Edit tour
Windows
Analysis Report
ee0b6b037b16b54632b6b37d1fb72727.eml
Overview
General Information
| Sample name: | ee0b6b037b16b54632b6b37d1fb72727.eml |
| Analysis ID: | 1556705 |
| MD5: | 4b9e5facdef9a6a766716ef1a494d15c |
| SHA1: | c7df5078fe1808cc06078c8d2629835732e97dc9 |
| SHA256: | 4d156810843e3438e761c4f3cbfecaccd29c4b64b2ea6aa73e54aed5283cf120 |
| Infos: |  |
 | |
Detection
| Score: | 48 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
Detected non-DNS traffic on DNS port
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry
Classification
- System is w10x64_ra
OUTLOOK.EXE (PID: 6428 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\OUTLO OK.EXE" /e ml "C:\Use rs\user\De sktop\ee0b 6b037b16b5 4632b6b37d 1fb72727.e ml" MD5: 91A5292942864110ED734005B7E005C0) 
ai.exe (PID: 7008 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \root\vfs\ ProgramFil esCommonX6 4\Microsof t Shared\O ffice16\ai .exe" "F05 FBD8A-C85E -48DC-96FE -34574180F F3D" "A001 9601-66DF- 4798-A215- D39904F8E3 46" "6428" "C:\Progr am Files ( x86)\Micro soft Offic e\Root\Off ice16\OUTL OOK.EXE" " WordCombin edFloatieL reOnline.o nnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD) 
chrome.exe (PID: 5156 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// www.google .es/url?q= querywbir( spellCorre ctionEnabl ed%3Atrue% 2CrecentSe archParam% 3A(id%3A38 91228890%2 CdoLogHist ory%3Atrue )%2Cfilter s%3AList(( type%3AREG ION%2Cvalu es%3AList( (id%3A1036 44278%2Cte xt%3AUnite d%2520Stat es%2Cselec tionType%3 AINCLUDED) )))%2Ckeyw ords%3Arem ote)&sessi onId=5NTcR f4wT3OOZdA OuNu6%2FQ% 3D%3Dquery (spellCorr ectionEnab led%3Atrue %2CrecentS earchParam %3A(id%3A3 891228890% 2CdoLogHis tory%3Atru e)%2Cfilte rs%3AList( (type%3ARE GION%2Cval ues%3AList ((id%3A103 644278%2Ct ext%3AUnit ed%2520Sta tes%2Csele ctionType% 3AINCLUDED ))))%2Ckey words%3Are mote)&sess ionId=5NTc Rf4wT3OOZd AOuNu6%2FQ %3D%3Dquer y(spellCor rectionEna bled%3Atru e%2Crecent SearchPara m%3A(id%3A 3891228890 %2CdoLogHi story%3Atr ue)%2Cfilt ers%3AList ((type%3AR EGION%2Cva lues%3ALis t((id%3A10 3644278%2C text%3AUni ted%2520St ates%2Csel ectionType %3AINCLUDE D))))%2Cke ywords%3Ar emote)&ses sionId=5NT cRf4wT3OOZ dAOuNu6%2F Q%3D%3Dque ry(spellCo rrectionEn abled%3Atr ue%2Crecen tSearchPar am%3A(id%3 A389122889 0%2CdoLogH istory%3At rue)%2Cfil ters%3ALis t((type%3A REGION%2Cv alues%3ALi st((id%3A1 03644278%2 Ctext%3AUn ited%2520S tates%2Cse lectionTyp e%3AINCLUD ED))))%2Ck eywords%3A remote)&se ssionId=5N TcRf4wT3OO ZdAOuNu6%2 FQ%3D%3D&s a=t&url=am p%2fcondom inioanacar olina.com. br%2flocke q%2fwtolwz l224moscrj iovolvgdhy a1s0oym4bi 4/a2VsbHku c3dhbnNvbk Btb250cm9z ZS1lbnYuY2 9t MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6732 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1996 --fi eld-trial- handle=176 0,i,596228 5065134541 861,782403 0978840373 784,262144 --disable -features= Optimizati onGuideMod elDownload ing,Optimi zationHint s,Optimiza tionHintsF etching,Op timization TargetPred iction /pr efetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6908 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// www.google .es/url?q= querywbir( spellCorre ctionEnabl ed%3Atrue% 2CrecentSe archParam% 3A(id%3A38 91228890%2 CdoLogHist ory%3Atrue )%2Cfilter s%3AList(( type%3AREG ION%2Cvalu es%3AList( (id%3A1036 44278%2Cte xt%3AUnite d%2520Stat es%2Cselec tionType%3 AINCLUDED) )))%2Ckeyw ords%3Arem ote)&sessi onId=5NTcR f4wT3OOZdA OuNu6%2FQ% 3D%3Dquery (spellCorr ectionEnab led%3Atrue %2CrecentS earchParam %3A(id%3A3 891228890% 2CdoLogHis tory%3Atru e)%2Cfilte rs%3AList( (type%3ARE GION%2Cval ues%3AList ((id%3A103 644278%2Ct ext%3AUnit ed%2520Sta tes%2Csele ctionType% 3AINCLUDED ))))%2Ckey words%3Are mote)&sess ionId=5NTc Rf4wT3OOZd AOuNu6%2FQ %3D%3Dquer y(spellCor rectionEna bled%3Atru e%2Crecent SearchPara m%3A(id%3A 3891228890 %2CdoLogHi story%3Atr ue)%2Cfilt ers%3AList ((type%3AR EGION%2Cva lues%3ALis t((id%3A10 3644278%2C text%3AUni ted%2520St ates%2Csel ectionType %3AINCLUDE D))))%2Cke ywords%3Ar emote)&ses sionId=5NT cRf4wT3OOZ dAOuNu6%2F Q%3D%3Dque ry(spellCo rrectionEn abled%3Atr ue%2Crecen tSearchPar am%3A(id%3 A389122889 0%2CdoLogH istory%3At rue)%2Cfil ters%3ALis t((type%3A REGION%2Cv alues%3ALi st((id%3A1 03644278%2 Ctext%3AUn ited%2520S tates%2Cse lectionTyp e%3AINCLUD ED))))%2Ck eywords%3A remote)&se ssionId=5N TcRf4wT3OO ZdAOuNu6%2 FQ%3D%3D&s a=t&url=am p%2fcondom inioanacar olina.com. br%2flocke q%2fwtolwz l224moscrj iovolvgdhy a1s0oym4bi 4/a2VsbHku c3dhbnNvbk Btb250cm9z ZS1lbnYuY2 9t MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7424 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1968 --fi eld-trial- handle=196 4,i,101273 8878667316 4989,17449 6295926141 8216,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 4608 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// www.google .es/url?q= querywbir( spellCorre ctionEnabl ed%3Atrue% 2CrecentSe archParam% 3A(id%3A38 91228890%2 CdoLogHist ory%3Atrue )%2Cfilter s%3AList(( type%3AREG ION%2Cvalu es%3AList( (id%3A1036 44278%2Cte xt%3AUnite d%2520Stat es%2Cselec tionType%3 AINCLUDED) )))%2Ckeyw ords%3Arem ote)&sessi onId=5NTcR f4wT3OOZdA OuNu6%2FQ% 3D%3Dquery (spellCorr ectionEnab led%3Atrue %2CrecentS earchParam %3A(id%3A3 891228890% 2CdoLogHis tory%3Atru e)%2Cfilte rs%3AList( (type%3ARE GION%2Cval ues%3AList ((id%3A103 644278%2Ct ext%3AUnit ed%2520Sta tes%2Csele ctionType% 3AINCLUDED ))))%2Ckey words%3Are mote)&sess ionId=5NTc Rf4wT3OOZd AOuNu6%2FQ %3D%3Dquer y(spellCor rectionEna bled%3Atru e%2Crecent SearchPara m%3A(id%3A 3891228890 %2CdoLogHi story%3Atr ue)%2Cfilt ers%3AList ((type%3AR EGION%2Cva lues%3ALis t((id%3A10 3644278%2C text%3AUni ted%2520St ates%2Csel ectionType %3AINCLUDE D))))%2Cke ywords%3Ar emote)&ses sionId=5NT cRf4wT3OOZ dAOuNu6%2F Q%3D%3Dque ry(spellCo rrectionEn abled%3Atr ue%2Crecen tSearchPar am%3A(id%3 A389122889 0%2CdoLogH istory%3At rue)%2Cfil ters%3ALis t((type%3A REGION%2Cv alues%3ALi st((id%3A1 03644278%2 Ctext%3AUn ited%2520S tates%2Cse lectionTyp e%3AINCLUD ED))))%2Ck eywords%3A remote)&se ssionId=5N TcRf4wT3OO ZdAOuNu6%2 FQ%3D%3D&s a=t&url=am p%2fcondom inioanacar olina.com. br%2flocke q%2fwtolwz l224moscrj iovolvgdhy a1s0oym4bi 4/a2VsbHku c3dhbnNvbk Btb250cm9z ZS1lbnYuY2 9t MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 3344 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2080 --fi eld-trial- handle=185 6,i,867922 0859908409 652,112213 6507190527 6730,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6648 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// www.google .es/url?q= querywbir( spellCorre ctionEnabl ed%3Atrue% 2CrecentSe archParam% 3A(id%3A38 91228890%2 CdoLogHist ory%3Atrue )%2Cfilter s%3AList(( type%3AREG ION%2Cvalu es%3AList( (id%3A1036 44278%2Cte xt%3AUnite d%2520Stat es%2Cselec tionType%3 AINCLUDED) )))%2Ckeyw ords%3Arem ote)&sessi onId=5NTcR f4wT3OOZdA OuNu6%2FQ% 3D%3Dquery (spellCorr ectionEnab led%3Atrue %2CrecentS earchParam %3A(id%3A3 891228890% 2CdoLogHis tory%3Atru e)%2Cfilte rs%3AList( (type%3ARE GION%2Cval ues%3AList ((id%3A103 644278%2Ct ext%3AUnit ed%2520Sta