MD5:E33CB69A5DE6649126BB07D426559629
                              SHA1:240F7C446F3D2ED6385F854ADBF1A4816AE91730
                              SHA-256:310148404671476E21BBC98039000CAF3F92DDA519DEE8F1FE0FF758D5A25479
                              SHA-512:FAD1FCF1F2AFDC84A4093FB6AD062C08E28B3D4817B927C88088F177D57ED32D9A792904728B05D9FC8B7CB9640E74D5D75874F76DA963FC11A69655B203AFC8
                              Malicious:false
                              Reputation:unknown
                              Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-11-14T16:01:57">.. Build: 16.0.18223.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:SQLite Rollback Journal
                              Category:dropped
                              Size (bytes):4616
                              Entropy (8bit):0.13640804182083316
                              Encrypted:false
                              SSDEEP:
                              MD5:86E6B47D0D2799C82B3D5CCE61443E25
                              SHA1:75940F7089296F6B556ED6AB3DD1242F15A88D38
                              SHA-256:821DD42C2DCBD90D6635138F328C899C2857FE9884930C477D8EC11A0AA83033
                              SHA-512:8D7607371C709F196E19B8E97D33A4C97FC4657D681B606CCD708ED4A8D47D9B408F95654B0B5DEC9D6F1D502EDBDAC9C91A1C2D17E98E82C8D3637AB4BC7590
                              Malicious:false
                              Reputation:unknown
                              Preview:.... .c.....o.kc....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\96LGQ1XY\Microsoft_logo_(2012).svg[1].png

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:PNG image data, 1024 x 219, 8-bit/color RGBA, non-interlaced
                              Category:dropped
                              Size (bytes):18274
                              Entropy (8bit):7.824973851637045
                              Encrypted:false
                              SSDEEP:
                              MD5:DAF0E34199D200E2C7BA15BC8CE1BB4C
                              SHA1:CB50C8AF6422F9023C77EEF33F3E02B187D5C28A
                              SHA-256:2EA031BFBAC97B6FAE94B02DB9A625BF38F83BA7D39FD1B6C233B4D240A3B578
                              SHA-512:80D73B5C8BF0725164C66F395858FF670BFEC48D09D18D1B149269663ECE1C980998BF8C6DDEBBB033019A316F3E40EC8A56F6E67A49A057E56C9C7AD553E0C1
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR...............|....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME.....20...l..FfIDATx...y|.e....wf...E.) .-". ..R..* .@-X.dw&.U.:....`..."r.,.."..r...........Mv...l.U.......~...!yf..|wv..<......bI..\.....o.....Q.i_*f}..\.H.....Q.8...........DDDDDDD............@DDDDDDD,...........DDDDDDD............@DDDDDDD,..........@DDDDDDD,...........DDDDDDD............@DDDDDDD,...........DDDDDDD............DDDDDDD............@DDDDDDD,...........DDDDDDD............@DDDDDDD,..........@DDDDDDD,...........DDDDDDD............@DDDDDDD,...........DDDDDDD............`........V......!"..........TUm..I._-......JU...U../"o..s.~......+Y. """""".....).Ba..|JU.Q...@U..wE.?..~.......t:}u............Qe....P.B.p(....I.q.#.1.,.......Q,.A.....$"....#..........T*.{.E=".'...........9s.4O.8......F.|..@"".w0s.L7......*$.N.<q..G..........@[[[SSS..z..}EdCU]?."x.......ADn+........5""...}.xU..@.......Q..=..........n.......k^..AU=.q.A..T...r..2.DDDc.

                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\XZUd2ZXlxLzNlUGc1d0NKWkJBYWo5YmFEYSt0ZzM2R3djTm5iS1JYdS93YW5hN1p6ZGlkeVcyRGV0VnJadjNpbVl1V0JmTUcxREJuRHUvbUVCK1c1dGdtRnlZbEQ1S2thZi8rOUtRekcraVJwSXJOWS9zRHl1dz09LS1VNmdTRHNPTEh2YUYx[1].gif

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:GIF image data, version 89a, 1 x 1
                              Category:dropped
                              Size (bytes):43
                              Entropy (8bit):2.7374910194847146
                              Encrypted:false
                              SSDEEP:
                              MD5:07FFF40B5DD495ACA2AC4E1C3FBC60AA
                              SHA1:E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
                              SHA-256:A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
                              SHA-512:49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
                              Malicious:false
                              Reputation:unknown
                              Preview:GIF89a.............!.......,...........D..;

                              C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:data
                              Category:dropped
                              Size (bytes):30
                              Entropy (8bit):1.2389205950315936
                              Encrypted:false
                              SSDEEP:
                              MD5:5237846606AC2FEA44AFA0131C0B8111
                              SHA1:7AC10DB129621C5A9E98D748AE84D319EF97839C
                              SHA-256:820DF1B6A7B1A32E9BA02C98BA33B19510624C5657E878EC2C755929C312D280
                              SHA-512:A913B003383B202F278280722454D2C6E67E2150A5128D11F6F2385E776E730B628F5303151354DED0AB85063B9B67CB57439744CA6AA9E8CA48FD75A6215E68
                              Malicious:false
                              Reputation:unknown
                              Preview:..............................

                              C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

                              Download File
                              Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):18
                              Entropy (8bit):2.725480556997868
                              Encrypted:false
                              SSDEEP:
                              MD5:A5E51FDFAF429614FB5218AB559D299A
                              SHA1:262EC76760BB9A83BCFF955C985E70820DF567AE
                              SHA-256:3E82E9F60CE38815C28B0E5323268BDA212A84C3A9C7ACCC731360F998DF0240
                              SHA-512:9B68F1C04BDE0024CECFC05A37932368CE2F09BD96C72AB0442E16C8CF5456ED9BB995901095AC1BBDF645255014A5E43AADEE475564F01CA6BE3889C96C29C9
                              Malicious:false
                              Reputation:unknown
                              Preview:..t.o.r.r.e.s.....