tes%2Csele ctionType% 3AINCLUDED ))))%2Ckey words%3Are mote)&sess ionId=5NTc Rf4wT3OOZd AOuNu6%2FQ %3D%3Dquer y(spellCor rectionEna bled%3Atru e%2Crecent SearchPara m%3A(id%3A 3891228890 %2CdoLogHi story%3Atr ue)%2Cfilt ers%3AList ((type%3AR EGION%2Cva lues%3ALis t((id%3A10 3644278%2C text%3AUni ted%2520St ates%2Csel ectionType %3AINCLUDE D))))%2Cke ywords%3Ar emote)&ses sionId=5NT cRf4wT3OOZ dAOuNu6%2F Q%3D%3Dque ry(spellCo rrectionEn abled%3Atr ue%2Crecen tSearchPar am%3A(id%3 A389122889 0%2CdoLogH istory%3At rue)%2Cfil ters%3ALis t((type%3A REGION%2Cv alues%3ALi st((id%3A1 03644278%2 Ctext%3AUn ited%2520S tates%2Cse lectionTyp e%3AINCLUD ED))))%2Ck eywords%3A remote)&se ssionId=5N TcRf4wT3OO ZdAOuNu6%2 FQ%3D%3D&s a=t&url=am p%2fcondom inioanacar olina.com. br%2flocke q%2fwtolwz l224moscrj iovolvgdhy a1s0oym4bi 4/a2VsbHku c3dhbnNvbk Btb250cm9z ZS1lbnYuY2 9t MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 1948 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2152 --fi eld-trial- handle=199 6,i,176040 8889480858 7731,15684 7095528657 46859,2621 44 --disab le-feature s=Optimiza tionGuideM odelDownlo ading,Opti mizationHi nts,Optimi zationHint sFetching, Optimizati onTargetPr ediction / prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
- cleanup
⊘No yara matches
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | Joe Sandbox AI: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Memory has grown: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Classification label: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Key value queried: | ||
| Source: | Window found: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | Key value created or modified: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | File Volume queried: | ||
| Source: | Process information queried: | ||
| Source: | Queries volume information: | ||
| Source: | Key value queried: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 2 Browser Extensions | 1 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 Registry Run Keys / Startup Folder | 1 Registry Run Keys / Startup Folder | 1 Modify Registry | LSASS Memory | 13 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Process Injection | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 Extra Window Memory Injection | 1 DLL Side-Loading | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 4 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Extra Window Memory Injection | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| yzpwvvyfpujhuri8bzaim9cqk9lqh7xhihnydfguqpg7hopl7b5677zv1g3.aeeouirl.ru | 104.21.25.176 | true | false | unknown | |
| ox0itqwgw8xcz6dl6uphi82rj1nkyu7hpvbuvd7nsbrtptg6jesm1kiu.aeeouirl.ru | 172.67.134.110 | true | false | unknown | |
| a.nel.cloudflare.com | 35.190.80.1 | true | false | high | |
| google.com | 142.250.186.110 | true | false | high | |
| CDG-efz.ms-acdc.office.com | 52.98.227.178 | true | false | high | |
| ORY-efz.ms-acdc.office.com | 52.98.159.194 | true | false | unknown | |
| l4t2chw8bqozm6lxxwcveyntznrcndgjvjlajqr2jr8aui2nnscya6iv.birsbunh.ru | 188.114.96.3 | true | false | unknown | |
| s-part-0017.t-0009.t-msedge.net | 13.107.246.45 | true | false | high | |
| condominioanacarolina.com.br | 191.252.128.160 | true | false | unknown | |
| mrwa.ungonditc.com | 188.114.97.3 | true | false | unknown | |
| www.google.es | 142.250.185.195 | true | false | high | |
| code.jquery.com | 151.101.130.137 | true | false | high | |
| cdnjs.cloudflare.com | 104.17.24.14 | true | false | high | |
| challenges.cloudflare.com | 104.18.95.41 | true | false | high | |
| sni1gl.wpc.omegacdn.net | 152.199.21.175 | true | false | high | |
| www.google.com | 142.250.186.164 | true | false | high | |
| www.microsoft365.com | unknown | unknown | false | high | |
| aadcdn.msftauth.net | unknown | unknown | false | high | |
| outlook.live.com | unknown | unknown | false | unknown | |
| assets.onestore.ms | unknown | unknown | false | high | |
| ajax.aspnetcdn.com | unknown | unknown | false | high | |
| www.microsoftonline.com | unknown | unknown | false | high | |
| c.s-microsoft.com | unknown | unknown | false | high | |
| identity.nel.measure.office.net | unknown | unknown | false | high | |
| www.outlook.com | unknown | unknown | false | unknown | |
| excel.office.com | unknown | unknown | false | high | |
| login.microsoftonline.com | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false | unknown | ||
| false | unknown | ||
| false |
| unknown | |
| false | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 13.107.6.156 | unknown | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 152.199.19.160 | unknown | United States | 15133 | EDGECASTUS | false | |
| 40.126.32.140 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 13.107.246.45 | s-part-0017.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 52.109.89.18 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 20.189.173.5 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 172.217.18.14 | unknown | United States | 15169 | GOOGLEUS | false | |
| 104.102.41.166 | unknown | United States | 16625 | AKAMAI-ASUS | false | |
| 104.18.94.41 | unknown | United States | 13335 | CLOUDFLARENETUS | false | |
| 104.21.25.176 | yzpwvvyfpujhuri8bzaim9cqk9lqh7xhihnydfguqpg7hopl7b5677zv1g3.aeeouirl.ru | United States | 13335 | CLOUDFLARENETUS | false | |
| 172.217.23.106 | unknown | United States | 15169 | GOOGLEUS | false | |
| 151.101.130.137 | code.jquery.com | United States | 54113 | FASTLYUS | false | |
| 2.19.126.202 | unknown | European Union | 16625 | AKAMAI-ASUS | false | |
| 8.8.8.8 | unknown | United States | 15169 | GOOGLEUS | false | |
| 184.28.89.233 | unknown | United States | 16625 | AKAMAI-ASUS | false | |
| 191.252.128.160 | condominioanacarolina.com.br | Brazil | 27715 | LocawebServicosdeInternetSABR | false | |
| 40.126.32.74 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 88.221.110.176 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 2.19.126.160 | unknown | European Union | 16625 | AKAMAI-ASUS | false | |
| 52.109.89.19 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 35.190.80.1 | a.nel.cloudflare.com | United States | 15169 | GOOGLEUS | false | |
| 52.113.194.132 | unknown | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 104.17.24.14 | cdnjs.cloudflare.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 142.250.185.67 | unknown | United States | 15169 | GOOGLEUS | false | |
| 40.126.32.133 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 1.1.1.1 | unknown | Australia | 13335 | CLOUDFLARENETUS | false | |
| 108.177.15.84 | unknown | United States | 15169 | GOOGLEUS | false | |
| 52.98.227.178 | CDG-efz.ms-acdc.office.com | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 23.32.185.131 | unknown | United States | 16625 | AKAMAI-ASUS | false | |
| 104.18.95.41 | challenges.cloudflare.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 151.101.2.137 | unknown | United States | 54113 | FASTLYUS | false | |
| 88.221.110.163 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 188.114.97.3 | mrwa.ungonditc.com | European Union | 13335 | CLOUDFLARENETUS | false | |
| 142.250.185.174 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.195 | www.google.es | United States | 15169 | GOOGLEUS | false | |
| 188.114.96.3 | l4t2chw8bqozm6lxxwcveyntznrcndgjvjlajqr2jr8aui2nnscya6iv.birsbunh.ru | European Union | 13335 | CLOUDFLARENETUS | false | |
| 142.250.186.164 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 152.199.21.175 | sni1gl.wpc.omegacdn.net | United States | 15133 | EDGECASTUS | false | |
| 52.98.159.194 | ORY-efz.ms-acdc.office.com | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 2.18.64.218 | unknown | European Union | 6057 | AdministracionNacionaldeTelecomunicacionesUY | false | |
| 172.217.16.195 | unknown | United States | 15169 | GOOGLEUS | false | |
| 104.17.25.14 | unknown | United States | 13335 | CLOUDFLARENETUS | false | |
| 172.67.134.110 | ox0itqwgw8xcz6dl6uphi82rj1nkyu7hpvbuvd7nsbrtptg6jesm1kiu.aeeouirl.ru | United States | 13335 | CLOUDFLARENETUS | false |
| IP |
|---|
| 192.168.2.16 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1556705 |
| Start date and time: | 2024-11-15 21:11:45 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 23 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | stream |
| Analysis stop reason: | Timeout |
| Sample name: | ee0b6b037b16b54632b6b37d1fb72727.eml |
| Detection: | MAL |
| Classification: | mal48.winEML@60/57@89/331 |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 52.109.89.19, 2.19.126.160, 2.19.126.136, 20.189.173.5, 172.217.16.195
- Excluded domains from analysis (whitelisted): omex.cdn.office.net, onedscolprdwus04.westus.cloudapp.azure.com, slscr.update.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, clientservices.googleapis.com, weu-azsc-config.officeapps.live.com, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, login.live.com, officeclient.microsoft.com, a1864.dscd.akamai.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: ee0b6b037b16b54632b6b37d1fb72727.eml
| Input | Output |
|---|---|
| URL: email Model: Joe Sandbox AI | {
"explanation": [
"Suspicious sender domain 'generous-minds.com' doesn't match the claimed identity 'Audio.calls'",
"Contains suspicious long encoded URL that attempts to mask its true destination",
"Subject line about voicemail doesn't match the email thread content, indicating a spoofed conversation"
],
"phishing": true,
"confidence": 9
} |
{
"date": "Fri, 15 Nov 2024 17:21:09 -0800",
"subject": "[External] - MONTROSE-ENV: You have a Voice Mail (if)",
"communications": [
"You don't often get email from rbeuk@generous-minds.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>\n\n<https://www.google.es/url?q=querywbir(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fcondominioanacarolina.com.br%2flockeq%2fwtolwzl224moscrjiovolvgdhya1s0oym4bi4/a2VsbHkuc3dhbnNvbkBtb250cm9zZS1lbnYuY29t>\n\n[cid:C91B23753AA0697700D1@WINCLJBGQJP]\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n54054\n\n\n\n\n\n\nYes Have not received estimate. Thanks Cyndi.\n\n\nThank you,\nJohn M Herrmann\nSERVICE MANAGER\nHill Idealease, LLC\n740-633-3011(Office)\n724-531-1195(Cell)\n740-633-2140(Fax)\n------------------\n\n\n\n",
"From: Cyndi Matvya <cmatvya@shamrockutilitytrailer.com>\nSent: Wednesday, May 3, 2023 11:13 AM\nTo: John Herrmann <jherrmann@hillidealease.com>\nCc: Richard Reuille <rreuille@hillidealease.com>; Lisa Zwiesler <lzwiesler@hillidealease.com>\nSubject: RE: IDEALEASE 322913 / 321806\n\nUnit 321806 is in the shop.\n\nUnit #322913 Did you ever get a quote for this one, I seen it was started but looks like the parts were put on, I will have them get this done ASAP.\n\n\nThank you ~ and make it a great day.\n\n\nCyndi Matvya\nService Administrator & Accounts Receivable\nShamrock Utility Trailers, Inc\n500 North Center Avenue, New Stanton, PA 15672<500%20North%20Center%20Avenue,%20New%20Stanton,%20PA%20%2015672>\n724-925-9200\n724-925-6999 FAX\n\n\n\n",
"From: John Herrmann <jherrmann@hillidealease.com<mailto:jherrmann@hillidealease.com>>\nSent: Wednesday, May 3, 2023 10:53 AM\nTo: Cyndi Matvya <cmatvya@shamrockutilitytrailer.com<mailto:cmatvya@shamrockutilitytrailer.com>>\nCc: Richard Reuille <rreuille@hillidealease.com<mailto:rreuille@hillidealease.com>>; Lisa Zwiesler <lzwiesler@hillidealease.com<mailto:lzwiesler@hillidealease.com>>\nSubject: IDEALEASE 322913 / 321806\n\nGood morning Cyndi I wanted to check and see the status of the units 322913 and 321806 we have there for box repairs.\n\n\nThank you,\nJohn M Herrmann\nSERVICE MANAGER\nHill Idealease, LLC\n<span\n________________________________\nCONFIDENTIALITY NOTICE: The contents of this email message and any attachments are intended solely for the addressee(s) and may contain confidential, proprietary and/or privileged information and may be legally protected from disclosure. If you are not the intended recipient of this message or their agent, or if this message has been addressed to you in error, please immediately alert the sender by reply email and then delete this message and any attachments and the reply from your system. If you are not the intended recipient, you are hereby notified that any disclosure, use, dissemination, copying, or storage of this message or its attachments is strictly prohibited.\n"
],
"from": "\"Audio.calls\" <rbeuk@generous-minds.com>",
"to": "kelly.swanson@montrose-env.com",
"attachements": [
"ilil.pdf"
]
} | |
| URL: Email Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "To listen to your voicemail, please click the button below",
"prominent_button_name": "Listen Now",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false
} |
 | |
| URL: Email Model: Joe Sandbox AI | ```json
{
"brands": [
"Generous Minds"
]
} |
| |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Confirming your browser to ensure a secure browsing experience.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: http://condominioanacarolina.com.br Model: Joe Sandbox AI | {
"typosquatting": false,
"unusual_query_string": false,
"suspicious_tld": false,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": false,
"redirection": false,
"contains_email_address": false,
"known_domain": false,
"brand_spoofing_attempt": false,
"third_party_hosting": false
} |
URL: http://condominioanacarolina.com.br | |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Confirming your browser to ensure a secure browsing experience.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": true,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"brands": []
} |
| |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Confirming your browser to ensure a secure browsing experience.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"brands": [
"Cloudflare"
]
} |
| |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"brands": [
"Cloudflare"
]
} |
| |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Ensuring your safety by conducting browser checks.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Ensuring your safety by conducting browser checks.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"brands": []