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 14 15:02:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2677
                              Entropy (8bit):3.988946852519709
                              Encrypted:false
                              SSDEEP:
                              MD5:8C87DB8A678942D54289E199C942F321
                              SHA1:43B5465CE9FCD110C87F431CE7C753EA0B9E88B8
                              SHA-256:5095B69BDA1032DB969CC03A1F3459EDCE6D3AA3CAFB27BF8672E56DE2167DF2
                              SHA-512:34A9D790BC297A37F13B67EEB1EDC28660DD8B2E865D97150DA9C5E1F248A5D9FBC27800F767400AFB030995B653D72310B0C173C8557F64F9FA25177E269FE5
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....K.;..6......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.InY/.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VnYX.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VnYX.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VnYX............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VnYY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r.~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 14 15:02:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2679
                              Entropy (8bit):4.004692993896903
                              Encrypted:false
                              SSDEEP:
                              MD5:7CD6662A17B8832ACD3A36BA31A2EF16
                              SHA1:4DE65B3E61410E4E87F7A1B86830D0AE490EAA90
                              SHA-256:C851FAC15742D60C1DFD1E9252011F94EC7F3B3FA7841A7B7E12A0A80985709A
                              SHA-512:1B4CF77FC3806B62AF8EE939AB4DA656CA9EDE40331157D26AFCF36BBAC2D3F1338F8F4614EC7FBBF8FA9140D9B735CB444B0C04C72810766DE4FF116F68E43E
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....0.,..6......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.InY/.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VnYX.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VnYX.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VnYX............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VnYY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r.~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2693
                              Entropy (8bit):4.015688416431899
                              Encrypted:false
                              SSDEEP:
                              MD5:23BB35A1AD6263623263340DC34D425C
                              SHA1:EA6063062A7C50A6858E7835B2011F660E16135B
                              SHA-256:EF38939ADF5A4F75DE5EF1BBFD69738F8A3ED40D2D59C72A83157AAF5CA4DC9C
                              SHA-512:94C2122E774A4A698D729D29DB1CD5B5A30362BBEB91AC5310542150C915BDD4DBD62C1D5075C2F9E7370530B25E3548217372199017AEF981BDA0FF84D6ADED
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.InY/.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VnYX.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VnYX.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VnYX............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r.~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 14 15:02:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2681
                              Entropy (8bit):4.005495238478
                              Encrypted:false
                              SSDEEP:
                              MD5:DDE2EDEEE55C7A2F3B962FF6CA2237DD
                              SHA1:B11E1F59FF343FCDFE675ECC903F290FDB69228A
                              SHA-256:163C8106AB1A245AC33EC4C00489C0D3AEB76B90335414AAF5C4D4DA48B5305C
                              SHA-512:1CD69308AA8DBECCF0E5323B194F27D731AFC1E3F06E5A486AFAD4E5D991477E2C5336FFA888A2BB3FA73311AE71C85832240C4D4347FAC7B1D177C2307CE2FD
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,......%..6......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.InY/.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VnYX.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VnYX.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VnYX............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VnYY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r.~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 14 15:02:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2681
                              Entropy (8bit):3.9913371098611985
                              Encrypted:false
                              SSDEEP:
                              MD5:2A13E3EBC3842D17C51254B5F1F8006A
                              SHA1:A232A92119D9D9F18F6C7BE7FB919B43D3C84B30
                              SHA-256:1CDFA9D8B765170CA85B6B5DC295E155823F2E16AF945B04CCB2B05490ABB475
                              SHA-512:023CFB2EE2D4351C881D2A674DBAE0A6053285CF6A043152F68C97F7149E965B9F40DFB0C8FBA9394859C2DF1FC5E198E8BEB46C27D98013DA33F44B542113DD
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....0$4..6......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.InY/.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VnYX.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VnYX.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VnYX............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VnYY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r.~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 14 15:02:49 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                              Category:dropped
                              Size (bytes):2683
                              Entropy (8bit):4.001235136060414
                              Encrypted:false
                              SSDEEP:
                              MD5:5DE8F8904EEBFD65E953BF27DBADF055
                              SHA1:B82B13D8E6E9A73DE67671358B250320A9798166
                              SHA-256:D200467496C0D3688AA30BFCEC641B03E28AF61C9D1D019414247609CE0F8B9B
                              SHA-512:0C9E87267365A3C9140297DA5BE45AF9A7082C2171AD1ACC83702ADA59D527B5DEC63C0E0FC45FE4BFF73D8E314DD89B4985F04E6E33DFEA4716A0D8C619A981
                              Malicious:false
                              Reputation:unknown
                              Preview:L..................F.@.. ...$+.,....4....6......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.InY/.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VnYX.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VnYX.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VnYX............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VnYY............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........r.~.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                              Chrome Cache Entry: 100

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:HTML document, ASCII text, with very long lines (407)
                              Category:downloaded
                              Size (bytes):461
                              Entropy (8bit):5.855526239618312
                              Encrypted:false
                              SSDEEP:
                              MD5:63CFBF5C2BE9A094EB65F01267B10952
                              SHA1:283F50122AB8CC6DF3EC01339FB4A7014F296E20
                              SHA-256:9F822A2C00679AEA6C6A7DA41548C8C785476598EC212D5F9148D010915FD51F
                              SHA-512:AC082F8DB586DB35349596984B40F50496EE49D54E165AD019247140D4E20358A547135FD0CEBC025446AD0F80413739F005C2FEACCE0429C4B47AC111EAD9FE
                              Malicious:false
                              Reputation:unknown
                              URL:https://guru.phishing.guru/XSUYzMVYwc2t4bjNlQ1R3WDRvTE94bVpNdWdwK3A3dC95eUt0K2xuYit2SmxwQVpTZVFKVlNhOFVVbHMzMWVkNXNXTGc2eDc1OUlhY3dndkYzVG9Fem5ZNzJKamkwQVFBT1pqK1JDYmd5MW55NXRXS1Y0WFNrSkgxRGR0RDJtSDBqTDJQUFg1YkFzdEhtblU0VzgxelErT28zeFlBK1NBQlU5aGw2WGxtdE5oNGlzT09laC9BcmkrV3VRPT0tLWJuNkYzYnZSNXF6dnlzTnUtLWtzbFZOV09uR3ZENlU0blNRaEVBY3c9PQ==?cid=2279533539
                              Preview:<html>. <head>. <script>window.location.href = 'https://secured-login.net/pages/6ed3313ca504/XSUYzMVYwc2t4bjNlQ1R3WDRvTE94bVpNdWdwK3A3dC95eUt0K2xuYit2SmxwQVpTZVFKVlNhOFVVbHMzMWVkNXNXTGc2eDc1OUlhY3dndkYzVG9Fem5ZNzJKamkwQVFBT1pqK1JDYmd5MW55NXRXS1Y0WFNrSkgxRGR0RDJtSDBqTDJQUFg1YkFzdEhtblU0VzgxelErT28zeFlBK1NBQlU5aGw2WGxtdE5oNGlzT09laC9BcmkrV3VRPT0tLWJuNkYzYnZSNXF6dnlzTnUtLWtzbFZOV09uR3ZENlU0blNRaEVBY3c9PQ==';</script>. </head>. <body>. </body>.</html>.

                              Chrome Cache Entry: 102

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:HTML document, Unicode text, UTF-8 text, with very long lines (2164)
                              Category:downloaded
                              Size (bytes):114165
                              Entropy (8bit):6.022852019067385
                              Encrypted:false
                              SSDEEP:
                              MD5:310989861B779448774B1FC3330362AF
                              SHA1:1F768A85EC485E31C893C659E7A95B54DD009E94
                              SHA-256:9C450EC04157C7CFCDCF563E3D2D6E10C0F779DC3A1B367A3415E4B4EE27E30E
                              SHA-512:9C6BEED9226E1811548B9C5FA2DBFCA8DD409996AB2A09CF0B726DEE5CFFB6B4B91867BABCC6DBBE274E2579548863B296F59C73140DD892DE55023422A2DCA1
                              Malicious:false
                              Reputation:unknown
                              URL:https://secured-login.net/pages/6ed3313ca504/XSUYzMVYwc2t4bjNlQ1R3WDRvTE94bVpNdWdwK3A3dC95eUt0K2xuYit2SmxwQVpTZVFKVlNhOFVVbHMzMWVkNXNXTGc2eDc1OUlhY3dndkYzVG9Fem5ZNzJKamkwQVFBT1pqK1JDYmd5MW55NXRXS1Y0WFNrSkgxRGR0RDJtSDBqTDJQUFg1YkFzdEhtblU0VzgxelErT28zeFlBK1NBQlU5aGw2WGxtdE5oNGlzT09laC9BcmkrV3VRPT0tLWJuNkYzYnZSNXF6dnlzTnUtLWtzbFZOV09uR3ZENlU0blNRaEVBY3c9PQ==
                              Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">. <meta name="IMPORTANT" content="This page is part of a simulated phishing attack initiated by KnowBe4 on behalf of its customers." />. <meta name="IMPORTANT" content="If you have any questions please contact support@knowbe4.com." />. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"/>. <meta name="robots" content="noindex, nofollow" />.. <head>. <script src="/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js"></script>.. <link rel="stylesheet" href="/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css" media="all" />. <link rel="stylesheet" href="/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css" media="all" />.. <script>.//<![CDATA[.. $(document).ready(function() {.