} |
| |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"brands": [
"Cloudflare"
]
} |
| |
| URL: https://login.microsoftonline.com Model: Joe Sandbox AI | {
"typosquatting": false,
"unusual_query_string": false,
"suspicious_tld": false,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": false,
"redirection": false,
"contains_email_address": false,
"known_domain": true,
"brand_spoofing_attempt": false,
"third_party_hosting": false
} |
URL: https://login.microsoftonline.com | |
| URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2 Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Sign in",
"prominent_button_name": "Next",
"text_input_field_labels": [
"Email, phone, or Skype",
"No account? Create one!",
"Can't access your account?"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2 Model: Joe Sandbox AI | ```json
{
"brands": [
"Microsoft"
]
} |
| |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Conducting security checks to protect your browser.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"brands": [
"Cloudflare"
]
} |
 | |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Conducting security checks to protect your browser.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false
} |
 | |
| URL: https://mrwa.ungonditc.com/aIEqPG/#Dkelly.swanson@montrose-env.com Model: Joe Sandbox AI | ```json
{
"brands": [
"Cloudflare"
]
} |
| |
| URL: https://microsoft.com Model: Joe Sandbox AI | {
"typosquatting": false,
"unusual_query_string": false,
"suspicious_tld": false,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": false,
"redirection": false,
"contains_email_address": false,
"known_domain": true,
"brand_spoofing_attempt": false,
"third_party_hosting": false
} |
URL: https://microsoft.com | |
| URL: https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook?deeplink=%2fowa%2f&sdf=0 Model: Joe Sandbox AI | ```json
{
"contains_trigger_text": true,
"trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:",
"prominent_button_name": "United States English Microsoft Homepage",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false
} |
 | |
| URL: https://www.microsoft.com Model: Joe Sandbox AI | {
"typosquatting": false,
"unusual_query_string": false,
"suspicious_tld": false,
"ip_in_url": false,
"long_subdomain": false,
"malicious_keywords": false,
"encoded_characters": false,
"redirection": false,
"contains_email_address": false,
"known_domain": true,
"brand_spoofing_attempt": false,
"third_party_hosting": false
} |
URL: https://www.microsoft.com | |
| URL: https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook?deeplink=%2fowa%2f&sdf=0 Model: Joe Sandbox AI | ```json
{
"brands": [
"Microsoft"
]
} |
|
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 231348 |
| Entropy (8bit): | 4.391437478040974 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 3DCCDC55441FE397F24BD462F1857611 |
| SHA1: | 8149C25B58ECF9F8FF9B546AB1D25B06704AE3D2 |
| SHA-256: | 099E51D16FE97EED148C57BB8B268BD91528451AD503D912814FF7302A3F39CC |
| SHA-512: | F72AC93D8FDB24DB95A02CFE68253D36A254AD9FDF41B52D3E019C215E09428A51D081D6A1A0A516E95B3245C4320C8D750E97B3F88B6FC87CA8EA3585C92630 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 322260 |
| Entropy (8bit): | 4.000299760592446 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CC90D669144261B198DEAD45AA266572 |
| SHA1: | EF164048A8BC8BD3A015CF63E78BDAC720071305 |
| SHA-256: | 89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899 |
| SHA-512: | 16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 10 |
| Entropy (8bit): | 2.4464393446710155 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 23CDD3C2BF36F44AC865D5C2EC815FC3 |
| SHA1: | F93B54AC79770F6E9B8883C1F966852A4711A69C |
| SHA-256: | FA007B3E07C5849DC82745D45A783C1A88DC69FB6CB8DD01FB4764887A23B455 |
| SHA-512: | 49127BE20B1479360BC2365BCD4BEB6855DD2FA92513728C9A5F2CA9050B749ADADEF59FE8B25CF32D0F9186DADF28BFEEBC09F5B97AFFEF311E7B3BC09DE7BE |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7FE24FCC-E5E6-49E3-BC4A-4943CEFAF418
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 180288 |
| Entropy (8bit): | 5.290980264446109 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | AADFA375FC5939560C91A6EBB406292A |
| SHA1: | 748C49323533EE0E9A4285E053129E36D3B9A79D |
| SHA-256: | 201384849706848666E4B07E754BEEC23CF82B7F58E8A7AC75E1E535F96F7E20 |
| SHA-512: | 2AE23B97C94A7BDA65AA996744AF557B26F325A5658944EBD633173972E2519E0AC608CD446C33D2AE26F090E654F244D82C1DA215D9F20EB4D94A2E00A9CB93 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4096 |
| Entropy (8bit): | 0.09216609452072291 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F138A66469C10D5761C6CBB36F2163C3 |
| SHA1: | EEA136206474280549586923B7A4A3C6D5DB1E25 |
| SHA-256: | C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6 |
| SHA-512: | 9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4616 |
| Entropy (8bit): | 0.13760166725504608 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A8709B9197F5C93A2DED9AA5A8EC9FA2 |
| SHA1: | 89AA23DA38F7DDF96D84C4A8F39EAB7EBB84AE21 |
| SHA-256: | AD11D285461A4BE2E4C06265032BC6B4C365EBD9AFF8C7A3C623BC255A26CD75 |
| SHA-512: | 1254B6702FB4EA58CCAA12C88C4D04A76F0B2CCF6463306858F402C9A85F981567209C5FE928DC6B36AE240D5E9BE40B3D295443ACBEB863833478200B802EEF |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 32768 |
| Entropy (8bit): | 0.04449651975591713 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 7A8DF2A8DDAC9FC5538F2C436DFD07BD |
| SHA1: | 333957C55A1061F324D8AEED1D0DD985DE78A1FA |
| SHA-256: | 6A76748184F88BBBF28CD953817B14938BCB851E2EDE139B4C5E54954CF1D5BE |
| SHA-512: | 8801049356CD4AC599FFFE5FBDE65A51C02AA49CF5B5A314C32A8E4786D1A0AD8CDC3ED4210D95C40558D9C2B715EFF85CB83781725A158D2BBEACF8B6426661 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 45352 |
| Entropy (8bit): | 0.39459034819233635 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B8593D356F7726E6A4EBC23A41A7FEF8 |
| SHA1: | 9171F47AD8BDA28860980F03DD6E7C6756A5656F |
| SHA-256: | 7AF38E837660ED60E99DC8907D730D1F2B4630E52875CD5152D729F525B003A2 |
| SHA-512: | 1E55425B56FB257FEB1B06DF6C514634145F763E4A3460659CC63715ECAE4E596F1C25004A1D9AE5BF895A728E684F80F26C06645F491CD697F5C1D1D1A1835B |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 82368 |
| Entropy (8bit): | 7.8980673829519885 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CD30258B77CF3300C43D7984FC667976 |
| SHA1: | FBF893AE35B7CA03C82F70D665515D962C5321A4 |
| SHA-256: | 344938F2E50CE50316A1400FD8965085DD859889721D47756645E6CA532E895D |
| SHA-512: | C6FE276EA27BC51F06A055C2F53B8921C30A411796069B91E24C5C0624408749423787A2C441D4D4F1709604CDB166C3044BF5296CAD8A3E67DF6365FF7BD8B7 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{0BF5F41C-A174-4C0A-A5F7-35A791FAE1D2}.tmp
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10716 |
| Entropy (8bit): | 3.6527240776470755 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | E68A3C8689F81B57D4AF7537BB38BE5C |
| SHA1: | CE22CA4E70DEF93DB6EF6C0E78B5D23B7FBF1D26 |
| SHA-256: | 3BE7F3B5E06B480E6ED05A9835E54D8A5A8EA70EF3B62A22817A6A9FD5D60A63 |
| SHA-512: | 53DBE687EC633DFA8E9F2CF3CCB777DF61F13FA2107A7C87C0F7301C3BDA02B8D5D193CE13DB7AC747A49D1233EFD130923FBD04C29A4CA499642B66431A6381 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1731701539002280800_724FEF67-A747-4055-BD35-B5E373A6D3A2.log
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20971520 |
| Entropy (8bit): | 0.007811362792378627 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8261F74991F01BB8F8AB92E02CA8B730 |
| SHA1: | E14FE656A160D04C34CE1AA9516E19F2F81BD1A7 |
| SHA-256: | 7B117EB9D1D2C72D0A75AB9FEEF279A132E861352451257961AAA8237B4D2903 |
| SHA-512: | C60D2731FA548A5DB1E7311A64D7122C77F1E221C36925A5B4879AB3C73252D25552AD9D48733F826580AD426751D504900E6B1C8AE8A854818D73926496DCA1 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1731701539002968000_724FEF67-A747-4055-BD35-B5E373A6D3A2.log
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 20971520 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8F4E33F3DC3E414FF94E5FB6905CBA8C |
| SHA1: | 9674344C90C2F0646F0B78026E127C9B86E3AD77 |
| SHA-256: | CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC |
| SHA-512: | 7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241115T1512180845-6428.etl
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 131072 |
| Entropy (8bit): | 4.701201381242015 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C57C75799E87B023A6B9210D9D3772FA |
| SHA1: | 5743BC1B2ADC67A8BD5A5E4C7CCA758193B02004 |
| SHA-256: | 368A46C774ED960F6C0E5FAD7AB8BFC1BF438FB134816441CF0B00D4357D4DD0 |
| SHA-512: | 8613F836993E5D215F0197337392647D7A5D644FA786D16CB3F681E3CA75A66711BED6AFCB0D26192E436832ABA3869571CD80F71925B27A9715F0EB43DB6AE7 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 30 |
| Entropy (8bit): | 1.2389205950315936 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 53CFA05FD097456CE7D5FAF7CE8AD83C |
| SHA1: | 902A3A05FA3FBD9F83C904ACB05870E72E9BBB16 |
| SHA-256: | 81F6BE4FF986B0D09569365472B22CA5F8EC301455E3B6D72471CA7F62C78F4B |
| SHA-512: | 645E7ED9B1CB2F4595ACC7EF19585B42D6C85390017F3B8E3F7D542853B0BC055A72866A684DAF006E351C82838477336052C3E2F0A24D69A8A21CECDF5A4934 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 16384 |
| Entropy (8bit): | 0.6697884749581648 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D86A30DF902425F03B8BCEB9EA0F32DE |
| SHA1: | 63A85A38F963073D3198B2A7917CC0227268D9FD |
| SHA-256: | EC59E969B08DC7F6B3A7C2CEF919A71A331D06404D846F5AFE2FA8314F62742D |
| SHA-512: | D40CEA41B01BA780B070D845BB3177DE3EFBCCFE5082B0BB4F6385126D38F904B42CC0B9AE04920D34B33A4A145D3A889F299B1B39B86514B8328A920E812CB8 |
| Malicious: | true |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2673 |
| Entropy (8bit): | 3.9838745898457644 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4A54892C3A6BC0D77B45312B0699193A |
| SHA1: | F49CF6A56937160A2B45E6EF7E4A4B5D456683CB |
| SHA-256: | C56026389B2584A47DCE7FE50753839266F71F547A56FEA524BE1C29DEFA0023 |
| SHA-512: | 122E84E40B186FD241462828F6FF691C667A2AAE725C036676350B360FC437655DF58F5185EF6968736DE2C9977B3CE2E44F066BB903BD1EBA5DA89DC0CD5C29 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2675 |
| Entropy (8bit): | 4.000327326578854 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A07E4ADA8C1B1698A77AE1837302EA89 |
| SHA1: | B65570CEF513187667901A225890ED6472A894FA |
| SHA-256: | 2991852B7300280CA22CCBE2BFED82BC01DD173F4B5D9244E4A571D402DA8C6B |
| SHA-512: | BBB687A39E1028E83C4B332BAA27D0EBB116E8E7F46EB164A79C81E9DD04F60A5FA3EE03FC72C5A3DC3173CE327815468D5AB75121C35CB29B712E648E77A2C1 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2689 |
| Entropy (8bit): | 4.0064229982503266 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 816CF523C26E3E6B3859C5E4EF559305 |
| SHA1: | BD1716E80E3DE14DA111C1784638F5D51F4E6FBB |
| SHA-256: | 4A438A76C147A69F3AC40E6FACA7398D43D60CDCA226F7D10C1B6514B7D24DDE |
| SHA-512: | 9721806DA33DC468BCF58C0A9406E02E0342B9F7B82DC37EF940B2A71331CC34FA7DA3EC21A0F790F1D0A28AF218E21F7093F69D38B3F609D8D85A3A85CEAC77 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.995908833152216 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8D564EB2B3D90DC0DAE7CC199D39705D |
| SHA1: | E92D1972600B801644F7BDE3A9E0AAEF367AA395 |
| SHA-256: | F6DBCF33BE54C6111A50CB8CA35F70864E23302571C52ED13F3063254F8461A5 |
| SHA-512: | 0347E224FEC5085727B344FDDE638C721C3C0B866A9FABD747D60783EC363BFBD5B14E1E9DA248FA9A34F66CEE206458CCB6D0348FCAB44AFC6806FB50417BDE |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.9839624607127586 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 38BC9B9CABFAACA711F59652AC3DE57D |
| SHA1: | 1EBEE77D7F596A672457CC0C8AA6BF0D411D5C51 |
| SHA-256: | D7CD5ED15ADF728355F1925F64C950CD5EFDDD35AE0B7344F92D38458896A53D |
| SHA-512: | 7696061AD9E1D6193E4D093D95846A41B9C9DBFF1D56F0ABB6D3AEB35CE5FFF63DE049DC7850ED04C7B5920BB43F9B76002D90AE6E898601467E1A9DD5DF09AF |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.995274545513944 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 380B6BC7C8CF95BDF9A29D11E4F715A4 |
| SHA1: | 82956BCFDEE56A74FC2BD3FC8336F15D13ABD55F |
| SHA-256: | E75CD45C088C253FE1D48B930623D90C3C1D60C6B98CC2C1769A595205FD1907 |
| SHA-512: | 887F338E4B55AADAC8B480950728ACD7D13005D4C748FB68640DD8086A626AF356A1D5E78B29A6499720E1CA52F1F90D27343E8D2B36DBDA19825B5D6F9F995E |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2302976 |
| Entropy (8bit): | 1.3455104413868888 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | FCB5237533859A4E2106C6FE320B217B |
| SHA1: | ACBBC0B06BD4442EA6924E1CB590F6CF86F47B73 |
| SHA-256: | 81946A7396A1C06C8F528DA0E0E948477F04269D5342975DAFB2EA097E5087F5 |
| SHA-512: | 5F58DE19971BD4D5E27FB623FC3336C810AD8BA690194830D0455931DEC6800D9D55CB73DFF647BED4B5AC3F4157665A77D6C434793BBC68C43170F2A2275904 |
| Malicious: | true |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 393216 |
| Entropy (8bit): | 5.253414177367724 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A175A4FA667759E0CD1DA432DE442726 |
| SHA1: | 412C03798DD0DD50BD9A67B81EB9B346026EDE55 |
| SHA-256: | 0D0FC579AF48FA9EFFD896F16E2CCE1E542F4C523774B02D419C2704422F2669 |
| SHA-512: | F6323476EF7ABBBF7AEF1508CB647B49E6D54E38BED56C060158AE4AE8D05D1A3EA77771A3A23CF476AA5A8FE4C75B9917A4ED06436EDC3D002E56A4EB2BCB5B |
| Malicious: | true |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 48316 |
| Entropy (8bit): | 5.6346993394709 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 2CA03AD87885AB983541092B87ADB299 |
| SHA1: | 1A17F60BF776A8C468A185C1E8E985C41A50DC27 |
| SHA-256: | 8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762 |
| SHA-512: | 13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3452 |
| Entropy (8bit): | 5.117912766689607 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CB06E9A552B197D5C0EA600B431A3407 |
| SHA1: | 04E167433F2F1038C78F387F8A166BB6542C2008 |
| SHA-256: | 1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021 |
| SHA-512: | 1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://login.live.com/Me.htm?v=3 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 513 |