                              Chrome Cache Entry: 104

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
                              Category:dropped
                              Size (bytes):3168
                              Entropy (8bit):7.704911325185365
                              Encrypted:false
                              SSDEEP:
                              MD5:A907E6E737788176B026FA71DFE8AFFE
                              SHA1:6844236F638CEDCD652EB0A805476A1A13376CF5
                              SHA-256:FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
                              SHA-512:3A17E66931A15B5C6553DAE241C5A7BB40240699F0608F92ED940CB203CBEA3031CB0FAC23F9C962F50D573F56DB27A3369F1A38ED1AEA0168D7E707803CA27A
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR.............>U....'IDATx..].\...e.!.H..B/J."""R..R....E)"../..".H..3s......&.O....d.QJ.L......P.m.U..u.Q..$.....}.5..M.....{.y.!A...|.|...3{.-M....m..~~....0.a...0..`...0........C...!`...0.a...0..<.z......w.tt<X.f..f.O.f./.(QK&s.t.{..z+.T..J..r.....3.....<r..../..Z.}.`..^.gGF6....p%.y^.,.R.....dr.c6/....w_[^........#G.j.7x...?.N.l..k.}...0< a..'.M...XO&g.....to......B..q~.......{....:...^H*QT..m..x.'..K}}.eu.&a........a..{...o..8.".-`Yi.p..zs........l........X-..tt<..=N&...H....&^...eE^M.9...U..gd..D;....gw.xL{.E.1..}}.+Q..U.......x.rO....V.8.,.n.p{...+............m...V.8.|~``.\.........[.......>s...r......v$.+ctq...B{.A....L...j..T..K...b.V.y.M.Z....7T..8...e-.>...u...&`)..|...... .....2...d....=:.N.~.....g%..x..5...7..-.l.e.........Y.u..=..l-...s.&.......r.vx.....{..e....).<1S(.\{>j.....+5.....kO...|"Q-.r.k.I..........]i..!...W..._...=7[.[uo....sk....t[..B.a....\...X......7..\.96...F..]..]...M{.6..!..lv...V..C..p5..q.f

                              Chrome Cache Entry: 105

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text
                              Category:downloaded
                              Size (bytes):5934
                              Entropy (8bit):4.931906350831601
                              Encrypted:false
                              SSDEEP:
                              MD5:134D934420B13974981A9634B7380865
                              SHA1:18C01D3711CF8C21C1CD0CF544002358C1C929C6
                              SHA-256:B3C447F15FCE33DFA869B9D2190364509EDE3937AE05B51BA394A78E28C244BA
                              SHA-512:7FAE93AD1895DCF7CC58FC2C477BA51D3EB7D7B2884FE117E21C0A7E0160981EB53D23A6ACDA07DA594AF6984F52E1B57B6F157F84220729C7EEBF9AE062C092
                              Malicious:false
                              Reputation:unknown
                              URL:https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css
                              Preview:/* line 2, app/assets/stylesheets/sei-styles.scss */.x-sei.sei-flag {. border-bottom: 2px solid tomato;. padding-left: 3px;.}../* line 6, app/assets/stylesheets/sei-styles.scss */.x-sei.sei-flag::before {. content: ' ';. display: inline-block;. background: url(/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png) no-repeat;. background-size: contain;. height: 12px;. width: 12px;. margin: 0 .1rem;.}../* line 16, app/assets/stylesheets/sei-styles.scss */.x-sei.sei-flag[generic='true'] {. display: block;. border-bottom: 0px;.}../* line 21, app/assets/stylesheets/sei-styles.scss */.x-sei.sei-flag[generic='true']::after {. font-family: "Courier New", Courier, monospace;. line-height: 1.8;. color: #b65555;. font-weight: bold;. content: attr(data-original-title);.}../* line 29, app/assets/stylesheets/sei-styles.scss */.x-sei.sei-flag[generic='true']::before {. content: ' ';. display: inline-block;. background: url(/assets/dark-flag-2846d82c5

                              Chrome Cache Entry: 106

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
                              Category:downloaded
                              Size (bytes):18668
                              Entropy (8bit):7.988119248989337
                              Encrypted:false
                              SSDEEP:
                              MD5:8655D20BBCC8CDBFAB17B6BE6CF55DF3
                              SHA1:90EDBFA9A7DABB185487B4774076F82EB6412270
                              SHA-256:E7AF9D60D875EB1C1B1037BBBFDEC41FCB096D0EBCF98A48717AD8B07906CED6
                              SHA-512:47308DE25BD7E4CA27F59A2AE681BA64393FE4070E730C1F00C4053BAC956A9B4F7C0763C04145BC50A5F91C12A0BF80BDD4B03EECC2036CD56B2DB31494CBAF
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
                              Preview:wOF2......H...........H..........................|.....h.`?STAT^..0..|...........+..2..6.$..`. ..x........z'o..w;....6.E....6....E...'$H.#.....n1X..JU/.d.O..JC.'J".v.v.l.h.....u.S...SY.....B.hz.o.}......W......%m6...A..=....\..m. .]..~.[..........]...I.*.h.=.....6.xt..F....Lt...Qs-.7..{...~BI.".F.Q......F...P..dMw..#I2........Rq.Q&.0@.;..;...3VG..:c.nki..-Q..2##e.u...8n....\?....T..b....^..#...../.J|OM..St....e.S.}!.....>..i.T/a.ES%.W.P3..`..a.R.A.....!~g..74.np8o.....d[6?.P.4)P.....AG.3.......;#0.y....M..O/2.@.4..N.vA$.:M&H,.AT".........@..a.~..L->...0@h...~.._..N"......t......C./g7..............2E.N.J...TW.F..."A.B...n.......i.?.{\.L.!*.B..x...S..!........?.\,... .@.....y"xw.A8.w..!E..-^P O..+.T.r.R.zz..K..].E.....Ri.)g.P...j..w..c.M.F.v../........Q....'...(....X..;.K.!BZ3.........f.....N.A(....cA`.b'...`.~sa*^.....?..../.L.S......t..`@h..C.....>N.W...;>..._h.+~=|......uOGA{.7.....h....q.d.4$.x<.....^0|...@....@Q[RC.0....b....'...*RID

                              Chrome Cache Entry: 107

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
                              Category:dropped
                              Size (bytes):1666
                              Entropy (8bit):7.843362903299294
                              Encrypted:false
                              SSDEEP:
                              MD5:29D583007FCD677AA31CA849478BC17A
                              SHA1:F354E323218A450060852C344927C3E79D8E7B66
                              SHA-256:120EE096F38C1E21083054C15F0F8CFBB02B6740A01D98068E3BE9581E83D453
                              SHA-512:4AFC2641D96D1C372D091FD795D39C1AF12149B5EB30DA7BEE6FBFEA0650841067B7D259473BF65706CDD42D1EDF1CC5673B5F5556D1E91F8AE32976490A7E4D
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR...<...<.....:..r...IIDATh..{.VE.....Y.E.......Uv.B....=. *{....ee....G.%....H/).UR1[.G...d...._m......~:.|.13..~.e.;s...;g......&g.@..w.G..K......{.u+..^...k.....s+...e..R.z...."..............l.z......C.......V.#.}.5(..f5.N`.......e&3".x..g..w..C.......T|...v"w..Q>-(/2.x.A.L..!....r..noB..g|...|.\....U.T...<3.N-...rU.bp%.<.CE........k....0C..|.Sw~.g....!....uf+y.KG.O+Y.h&.....F.......sB...7.|;.r|..\o......;.$...i.wC.ICO.n.h....AJ.N.+.T).........)9..y..?.hs%.".B..k....#.S.....:..!o..Z...|.w2....a..+y.e;..A...x.p+2G/!..1..jTr.S...S.....D.<.G.z.+2..E..>.Z6L.......e.2..R..3...~..%.C.!..f..s.'.;.M...5..k.1..L._B.vA_|.c{......{....*...d...Y.'Q.TS:.7.......|...,.:..-...#.V.*NA..&...iO.....SEE.kW!.y.p.y.m..6b..@=.,.n..i,....q..W...w.f..bg.`|......3.:.K.<..I.[....a..}..%_....{...~..j...)......n}m[...u...._....{....,.t.[ ..g.....&.v.j..2.r5.r5.B..jp..v-.j./.....c.s..$q@..z...oo..g?.z...%..gW.......}.6h....U....o.u.])]..@B);.o.V