| Entropy (8bit): | 5.350826451115093 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 602C381194795DFC124FACDF48492EF1 |
| SHA1: | 90D594B7B5AF217824F2974514548C95FECFBFA5 |
| SHA-256: | BF450798FB52E2458A1E10749577E5334F3E1D7907A47FDFEA5430CB71FA19E6 |
| SHA-512: | 8837F6BD2A11387D31A866D07B66A0FF2E58D2EDC2682A582919A1896CE9B4CB683A795D91968B41FA46C31CE62D34414E1F3318D4F5DDA2999447F4BCA6133D |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=f65ecb70-094d-0b11-7c9d-7da1bcadfaa7 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1435 |
| Entropy (8bit): | 7.8613342322590265 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9F368BC4580FED907775F31C6B26D6CF |
| SHA1: | E393A40B3E337F43057EEE3DE189F197AB056451 |
| SHA-256: | 7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36 |
| SHA-512: | 0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 142367 |
| Entropy (8bit): | 5.430597817875451 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CCAA31FD031C4C856EB7B986FD9F447B |
| SHA1: | 0A809EABCDB95FA04DE5F8409B3BC994ED65CBD1 |
| SHA-256: | 3D40B4129B8B4C284908636AE46D72EA053F286FB5FE45DB78351B5B2CFC1EB9 |
| SHA-512: | 4B5B2271DB5F640FEBF13A7C0BDBD630C73530000F1593046D090585D1752E239D894614E23E801BE4C6A379406B6EF521423FA27C3865C3CD4ABB0A64823780 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 15880 |
| Entropy (8bit): | 5.926995596321435 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 5F4991D277F35CB0E590DC07DFD74592 |
| SHA1: | 4C72292D83366BC03D6B28B2C2DF0E6FF46E4C2C |
| SHA-256: | 3E922C5DAFD37C9E0361DC9B54FAD5626507072A76B915D11D63A90553916F89 |
| SHA-512: | F6253F53D06B29ADFCE3D028849B7EF6DDA9E8CE0067D858E26C448FCD4D9B0FC8A7C3750BBAB24489D6A2D50143F437A0FC200A49265781190240D697893B3F |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://mrwa.ungonditc.com/aIEqPG/ |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 47672 |
| Entropy (8bit): | 5.401921124762015 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B804BCD42117B1BBE45326212AF85105 |
| SHA1: | 7B4175AAF0B7E45E03390F50CB8ED93185017014 |
| SHA-256: | B7595C3D2E94DF7416308FA2CCF5AE8832137C76D2E9A8B02E6ED2CB2D92E2F7 |
| SHA-512: | 9A4F038F9010DDCCF5E0FAF97102465EF7BA27B33F55C4B86D167C41096DB1E76C8212A5E36565F0447C4F57340A10DB07BB9AE26982DFFF92C411B5B1F1FB97 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 89501 |
| Entropy (8bit): | 5.289893677458563 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8FB8FEE4FCC3CC86FF6C724154C49C42 |
| SHA1: | B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4 |
| SHA-256: | FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E |
| SHA-512: | F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 116365 |
| Entropy (8bit): | 7.997737813291819 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 2D3FBED6DDD719FCC1BFB500B612FCEC |
| SHA1: | CD91B795DDE806AC8A38E51CCB6E8BAD8E57DA1B |
| SHA-256: | B2566B646F02DF4CE30B05D8223B78130A719D4EC9E4794A0106C371ADE33CC7 |
| SHA-512: | A870E514B325D6FDC4D154438A8DD333C7AB46E545C1B27AC4869D9F1D8594CA1CDC530F5E96C835220DDAD4E1CEF841673696978031B5237E783972AEE701D1 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 16326 |
| Entropy (8bit): | 7.987374325584103 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C217AE35B8592DC9F1E680487DAD094F |
| SHA1: | 2E642562C2BFD8968629317FF212684C7EB59193 |
| SHA-256: | D41992E79D7BCFCC1F32597208DD99033D99C04882EAFCC8508F2FA0EE728C6B |
| SHA-512: | EAF3BF49BCF58A7F7C39CBF35FD75862FEE98F611536080DFC794D288274CB9D67E95D0299679F7981E110B2577A47579D3623C7F11A6AC2A0CFA56AAEA2CAB0 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 122342 |
| Entropy (8bit): | 7.997532685332134 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 147E69329BBA6FCE4DDE9F78ED77B09C |
| SHA1: | 562AAB06119DA1887889091BD4ED50EA28BCA5B6 |
| SHA-256: | EC4EF3667A279D376892CD32D3E03852EAA04633FD1B2191E74F6312DA2C1D4A |
| SHA-512: | CFBD3615F3581F4754E10EA4636423924187E4AD26F02EA613FED5C616A7118FE62D490CDE224E5AF4FAB5D54DC13C6DEEA82FA938F3DAA1EE0229C2D4705358 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 35168 |
| Entropy (8bit): | 7.99275807202193 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | D3B6AE9986DF244AB03412CC700335D0 |
| SHA1: | BAAA1F9899178938F3881F09B18265E47DA806E3 |
| SHA-256: | CA50059111D30C2E212C90805792EB543548AEF0D4941E886A778E3DCE0B9066 |
| SHA-512: | 755C57FBC9BECE435A477F76C5E8198CA8942C23BE667ACAB83A00E5CD4F54075B10AA07C7FDC10C38FC3D5C0C406C9132FEB5B67BA5BCCC57EF796054A84E7C |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 61 |
| Entropy (8bit): | 3.9902101553250042 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0ED14AF36F2244A2F02C53D5EA300686 |
| SHA1: | 01E2ECB913536B9325C3A8FE6AD26B954D14753C |
| SHA-256: | 69E572F8A1712ECE5B8BE0A95E10F808BCBA4AC9CA31A553A820AD948604443C |
| SHA-512: | A31CF0251391FA320889C83408F15C2B63EA4A5B878F85CA3EF591FFB3E7F52E128AE1EBE253B3C8CE6B7A5F1F104CBC35DF1757306BF07A78A0295D6F3631E6 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8e31e5c8d84a3468/1731701564320/DHJ-Ff0u-GtLTiF |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 61 |
| Entropy (8bit): | 4.035372245524405 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 57C8353D95A7610C40A982ABB97F1DDC |
| SHA1: | FFC36C413360259ACA19205D3B8531B904E22955 |
| SHA-256: | 9A434FD42FF7932B35D5392ABBE946059956EEF622968BB727719279D82D857E |
| SHA-512: | 8614E6D1F8F044AC8CDACE2BD05D22EC1AB6551AE75C00AEB68272038CA9DC8DF0B8E9E84714A1480B6A9CFC18F0A37A436A112E4D844C03E3F34AF272C01FC7 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 17174 |
| Entropy (8bit): | 2.9129715116732746 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 12E3DAC858061D088023B2BD48E2FA96 |
| SHA1: | E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 |
| SHA-256: | 90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21 |
| SHA-512: | C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://www.microsoft.com/favicon.ico?v2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 201253 |
| Entropy (8bit): | 2.661810841903416 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 85DE642E1467807F64F7E10807DF3869 |
| SHA1: | C795B490811C0E5A1A8F3C3F620AAB9F00C34F07 |
| SHA-256: | 5965B2C5472AACA1CD66EA5B0D07A971B961FEE72FC27EB1F6C760042084B21B |
| SHA-512: | BF4EC56D6FC54EAAFBD57C4E4D06900D358E39CE15009FB983491B0A83ABB60A0A54F46BE86387AB837B4AE1D1F3FF99156D04207065B0F65F165B54CFAAF47B |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook?deeplink=%2fowa%2f&sdf=0 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 36 |
| Entropy (8bit): | 4.503258334775644 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 06B313E93DD76909460FBFC0CD98CB6B |
| SHA1: | C4F9B2BBD840A4328F85F54873C434336A193888 |
| SHA-256: | B4532478707B495D0BB1C21C314AEF959DD1A5E0F66E52DAD5FC332C8B697CBA |
| SHA-512: | EFD7E8195D9C126883C71FED3EFEDE55916848B784F8434ED2677DF5004436F7EDE9F80277CB4675C4DEB8F243B2705A3806B412FAA8842E039E9DC467C11645 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 5529 |
| Entropy (8bit): | 7.95514518328613 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 6DEB44A9FE273266EFABC3214B998BA0 |