                              Chrome Cache Entry: 108

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Web Open Font Format (Version 2), TrueType, length 11116, version 1.0
                              Category:downloaded
                              Size (bytes):11116
                              Entropy (8bit):7.977966003020195
                              Encrypted:false
                              SSDEEP:
                              MD5:7E05F5267BBA1AA9FB260096F923BDB7
                              SHA1:44E5FE17DC41EB94BB2FE85D77C0904AC766325D
                              SHA-256:21E75944D3F77408D1F5F2FAB67C89C7FC43F4A80A3B8E4DCF38185F9D9F46E6
                              SHA-512:E3442FC98D171DFE08614751267C2023BF6DE2A2E42BE7B7CB54E15DDBE028534D193D93B086A75549432B2818B0EC1824D2BDBB848B00A9329F22C5DDDE619F
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2
                              Preview:wOF2......+l......Q...+..........................>.....X.`?STAT^.."..|.......(.%.....6.$..6. ..x..R.....Iu...8@.}.G"....~x5.`....J.......t.Tm.....*"....*...e..........C..9.9..R...F?..x.i...._.x.<%2R...d...y........{.om......Oe..u..3Z.....x...#4.I..ES...8=........,...Y.^ ...2.=@...a...a..0.P..#w3.'F...b.,l.........1..".......IB.....b.......e......X....?D.[...iK.....$.F.......nM......4..@M......u../.#.C.X.TC3z.n.Wx...........=...@...t.I..UR....6.v...3...X.~i+..s..J.V.Y...g..Kun.IZ,....%O.u..3.(.+B~.)....M(6r.m......>x..p.MZL....P.Z>....@.*..M.0..5....@\.D.&..H. 2M...N..f.E.UM....B).).m.1.J......'.=D....Z.6.{.5..q......4.T.$:=...r....5..3s..zD[.i ......x.Mtq.|.#G......._.9P=}..PG.a......l8V.m...P.#..5..6R....`.<K}k.a..a....D.6..A.l...e.F...Z..0...7.0...^.....n`p..o.`.........4F.....H.1.).lh.....u..3WB4.$.............E......Z.{..{.[]...E.m.{.V^kZ..J.y?.w.m......o.k.j<.}...g. 7...-3}C?....<..\..ld9s..p...p..3%....>...F;...6..h.Z..GKh>...k.S..V....

                              Chrome Cache Entry: 109

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (65447)
                              Category:dropped
                              Size (bytes):380848
                              Entropy (8bit):5.202109831427653
                              Encrypted:false
                              SSDEEP:
                              MD5:67A0C4DBD69561F3226243034423F1ED
                              SHA1:88C1B5C7EBBFA24D8196290206BF544F28EEB406
                              SHA-256:74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
                              SHA-512:D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
                              Malicious:false
                              Reputation:unknown
                              Preview:/*! jQuery v3.7.1 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n||C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

                              Chrome Cache Entry: 110

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text
                              Category:downloaded
                              Size (bytes):1471
                              Entropy (8bit):4.754611179426391
                              Encrypted:false
                              SSDEEP:
                              MD5:15E89F9684B18EC43EE51F8D62A787C3
                              SHA1:9CBAAACEAE96845ECD3497F41EE3B02588ABEC11
                              SHA-256:16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
                              SHA-512:79E0110A045F28437D192290AC9789270CB0D4E676A985564746DB439992D867BA89639D7738E2A7F7D83BBF37D9A02CAA2AE1DC4E0EE2519797E5840A47FABE
                              Malicious:false
                              Reputation:unknown
                              URL:https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
                              Preview:/* line 1, app/assets/stylesheets/landing-watermark.scss */..watermark {. -webkit-writing-mode: vertical-rl;. -ms-writing-mode: tb-rl;. writing-mode: vertical-rl;. text-orientation: sideways;.}../* line 4, app/assets/stylesheets/landing-watermark.scss */..watermark.left {. left: 0;.}../* line 7, app/assets/stylesheets/landing-watermark.scss */..watermark.right {. right: 0;.}../* line 10, app/assets/stylesheets/landing-watermark.scss */..watermark.top {. text-align: center;. -webkit-writing-mode: horizontal-tb;. -ms-writing-mode: lr-tb;. writing-mode: horizontal-tb;. top: -38px;.}../* line 15, app/assets/stylesheets/landing-watermark.scss */..watermark h1 {. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 15px;. color: #fdfdfa;. font-weight: bold;.}../* line 24, app/assets/stylesheets/landing-watermark.scss */.#template_sei .watermark.left {. margin-left: -10px;.}../* li

                              Chrome Cache Entry: 111

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:PNG image data, 200 x 38, 8-bit/color RGBA, non-interlaced
                              Category:dropped
                              Size (bytes):3014
                              Entropy (8bit):7.902919939139106
                              Encrypted:false
                              SSDEEP:
                              MD5:E154B58FD2CD3F1F2E2C6C810BB1E65B
                              SHA1:CAEF301E8550A910909ECE9471669DA0C32EA6F0
                              SHA-256:E8C5A2C9860C1A6CC7C949B9D7C793E5E435D75996DEBEB295A959F3D09831C0
                              SHA-512:464EC940E824EAB8B7F83EB40852DD3019E84BE7B1A0F75AF288656605426B2EE386FA7FF102E0144AA065F053E88E8356E7C185B4DC393CC4D8EB0ADC877312
                              Malicious:false
                              Reputation:unknown
                              Preview:.PNG........IHDR.......&........l....IDATx...{h.U..q...Ms"e.ej,..M.,](&..B...)G.F...2.22oY......L.%...iF......L.e.dsn.Oo.@..?...........y...s...=...D-jQ.D..&C1..Mr_9.n...p.8.W...x....8d..Nl.b..=h...b<.`...W .GI...S.Q....l..b ....G.F2.+ ...C..u...2j.?Z.).....!-...d)2]..d.;p.,.t@>F>.3}9....... ......v@.>4.= ..B.5H..e.....5i.?NP....<.Y.LWx.a.>8..?.M.$S> .C...r...:.,...OLWx.a.v8.....c.....Z../...M........m.,..Rl..1.X.Y........j@.@.%.2l....YJR..?.....5 ..G.d.BF./.L\........,J..~...0]...,...q.7x....h}.m..#...."<...0q....8.9.`...e...EV...m..p.M}H.y...H..l.~...x..0...<.....d..Xh.1.~.Y.M`.].Q....:...8.....M1.'..~.h...g{..OD..f.Hc.g.(..)....,.y.w.\.....HO" /A.\..Z@...$...].,.<.G..WavB...q....\...H..<.t=d...-VWTC.I........jv...!....N@..0..M...."._B....%X.R.q.....W.'WAL..'m]*.+.j.pF.8,...V.Jc..@....E...|L...=.[..2&^......y....X..1..(.F..,..f.5..dT...b>..q>.;..d....:.O..)N. ..\.......s..R..*.UcD..d;ct.,+<.c;.W...!K.$..... .g.../.,5.T..g7l.,...p. .8.]...C_4...?