| SHA1: | C8BE755694C25E416C81F5057670E3B14B2FE08F |
| SHA-256: | 4A1AA3B8B23FB3C150A62BB681DAE96E6CAB20BFAFB89D74FED2E0BC85826BAF |
| SHA-512: | EBA11F91C3751574F82FBF82F81338761142ABC13B14534133A2986BEF2F2505125B648E1E991F79C1ACC731A9008F98C3F7937649533E7C4E59C2548D4E7452 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 15 |
| Entropy (8bit): | 3.189898095464287 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 39A19D0882684989864FA50BCED6A2D1 |
| SHA1: | 5CED55DAC2E0427E9DC605CEC1FEDAB0949EB15E |
| SHA-256: | 8FBEDED073249C3611742297EE96A976A95EE113F33B9A422A5D3A7A2DEB63E5 |
| SHA-512: | E795CB7DE27B42948B7DDFF19F3B401A8F95753AC7D37D9B5F52D8DACD2AA43A2AD9EACEC29F77D28080E20C21C48B9FA88A733FAC108939FB2F0EB036C7AEEE |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 621 |
| Entropy (8bit): | 7.673946009263606 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4761405717E938D7E7400BB15715DB1E |
| SHA1: | 76FED7C229D353A27DB3257F5927C1EAF0AB8DE9 |
| SHA-256: | F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF |
| SHA-512: | E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 92629 |
| Entropy (8bit): | 5.303443527492463 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 397754BA49E9E0CF4E7C190DA78DDA05 |
| SHA1: | AE49E56999D82802727455F0BA83B63ACD90A22B |
| SHA-256: | C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4 |
| SHA-512: | 8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 20400 |
| Entropy (8bit): | 7.980289584022803 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F0DE9A98DBDFA8C02742CE6D92FB2524 |
| SHA1: | CDEC682AEB9E39EDCCC2374DAB26F04DB754A8B5 |
| SHA-256: | FAF4294F27A542B0F9EA2A7CB2711529AB027CD84A5F5BADFAE752100855E6BE |
| SHA-512: | 856FC9AB199997E69A9487372BC0083564F7115B3E0678CF1D542B9864E9A88D5FFB85697FD93538DC9439071E3BCD4B8BCCBFC610E1A45DE104D6362D8ADCD9 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 131537 |
| Entropy (8bit): | 5.2237799798561975 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 30B7C335C62E5269E2D35B8E8B9F44B4 |
| SHA1: | C6D92B1516EB8F6D44AAF171FB24A1B2AADD0C4C |
| SHA-256: | 10733A5D876108F81C5F78EEE5C9760A739D89C52FA6180C4290B7F909F24346 |
| SHA-512: | 5BCE247C84C88F993A857CE2F1E8540C648672DEB6D92A55BC808C33394B784C52866D635BEC8B7CD5E62A7EA4109569AC8BCD1381571B84592ACD6C5901D7A8 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/1b-c96630/db-bc0148/dc-7e9864/78-4c7d22/e1-c35781/40-7b7803/cd-23d3b0/6d-1e7ed0/b7-cadaa7/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/db-f3b1fd/93-283c2d/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/19-c0fae7?ver=2.0&iife=1 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 61 |
| Entropy (8bit): | 3.990210155325004 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9246CCA8FC3C00F50035F28E9F6B7F7D |
| SHA1: | 3AA538440F70873B574F40CD793060F53EC17A5D |
| SHA-256: | C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84 |
| SHA-512: | A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 61 |
| Entropy (8bit): | 3.9778349503715043 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 228B63099E198B831BF889D6ACF4D50E |
| SHA1: | 6930398EE84FBE62908E7E5F6F2A4DE121A1372B |
| SHA-256: | EDEF72AC444C19F9387816DC0F6A5CF0D074E0B25639375306CA79B36BF32FC8 |
| SHA-512: | E2B497F4B2CCC9FE6AC67EDD32466C4EA31B80CA192B192B1744A0B2B4FE918E17C52F75BCE4F08395D49120A90BDDE471B239B40E07EE3430960AC25D1605B8 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8e31e7aafcda144b/1731701641045/-bGdmoW2_wt1SdQ |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2672 |
| Entropy (8bit): | 6.640973516071413 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 166DE53471265253AB3A456DEFE6DA23 |
| SHA1: | 17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D |
| SHA-256: | A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13 |
| SHA-512: | 80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1 |
| Entropy (8bit): | 0.0 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C4CA4238A0B923820DCC509A6F75849B |
| SHA1: | 356A192B7913B04C54574D18C28D46E6395428AB |
| SHA-256: | 6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B |
| SHA-512: | 4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 563851 |
| Entropy (8bit): | 5.221453271093944 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 12DD1E4D0485A80184B36D158018DE81 |
| SHA1: | EB2594062E90E3DCD5127679F9C369D3BF39D61C |
| SHA-256: | A04B5B8B345E79987621008E6CC9BEF2B684663F9A820A0C7460E727A2A4DDC3 |
| SHA-512: | F3A92BF0C681E6D2198970F43B966ABDF8CCBFF3F9BD5136A1CA911747369C49F8C36C69A7E98E0F2AED3163D9D1C5D44EFCE67A178DE479196845721219E12C |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 26288 |
| Entropy (8bit): | 7.984195877171481 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D0263DC03BE4C393A90BDA733C57D6DB |
| SHA1: | 8A032B6DEAB53A33234C735133B48518F8643B92 |
| SHA-256: | 22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12 |
| SHA-512: | 9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 673 |
| Entropy (8bit): | 7.6596900876595075 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 0E176276362B94279A4492511BFCBD98 |
| SHA1: | 389FE6B51F62254BB98939896B8C89EBEFFE2A02 |
| SHA-256: | 9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C |
| SHA-512: | 8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3620 |
| Entropy (8bit): | 6.867828878374734 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B540A8E518037192E32C4FE58BF2DBAB |
| SHA1: | 3047C1DB97B86F6981E0AD2F96AF40CDF43511AF |
| SHA-256: | 8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D |
| SHA-512: | E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 315 |
| Entropy (8bit): | 5.0572271090563765 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A34AC19F4AFAE63ADC5D2F7BC970C07F |
| SHA1: | A82190FC530C265AA40A045C21770D967F4767B8 |
| SHA-256: | D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3 |
| SHA-512: | 42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | http://condominioanacarolina.com.br/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 167730 |
| Entropy (8bit): | 5.045981547409661 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | AFB5C64B13342F6E568093548D0A2A9F |
| SHA1: | 95FC121CCCFDBA12443CF87A9C823486065A14AB |
| SHA-256: | 238DB52476BF8107E2E851CD3299B071ED5944B570C1603A1EA758A4FADF5F29 |
| SHA-512: | 6FE8BADD1B94E81464C0808383A4CC77F779BF226A3C13B58B2BCB36332995EFBC7711373EE8AB2A8BC52675884F9885D168CB2DE9535E39E71B0B72940691E1 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/51-40faf7?ver=2.0 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 61 |
| Entropy (8bit): | 4.014960565232003 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | FE245F849186FA0ED4DB94617B46FE0A |
| SHA1: | 58A615ABE638C7AD79C49DD114A7261D9920C13B |
| SHA-256: | B1931DBA22C99A20E6A147F712E61B3BB0E9C2A1C4AF661E65BA5098934FB146 |
| SHA-512: | C0F584A1A60C3C47D9D75CAB27808D96F5E8EDC261A79302F7127D01940F49D42D144D1117FF24ABB80C6F5A87FA7BD90A67284060C4B1F98FCF70B09ED708ED |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.197036035947996 |
| TrID: |
|
| File name: | ee0b6b037b16b54632b6b37d1fb72727.eml |