                              Chrome Cache Entry: 112

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                              Category:downloaded
                              Size (bytes):4524
                              Entropy (8bit):5.108931295370594
                              Encrypted:false
                              SSDEEP:
                              MD5:DD05B711E15EF201B07E20CB5C87F5D8
                              SHA1:41B818B243140D90DA4CA917D454335B603A6BDA
                              SHA-256:617F793D125F780AB7BB7C9E92AB427D9E757083E7368E241E8E8FA69F013E4F
                              SHA-512:243C149BB8AAF5376EEBAC49833A59F75BA26BEC098AFD8A167D12BDACD3E80D98EE1DA1D82915CC7E4C7FAC747FBFF5D2D687D97F20BDF5C81D67CFA0620F39
                              Malicious:false
                              Reputation:unknown
                              URL:https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css
                              Preview:.borderRadius{-moz-border-radius:5px; border-radius:5px; }...borderRadiusTp{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 5px 5px;}...borderRadiusBtm{-moz-border-radius:0 0 5px 5px ; border-radius:5px 5px 5px 5px;}.....ddcommon {position:relative;display:-moz-inline-stack; zoom:1; display:inline-block; *display:inline; cursor:default;}...ddcommon ul{padding:0;margin:0;}...ddcommon ul li{list-style-type:none;}...borderRadiusTp ul li:last-child{-moz-border-radius:0 0 5px 5px ; border-radius:0 0 5px 5px;border-bottom:0 none #c3c3c3; }...borderRadiusBtm ul li:first-child{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 0 0 ;border-bottom:1 solid #c3c3c3; }.....ddcommon .disabled img, .ddcommon .disabled span, .ddcommon.disabledAll{..opacity: .5; /* standard: ff gt 1.5, opera, safari */..-ms-filter:"alpha(opacity=50)"; /* ie 8 */..filter:alpha(opacity=50); /* ie lt 7 */..-khtml-opacity:.5; /* safari 1.x */..-moz-opacity:.5; /* ff lt 1.5, netscape */..color:#999999;..}...ddcommo

                              Chrome Cache Entry: 87

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:RIFF (little-endian) data, Web/P image
                              Category:downloaded
                              Size (bytes):2368
                              Entropy (8bit):7.857782123483033
                              Encrypted:false
                              SSDEEP:
                              MD5:402214A564EAB22101571DF8C6E30B79
                              SHA1:D5E452981A5C325383F92BFB964BA28ECEA6FFA6
                              SHA-256:8D63A7ED00572C8B418FF91F5B2E5CD667AA7226CE280E48FC8FE9D58A4D98AC
                              SHA-512:D7FD2C24B182ACEA57713FB9EFD19371802B1AE748F7B01FA82D822A86F70267D94C5105FB6BD1967BCDBC1FC43DE484F2B647DFD1EC729531BD4E89814CA42C
                              Malicious:false
                              Reputation:unknown
                              URL:https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
                              Preview:RIFF8...WEBPVP8L,.../.@...0..M._.w..1..WVaU.W,K..m..}.J.]...=..:].Dz.=....~......M.O.PneX(.......3.4..........;.f;..I2..L.....$[J....wA.a....,....@.$.].m.m.m..l.N.mcO..l.-....[t...5....-.%.....A.f ..D.`._@+.q.?.....8...(..-.^.i.,...]f..a...i....Tw.p..B....."...J'......O..J9..L.%P...{..H..JP.jP-.Cu...P{jFU..%.P[.%*B....3....X.'PO.Y.....bE....P........?J.U...*P!......O5.M.*.rT./LQ"JI..uCR...BR...S...-U.].YR...(..R..t4.....J...c..J1)|....) ^.C..*..=`.bR..~+.h.5.T......".....GS.u..|.._Dj..".D....,.7....<1.PU.t...X}.[8H1;T!+....H...R.*.I.\..f..V..P.S..+...m..s.659FlS.I....Ph.).....GhV.v+...&......l...K.^Q.)...7....5.<....a..%.t....<.(.....;2.n....K...9.J.B....Lf...T..!a..(....0H....E1......Qn.+.j.....v.R6.1G..?B......~.....&R....F...2.....}.(m.....).....]..I.....~.e.Z.T..U..C.OE.[......Zq..F.hc.W..,E.|.Bu..*SQ;..`.a.......|..?..}..COX4.....!{'P..J.8:..U...\..S.{8U1......J.P.N*._...9L......#<...v..n...M...8..##.r..]\..e|.....D.t.@...

                              Chrome Cache Entry: 88

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Web Open Font Format (Version 2), TrueType, length 9344, version 1.0
                              Category:downloaded
                              Size (bytes):9344
                              Entropy (8bit):7.975595436620788
                              Encrypted:false
                              SSDEEP:
                              MD5:CBCA61F27F93FD71171FE8D314C66AB9
                              SHA1:C46A51672FFFF100945F84C3EB87826B7844A1E2
                              SHA-256:F9A9A7A4B9D40BCC3047928DFA60695D53E6AE1D6EE699EA70146E171322ACAD
                              SHA-512:7F9E8520DFB64197CE233AF7671A5A5643AE116478C6E2F5F67FBD8A092117126ADF1E2EDDA13FF1C19D68AEA3D04288310A2109D7C81183330F2B8DAD0785D4
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVIGxA.woff2
                              Preview:wOF2......$.......A`..$..........................L.. ....`?STAT^.t..|.......t.Z..N..6.$.... ..x..h....B;%c[.08.@D..=.E...O...q2.0..i......v.p.0......Y. ..P)......N.C...K,.W!.Wutp..I.2...6.....Y..X...W..z.U.nq.j^;.8.zO..gw.d.^U?p.........7.. ....S..d......d./.-.7....$...V(V(|.........c~........B[H.D(.$2.1<....N7..n.9k...D.@.(.(...H.D....qsQ."..O..{Oh..r.T.Iw..9I...rq.2.n....SW.O..\b5B.n..M.06.j..L.Sx?.........t.|z}..V...G..J....x..Co].5HC..6p..,.2..&..}`.I.n......S}'....$*..iV.[.....W......6...m.I'M...a......c...|.a.FK.d.zW9xi'Y8v..lWi....T-..F\...^p.<.TT!wvQ.i0.0.f.\.A.. .Hq..J...=/.....\.]..Dq...:..+...W..]4u*Z.._.l...e-..........k..."p....c......X..=.9..1.....2.......],.....R|J......r.x./...pa...ef.......{..&.........=.5..>....5@...x.v..o.Io.L.t[Wu^.=..Z.r?xV..V..jV..`...+.2..8..P....[.r.....4.,Y....&.|.W<..7..Y.s.=,2..A.i..je..P..`pV..!VW-...`.>YBRJY[...!rY5...l........Z.5_..B.....cP.....v1....(.5...[....n.....vlx=I.*1..9R....=..2..u\..p...iFD...

                              Chrome Cache Entry: 89

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with no line terminators
                              Category:downloaded
                              Size (bytes):9
                              Entropy (8bit):2.725480556997868
                              Encrypted:false
                              SSDEEP:
                              MD5:D8F4A1993546CC4B850CDE3599E27AEC
                              SHA1:094B763B4CFCC0B05E5D040581CD513C3CA08067
                              SHA-256:907BA78B4545338D3539683E63ECB51CF51C10ADC9DABD86E92BD52339F298B9
                              SHA-512:7C696247F98AA6FE4E1DF001FD6029ABBBCCF45B122D65DFDEDE8F8A400CDA775387C657F96BD1E4E52DA7409187892B1F0786C54D835D2E44227B2E1335EAF6
                              Malicious:false
                              Reputation:unknown
                              URL:https://secured-login.net/assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css
                              Preview:not found

                              Chrome Cache Entry: 92

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (1572)
                              Category:downloaded
                              Size (bytes):6193
                              Entropy (8bit):5.401714743814202
                              Encrypted:false
                              SSDEEP:
                              MD5:F2D1D2937C3546E15C471236646AC74E
                              SHA1:DD8D90F6D4AC8D72C718C10424788612689D89DB
                              SHA-256:719D2FC548145FA8D8361205F6FCB49EEFC54C71FBB18E6320A60A263F40637A
                              SHA-512:7B400281407249F805AB4695E0B7D3CDF4F7F5F776F9F7E60872D5208B7324DADDDAD79D76AC9991C74563520FB6BFF3A6343C8C10591C9EB5682733592668A4
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.googleapis.com/css2?family=Open+Sans&display=swap
                              Preview:/* cyrillic-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVIGxA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVIGxA.woff2) for

                              Chrome Cache Entry: 94

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Web Open Font Format (Version 2), TrueType, length 17576, version 1.0
                              Category:downloaded
                              Size (bytes):17576
                              Entropy (8bit):7.986135354736866
                              Encrypted:false
                              SSDEEP:
                              MD5:EFB3F28447C9EF35FD5882FB763B37C3
                              SHA1:158DDD8C0348DEFA3192F26DA60A746727F4A8A3
                              SHA-256:6D4370B59E36AC955C8B97F12FD5E86F7D3E80285D6AF2BFF0DAFA8E122D3C3B
                              SHA-512:C0521D7C7BE4F635F70F0F466BC7A179C647C43C5AB400C8E490466BDDDE7175809B594C3D7B1A2F2AE9841CDE2F9AABFB8A967618FFB2CC7456A9B3231E0CDD
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVIGxA.woff2
                              Preview:wOF2......D.......}...D=.........................N.......`?STAT^.....|........<.....T..6.$..$. ..x........n'...........#.`.........9IE.LZLJ....Cf.`....0....I.Y|...`*.{j.K....EW..zG=xA..P.6....6..n.+V....+..J.. ........ ..6~.f.....o.........}.H?..1.j^.^..?...z^.J.X.6.._...I....."..5..3<Bc.......oI.av}.s.{>.. z.c...........&@-w.S..*P_.~..f..~..'+.....m..s..*.`D..(.....`.b...U.Vcn:..5.\.j.......v.. .I..K..mS#.=...w.%[.}I..>.O..'.k.k..}Gh...v..eB.....E..'"!.I...I.D...jo2.X.U.....OC.......H......8..[.... @..M.....=U/...E<.BH.I}h.j..H'..R.&O...i...kE%.....oTns.U..9.7...._....fL8....Um.@...g.[...%...0vU_.<.........Mp.."R.l.A....t..&..... X@.P..o..wI..4...c.........n.~9....U.`....gj...pu.... ..'.B,..C.\T!.v.......x.b...(0(....J......2...$...'..+..s.u]..m.E]....QS.......}.Z=.$.....q.0..2.kKK.....[.|kg.....y....`DZGC.....A8....'.....,.Iy...h.K#........)r.P)~...!o.2t........._AAvQ~.!.@hy;c.-....p.'...:4...5......!..yS4A..........yD...T.*.A.!......dK

                              Chrome Cache Entry: 95

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Web Open Font Format (Version 2), TrueType, length 7728, version 1.0
                              Category:downloaded
                              Size (bytes):7728
                              Entropy (8bit):7.973684421983582
                              Encrypted:false
                              SSDEEP:
                              MD5:80210D1FF4DE56C6704607F3831E8F6C
                              SHA1:32FB4E1E177D5DE97AAD6E0D57100755D8DD2CFD
                              SHA-256:F515A6F8BAE422286936B110653FB8EE0F58FE32D61390EE5DE77029BE23EFD6
                              SHA-512:E24520E29F2073F03A0FF1E72EB632CCFB6FC1451BCB0735671EAE03CAFFB1CA6731050318F43544CC99AC7127015664464A0DEF587058535F9F7F743F166713
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVIGxA.woff2
                              Preview:wOF2.......0......:..............................V..\..f.`?STAT^..4..|............$..6.$..D. ..x..,.....4%...<...}G.H..T.0...L.F...._[e.'.B"...)*.J...55. ).M.u..J}bV.,.q.#.I.C.(O....0.J....$...c...}.E'/.n.k...A..#m..d...9{.fV...!..[qj.,5...P..u..p.T.N\...{...d...f+.pt...+..y.A*...Z.3&..H.VuX...^..R9.q@...s...]...c.pMS .GH...z..e?.n.....Z...V........,.8..t......p....X..i.w.....j.....2]sP.%Z.....XQU.....7..3.u.]...+.I.....!......c.ey...b_...M.....aXp: ..$.....^........8+..Z.~.!..BXR..E#WbC....1..P;@...e...c....&<0.(..2..,.e.....n..C.`....n,7\.DV.B..._.=...Ko}..O......A.......@C.}I}.....z.8._J....5.t....&.$....a.PS.}.....^....$..@...;.<.'.F.t.....\........~.w."..w...7...8..-r...r.Z.`.K..Y.R8.#R.....Ijz.vc.Xk....g..E.n...Q.x........>....gH..t...:Z..v..+.z.^H..A.@.....|W9.}+.Ury.......Q,@...!.. .'kN..X..RA.oHWF$O...<..r.....|N..!.fT...F.....~.....1..(jD...e..i..!....cD.h.Y.....A....r.dfD5.P..x...g.../@..._g\.h....pH..~..e..../MR.....).]

                              Chrome Cache Entry: 96

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:ASCII text, with very long lines (65371)
                              Category:downloaded
                              Size (bytes):121200
                              Entropy (8bit):5.0982146191887106
                              Encrypted:false
                              SSDEEP:
                              MD5:EC3BB52A00E176A7181D454DFFAEA219
                              SHA1:6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68
                              SHA-256:F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
                              SHA-512:E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B
                              Malicious:false
                              Reputation:unknown
                              URL:https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
                              Preview:/*!. * Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). *//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

                              Chrome Cache Entry: 97

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Web Open Font Format (Version 2), TrueType, length 8572, version 1.0
                              Category:downloaded
                              Size (bytes):8572
                              Entropy (8bit):7.968224802101464
                              Encrypted:false
                              SSDEEP:
                              MD5:776FDC253D54124DD63F274BF5EA35F0
                              SHA1:7761DAC9A7FBB2814989092003506BA594C6EE45
                              SHA-256:0B81CC8358F236821ADA286C94726C7FEBC9CAD8BD4F59FB39C515956B644E99
                              SHA-512:4689A0D6723243E796D5DC1B031F5E1E8CE1D038921F1CC612169F179147DFC1B74CCA87CD7E2C8BEB38D9A8ED99F42FF369BDCB2FA9EA80B1BC00CC36CAEB10
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVIGxA.woff2
                              Preview:wOF2......!|......G@..!..........................j..l..&.`?STAT^..8..|.......$."..&..6.$..H. ..x..T.....A...........ZuVQ.......Kn..`...%.$T6I....\G.Q.X9uK8.ct?..........P.\5..;.I{...r}E......?.E7....8A..R.k."....^.4..^..j?.2h..bg.8.5.....7;..I..JH..j...4B!jI_v....=..*S.."+eQX....h...X11........t.....rw-.2..X..J..z@.8@.a.........+JCV..df.p.4..B.U ....]..n. ...u..+..d.C.P8.,.8F.P.L.bL...=..=...5..O..T.<..I...].....O...`.Q.9....WT...r.>.b...3U..`.&.. .<..X-.'.s-....E;?.T."c.%4....ue.>...0A+`.X/.y..T.......O`...sHEE8E>...f...........%.p.t ....RrH.Sy!..)...Z....E...w^....V"..z..=O....B.........&XV..{..B....*.>...=........]..Z.._..c.I.....U.^..j...B..A....Z.......T..N.F822.....G......h.(.`'E1..;..)...q.....%........... uK..*....@...7..DEd....N.l..,.,....oI...z... .eq.t:.HG/;4..3.F+...A........WFNm.*.._.|-! Y.Utv.},......,..G.O.#...w.G..?.C..5_.)O{.G<.^.u..b..p,...P.MR.... ./C.)...s..{.,.}..z.....L..A...~..J..W.)}....r/u..:Q..aM......W...

                              Chrome Cache Entry: 99

                              Download File
                              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                              File Type:Web Open Font Format (Version 2), TrueType, length 15368, version 1.0
                              Category:downloaded
                              Size (bytes):15368
                              Entropy (8bit):7.986184968554377
                              Encrypted:false
                              SSDEEP:
                              MD5:BE7B70AB1265B1047BD93422397C655E
                              SHA1:E10BBC7D8529AE3E64D8B08C9F7CD55C98F83D60
                              SHA-256:B452C0F212E8BF33965905032F5BA1FAE29CD6F9539DCBC673704E66CE943B2B
                              SHA-512:A9A913559EFE29685B7C12456326C3F8C7053D639B849261108A69348EEA02C617BA923561C1CDBE36082B2CEC1C0ADCC22511389791DB328ABC99A57F011F5A
                              Malicious:false
                              Reputation:unknown
                              URL:https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVIGxA.woff2
                              Preview:wOF2......<.......x0..;...........................>..\..|.`?STAT^..J..|........\.i.....6.$..,. ..x........l..]{N..#R.-...0.Q.%.T.......Q...U...L..R.)KFQ0.)p..L%d......!3..;..v8..9.........A..'..........v5D80.......&...M...}....g.6.'N..M.y......gk....B.{....}.....q>j...].......o!..AL....b.....f......F..FE,@.Q..c*F..6n....g.....Ey..O....^.3...P.)U...AH.y..Z...'%.?8/.......T.S............S..8.w 7..>`.5.........*..0#.._..(_.P.W....s=......i+i.....`Dn.*)k.$.....G...]..=.....w.....n..|."..4.g.....H.2M..P.(oRg..l~G..dJ.<.U..q..u..4%......<...`.-$.....$[..".....TuM.V..7.[.{.l.. ,....>.&...P9].....S.lg.B.tK..B..\..z..RS.i....3.D."u..Bz..T.E^R.=m...U.\.X...IZ....n]....]...}i.......K.kL.D.6.".5..V..u.....?...|.a.=.;..0..cL..HpU..t.p)1.k.....^G..:.u.q(E.Q5.o.k.1.0..R....c..`.....A..3.g.0&....$....| .....C.H....(..F.. .::.......&.$Z4...$N....$.<.%.A6..y.1.?.......w...}....~$....V..Q......x..A'...*...+...I<n. .......t@...w$ ...@...9..H.h..B...Q

                              Static File Info

                              General

                              File type:CDFV2 Microsoft Outlook Message
                              Entropy (8bit):3.9916124672033546
                              TrID:
                              • Outlook Message (71009/1) 58.92%
                              • Outlook Form Template (41509/1) 34.44%
                              • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                              File name:FW Important Security Policy Update.msg
                              File size:112'128 bytes
                              MD5:8c67225141833c42886cfddd3e8de4fd
                              SHA1:2b26f82f7aeabcd3ea6dd807b0bceabb7d75bb64
                              SHA256:9bce3500938ba5e5cfd908127fac74ff84f33e80701e4e9284212ce50b55c398
                              SHA512:7542189f18e2756e8eab36146aedc32e30aa6656a534713b9f21c4ea28068adeb6a7a5e603f7c57d3ea17fc946cb255518fa9fbfe6aecea791d14f642894cc33
                              SSDEEP:1536:gTIxpsWETo4X3WqqFlYe36ZdMIXRW0MWjohzBz6Nuq7gGyTvWykcK5WT+5R1U:UWqqnYe3y3VohzBzguq7g4c9W1U
                              TLSH:6EB3DF113AFA1119F2779F354BF29097893ABD92AD25DA5F2181330E0672A41DC72F3B
                              File Content Preview:........................>..................................."...................r..............................................................................................................................................................................

                              Static Mail

                              General

                              Subject:FW: Important Security Policy Update
                              From:Tammy Busch <tbusch@rdusd.org>
                              To:Gabriel Espinoza <gespinoza@mydatapath.com>
                              Cc:
                              BCC:
                              Date:Thu, 14 Nov 2024 01:21:17 +0100
                              Communications:
                              • External Sender: ________________________________ Im wondering if other staff receive these as well and if staff should apply update or should we send out an email that its done in another way? Tammy Busch Assistant Superintendent of Business Services Certified School Risk Manager River Delta Unified School District 707-374-1715 tbusch@rdusd.org <mailto:tbusch@rdusd.org>
                              • From: Microsoft 365 <noreply@updates-microsoft365.com> Sent: Wednesday, November 13, 2024 3:18 PM To: Tammy Busch <tbusch@rdusd.org> Subject: Important Security Policy Update <https://upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/1024px-Microsoft_logo_%282012%29.svg.png> Important Security Policy Update Hi Tammy Busch, A new update was recently released for one or more Microsoft services currently active in your account tbusch@rdusd.org <mailto:tbusch@rdusd.org> . Version Release Date: November 13, 2024 Version Release Code: 23407142 You're required to accept the updated policy changes to continue using your account securely. Apply Update <https://url.us.m.mimecastprotect.com/s/qG95CL9mjxiRpjD5uBfgHy_mcS?domain=guru.phishing.guru> Microsoft 365 Mobile & Desktop Apps Security Patch We've released a major security patch to the following update channels for Microsoft 365 Apps: Azure SSL/TLS Security Certificate. When will this happen: We'll be gradually rolling out this update of Microsoft 365 Apps to users on the update channel. If you have any questions about this update, please let us know <https://url.us.m.mimecastprotect.com/s/qG95CL9mjxiRpjD5uBfgHy_mcS?domain=guru.phishing.guru> . Thank you, Microsoft 365 Security Team <https://guru.phishing.guru/XZUd2ZXlxLzNlUGc1d0NKWkJBYWo5YmFEYSt0ZzM2R3djTm5iS1JYdS93YW5hN1p6ZGlkeVcyRGV0VnJadjNpbVl1V0JmTUcxREJuRHUvbUVCK1c1dGdtRnlZbEQ1S2thZi8rOUtRekcraVJwSXJOWS9zRHl1dz09LS1VNmdTRHNPTEh2YUYxeWQ5LS05RFcwVktJSkhHQU94alBBdmlpNXlRPT0=?cid=2279533539>
                              Attachments:

                                Headers

                                Key Value
                                Receivedfrom PH8PR10MB6525.namprd10.prod.outlook.com
                                0021:17 +0000
                                ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
                                ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
                                h=FromDate:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
                                ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=pass
                                by LV8PR13MB6894.namprd13.prod.outlook.com (260310b6:408:263::22) with
                                2024 0021:18 +0000
                                (260310b6:303:16d::32) with Microsoft SMTP Server (version=TLS1_2,
                                Transport; Thu, 14 Nov 2024 0021:27 +0000
                                Authentication-Resultsspf=softfail (sender IP is 205.139.110.120)
                                Received-SPFSoftFail (protection.outlook.com: domain of transitioning
                                via Frontend Transport; Thu, 14 Nov 2024 0021:26 +0000
                                h=fromfrom:reply-to:subject:subject:date:date:message-id:message-id:
                                toto:cc:mime-version:mime-version:content-type:content-type:
                                in-reply-toin-reply-to:references:references:dkim-signature;
                                arc=pass ("microsoft.coms=arcselector10001:i=1");
                                spf=pass (relay.mimecast.comdomain of tbusch@rdusd.org designates 40.107.94.100 as permitted sender) smtp.mailfrom=tbusch@rdusd.org
                                Authentication-Results-Originalrelay.mimecast.com; dkim=pass
                                ("microsoft.coms=arcselector10001:i=1"); dmarc=pass (policy=quarantine)
                                header.from=rdusd.org; spf=pass (relay.mimecast.comdomain of
                                13 Nov 2024 1921:21 -0500
                                X-MC-UniqueBXT5P4RUNOKrO50zzJ71uQ-1
                                X-Mimecast-MFC-AGG-IDBXT5P4RUNOKrO50zzJ71uQ
                                DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=rdusd.org;
                                by CO1PR10MB4609.namprd10.prod.outlook.com (260310b6:303:91::6) with
                                ([fe80:5588:f940:6786:e568%4]) with mapi id 15.20.8137.027; Thu, 14 Nov 2024
                                FromTammy Busch <tbusch@rdusd.org>
                                ToGabriel Espinoza <gespinoza@mydatapath.com>
                                SubjectFW: Important Security Policy Update
                                Thread-TopicImportant Security Policy Update
                                Thread-IndexAQHbNiJHqv+InXpFsEC9yGTp2wdBfbK16clQ
                                DateThu, 14 Nov 2024 00:21:17 +0000
                                Message-ID<PH8PR10MB6525B08ADEE5C5F4AB977499C15B2@PH8PR10MB6525.namprd10.prod.outlook.com>
                                References<673533a419e98_924a4425625@169.254.70.14.mail>
                                In-Reply-To<673533a419e98_924a4425625@169.254.70.14.mail>
                                Accept-Languageen-US
                                X-MS-Has-AttachX-MS-TNEF-Correlator:
                                x-ms-traffictypediagnosticPH8PR10MB6525:EE_|CO1PR10MB4609:EE_|SJ1PEPF000023D6:EE_|LV8PR13MB6894:EE_|BYAPR13MB2712:EE_
                                X-MS-Office365-Filtering-Correlation-Idd022c6b0-ea50-42f2-46e8-08dd04424762
                                x-ld-processed800138de-5eb1-4eab-8a2c-509477600567,ExtAddr
                                x-ms-exchange-senderadcheck1
                                x-ms-exchange-antispam-relay0
                                X-Microsoft-Antispam-UntrustedBCL:0;ARA:13230040|366016|69100299015|376014|1800799024|5042699012|8096899003|38070700018
                                X-Microsoft-Antispam-Message-Info-Original=?us-ascii?Q?ngKzPFTvjclE/qceBIBioeX6QQ9PttAOeE+oGdi8VRgD6hLvijRhAAeyGvcV?=
                                X-Forefront-Antispam-Report-UntrustedCIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH8PR10MB6525.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(69100299015)(376014)(1800799024)(5042699012)(8096899003)(38070700018);DIR:OUT;SFP:1102
                                MIME-Version1.0
                                X-MS-Exchange-Transport-CrossTenantHeadersStampedLV8PR13MB6894
                                X-Mimecast-Spam-Score0
                                X-Mimecast-MFC-PROC-IDcjtC3AJzpM00G-n_B676gyt9WuZEDaClYWNAH_aaIzc_1731543679
                                X-Mimecast-Impersonation-ProtectPolicy=Default Impersonation Protect Definition;Similar Internal Domain=false;Similar Monitored External Domain=false;Custom External Domain=false;Mimecast External Domain=false;Newly Observed Domain=false;Internal User Name=false;Custom Display Name List=false;Reply-to Address Mismatch=false;Targeted Threat Dictionary=true;Mimecast Threat Dictionary=true;Custom Threat Dictionary=false
                                Content-Languageen-US
                                Content-Typemultipart/alternative;
                                Return-Pathtbusch@rdusd.org
                                X-MS-Exchange-Organization-ExpirationStartTime14 Nov 2024 00:21:26.8454
                                X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                                X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                                X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                                X-MS-Exchange-Organization-Network-Message-Idd022c6b0-ea50-42f2-46e8-08dd04424762
                                X-EOPAttributedMessage0
                                X-EOPTenantAttributedMessage9ef5d077-23c6-453f-94f9-7809c35a837f:0
                                X-MS-Exchange-Organization-MessageDirectionalityIncoming
                                X-MS-Exchange-Transport-CrossTenantHeadersStrippedSJ1PEPF000023D6.namprd21.prod.outlook.com
                                X-MS-PublicTrafficTypeEmail
                                X-MS-Exchange-Organization-AuthSourceSJ1PEPF000023D6.namprd21.prod.outlook.com
                                X-MS-Exchange-Organization-AuthAsAnonymous
                                X-MS-Office365-Filtering-Correlation-Id-Prvsd043ef12-9da3-46e6-0d91-08dd04424217
                                X-MS-Exchange-AtpMessagePropertiesSA|SL
                                X-MS-Exchange-Organization-SCL-1
                                X-Microsoft-AntispamBCL:0;ARA:13230040|240411011799012|69100299015|82310400026|35042699022|4076899003|8096899003;
                                X-Forefront-Antispam-ReportCIP:205.139.110.120;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:us-smtp-inbound-delivery-1.mimecast.com;PTR:us-smtp-delivery-1.mimecast.com;CAT:NONE;SFS:(13230040)(240411011799012)(69100299015)(82310400026)(35042699022)(4076899003)(8096899003);DIR:INB;
                                X-MS-Exchange-CrossTenant-OriginalArrivalTime14 Nov 2024 00:21:26.3610
                                X-MS-Exchange-CrossTenant-Network-Message-Idd022c6b0-ea50-42f2-46e8-08dd04424762
                                X-MS-Exchange-CrossTenant-Id9ef5d077-23c6-453f-94f9-7809c35a837f
                                X-MS-Exchange-CrossTenant-AuthSourceSJ1PEPF000023D6.namprd21.prod.outlook.com
                                X-MS-Exchange-CrossTenant-AuthAsAnonymous
                                X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                                X-MS-Exchange-Transport-EndToEndLatency00:00:09.7983707
                                X-MS-Exchange-Processed-By-BccFoldering15.20.8158.013
                                X-Microsoft-Antispam-Mailbox-Deliveryucf:1;jmr:0;auth:0;dest:C;OFR:CustomRules;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
                                X-Microsoft-Antispam-Message-Info=?us-ascii?Q?0xwTkfgnAVCVOvndDK58oNM4dVm57CeUGJ4F2LwlchejwlPrg8UjGa73xLlS?=
                                dateThu, 14 Nov 2024 01:21:17 +0100

                                File Icon

                                Icon Hash:c4e1928eacb280a2