| File size: | 205'664 bytes |
| MD5: | 4b9e5facdef9a6a766716ef1a494d15c |
| SHA1: | c7df5078fe1808cc06078c8d2629835732e97dc9 |
| SHA256: | 4d156810843e3438e761c4f3cbfecaccd29c4b64b2ea6aa73e54aed5283cf120 |
| SHA512: | 81797d3724bc07bb3f3574cd394b65ac23e5369b6b1ba30d87165f714c6f243d760ed33730c2c61d7e695e79df6bee38792babd31a7fa6baab10efce7187c150 |
| SSDEEP: | 6144:bdksZIfYsEZkRwDKZwaGLiAKWtr/rySq2LUDS29666r:bdksZIfYsghiAdrTnb4u |
| TLSH: | 3F147D47EDD50E71CC9A20EC2C07776F3A7808EBD927AC70AAEE765F090ECD9914A115 |
| File Content Preview: | From nobody Fri Nov 15 20:07:29 2024.X-MS-Exchange-Organization-InternalOrgSender: False.ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;. b=j2MTXz0IzWT6fasm+8qIFRZ7dBxhFmhrnMhSjj3RALCXLY48luWDS7/1CRl45ROjSbFj6m/ltNFYrIRC97oSYaeJ |
| Subject: | [External] - MONTROSE-ENV: You have a Voice Mail (if) |
| From: | "Audio.calls" <rbeuk@generous-minds.com> |
| To: | kelly.swanson@montrose-env.com |
| Cc: | |
| BCC: | |
| Date: | Fri, 15 Nov 2024 17:21:09 -0800 |
| Communications: |
|
| Attachments: |
|
| Key | Value |
|---|---|
| X-MS-Exchange-Organization-InternalOrgSender | False |
| ARC-Seal | i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Aw0bxXWPzNzW59z/62NmJhlaMr3lbWtk4Q7QLROefbauqa8gvKTCExft349e+drI0AcES12h11zO7q4nm3PIrnCrkaMAW0ioiRS3y1kJJiYG5A2CXs3WiWadsgSIGCSHrOn7XYsBXqPbQOvo1U3fz0uoh2GheKADimGCUeTh6ni1qoS3VtyF1SfHotSpJ6WUGIS05VnnIGhQWjMpN0DJz4rkVfRDiE4FzX2Y7IRiwsnN3tqaWC3X9f4e0RzBTOBsaqtmUs4WZpFSF8vwtGjh4PPabUoF+CQiv21sO4+Ml77vYRyDi9KdJB/GuXPmohUD1Gk96pL9FTXHMOQPw3sg0A== |
| ARC-Message-Signature | i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Y5V/xx3CJ3ZeC+Yb2J4fKYGaIfNyA44lj4+dHdJz7r8=; b=vbv+x/5vZSDCVV8yiN2Sx7B/nPDi8+XlznHeg2P2WBJDyXezHBpwCOO8Ae2tw8GVOxzKOn3mvdtCj18YLHIcYyU8kCEFr+XbvNiYP2AyW3h2NBy5Sf9WRThytlYdPUPVHiUKKiG+QciHWiiDBgX0wCWsH9a/gHibGCMIp2dDf50grKsNz8XwVAWMayC8NTOojehBMqskqsODZI43S3tQwT0QTbMw1er9ud7FCm3UDlEB6NZg6UAILf1alFL8D52RpeV9Tf4AUie0DeyoPotmnjGgHZFKjjiImuEhBvaPWKBDucDgLWC8zdsoFIbfdTazpnlJ6Wh0ATGTjC71vV2pdg== |
| ARC-Authentication-Results | i=1; mx.microsoft.com 1; spf=fail (sender ip is 173.195.100.199) smtp.rcpttodomain=montrose-env.com smtp.mailfrom=generous-minds.com; dmarc=fail (p=none sp=none pct=100) action=none header.from=generous-minds.com; dkim=none (message not signed); arc=none (0) |
| Received | from cloudfare.com (173.195.100.199) by DU6PEPF0000B621.mail.protection.outlook.com (10.167.8.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8158.14 via Frontend Transport; Fri, 15 Nov 2024 18:28:20 +0000 |
| Authentication-Results | spf=pass (sender IP is 40.107.247.116) smtp.mailfrom=generous-minds.com; dkim=pass (signature was verified) header.d=generousminds.onmicrosoft.com;dmarc=pass action=none header.from=generous-minds.com;compauth=pass reason=100 |
| Received-SPF | Fail (protection.outlook.com: domain of generous-minds.com does not designate 173.195.100.199 as permitted sender) receiver=protection.outlook.com; client-ip=173.195.100.199; helo=cloudfare.com; |
| DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=generousminds.onmicrosoft.com; s=selector2-generousminds-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Y5V/xx3CJ3ZeC+Yb2J4fKYGaIfNyA44lj4+dHdJz7r8=; b=tTpqZ0r+yE9jZ7xccQ5ibSJD8YX6FXtQjb619+4iurrw+TgBN+dnivlDkvCwtGx3lm3L7sr23W1HQKr+oEtkWpEMayc1eIIcxe6RLPifVH1Cio4YHHXUt0nBspAsf6H7enWk318G/Cf8/V/q0hlMH6oAwfjkqf3BZRZnh5OF2mU= |
| X-MS-Exchange-Authentication-Results | spf=fail (sender IP is 173.195.100.199) smtp.mailfrom=generous-minds.com; dkim=none (message not signed) header.d=none;dmarc=fail action=none header.from=generous-minds.com; |
| From | "Audio.calls" <rbeuk@generous-minds.com> |
| Subject | [External] - MONTROSE-ENV: You have a Voice Mail (if) |
| To | kelly.swanson@montrose-env.com |
| Content-Type | multipart/mixed; boundary="_19228eef-c57b-4190-9c5a-8b946159626b_" |
| MIME-Version | 1.0 |
| Date | Fri, 15 Nov 2024 17:21:09 -0800 |
| Message-ID | <1509202411211767EE169487-4AE9380373@generous-minds.com> |
| X-Mailer | Outlook Express 6.00.2900.2527 |
| Return-Path | rbeuk@generous-minds.com |
| X-EOPAttributedMessage | 1 |
| X-MS-TrafficTypeDiagnostic | DU6PEPF0000B621:EE_|PA4PR08MB5952:EE_|SA2PEPF00002251:EE_|SJ0PR09MB11746:EE_ |
| X-MS-Office365-Filtering-Correlation-Id | fc02e381-59d2-4bbd-595d-08dd05a35233 |
| X-MS-Exchange-SenderADCheck | 1 |
| X-MS-Exchange-AntiSpam-Relay | 0 |
| X-Microsoft-Antispam-Untrusted | BCL:0; ARA:13230040|376014|82310400026|1800799024|36860700013|34020700016|4076899003|8096899003; |
| X-Microsoft-Antispam-Message-Info-Original | E5AO3V30IcLJE56eFr3q3ZOsA0BlgJ7ypn/g0hgVwNsKEG19ZipcDrUEpMJxMHW3PneovS3KmcvzCnXhaQONKgxQCSClDyJTv2kmVzCc7sMpSHPJ+bosqPR3IxvGnViKZ79rOme7G9TFTKWxZonYVv1haPjw+Qc9vogmB6a4wzm3H3mGdyN98QL22r28OkZ7TJosf3bIj75J3GV4PMDHxgXgPgPN1EAd6IEYBWUJ3uH2MmW58mdysZFRxpoHxyX4frB13x2d5GvdDUUxlCLp+6HVtiwhjPNTQhzMANbc2Ka2k3PXJwjLIXtAVJU9MxjNqZpEN5lQ/hyI3QBvv2d7OvJtjNQ9Z89PHN2HCzt3wgbyOB6pK7ctytZ4Pj1Ep1FgBxQSP3YJa8Ddr/fq5p/or/JBuEve2jDYr6V2gL8eSzYSMeN8wRIYpiENtJy0zqGwnignoMYfnTwYml4vebN2O0VIIWADSRm/4x5gEHnUFWGkBYiB0CtA6fXWLCTm++njSabduHjNIJtYKIDQjh6M/rqzg4xfhVMdsZqxXbATS1u1Q7FUCb1n7CI+Almb7kxODbp1sGTHy0TXDGPMDz7FkuxyABRkp+if7pEa1uqENqruPn2LI2jid1Xu0Xfm6uJ6UmZ6KoeQNW3ahbIfrSdOtX5pmHPi9YbOp0cKfqhshD0YByy0ssPx+ARGOqIQ9UYJWDlwwS+Y7uLD3sBHhSNrWekU66IETdKVggY2tRfYf6s6tU5IMR61GA+CR60b2kaWj/SYm6+jQH+1UM8Lat5pxytD/F32bEKZQuxTRnigHZ/c6EVu7d6V6taYZCqDz3HIEgY3tv5vvwdnMjK7cnu5CA2ocqM9JPIoNOHC3GB/VNXkGPAO7DbKfITU3YapkEskrdb6LbgdhKbOoDVlUpPWvlqKZRxQiS9E8mFAwUwdJfhQDz+VaPZAp+KF6KtlthoV+d+etYW+Ki2bZS2nPGAza+iPniiwasFXox4v3B7m/3J2pglEgL4Q0O79fNTkXhvO0ripHY69BO/hiCrJPi99jdOZS7tM03u801seidY3KPHKArEhMr7viZVSxuUFvjtWjetKlQB/0OASaKcqkZeASFyXMbLYkEuZsC8BBTHnzfeanb51XQFMz3cL8H/aw6whDGURmP6qIoPAnCb7UP/0UjW+cBVe8rTQjNiQvl81pamlhG/0pqI6R3TecLIvLyROJgzgzspicSiboZwMHbShgoH6035X9iJH4mPGAn3QbPmbTXp4jgk9Dd/IvK4wz9fUXgNdb3YizOgszAg9Dxeu6jTHTk7lNO4IKcSYhlTBlHvAmpjHBcQ7vBXx7e6DeY8eNjUK2X7DqwyK8Me6qXEHsA== |
| X-Forefront-Antispam-Report-Untrusted | CIP:173.195.100.199; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:cloudfare.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(376014)(82310400026)(1800799024)(36860700013)(34020700016)(4076899003)(8096899003); DIR:OUT; SFP:1102; |
| X-MS-Exchange-Transport-CrossTenantHeadersStamped | PA4PR08MB5952 |
| X-MS-Exchange-Organization-OriginalArrivalTime | 15 Nov 2024 18:28:37.0727 (UTC) |
| X-MS-Exchange-Organization-ExpirationStartTime | 15 Nov 2024 18:28:37.3383 (UTC) |
| X-MS-Exchange-Organization-ExpirationStartTimeReason | OriginalSubmit |
| X-MS-Exchange-Organization-ExpirationInterval | 1:00:00:00.0000000 |
| X-MS-Exchange-Organization-ExpirationIntervalReason | OriginalSubmit |
| X-MS-Exchange-Organization-Network-Message-Id | fc02e381-59d2-4bbd-595d-08dd05a35233 |
| X-MS-Exchange-Organization-OriginalClientIPAddress | 40.107.247.116 |
| X-MS-Exchange-Organization-OriginalServerIPAddress | 10.167.242.133 |
| X-EOPTenantAttributedMessage | 726003d6-df89-4f29-896a-515cf07df7dc:0 |
| X-MS-Exchange-Organization-TargetResourceForest | namprd09.prod.outlook.com |
| X-MS-Exchange-Organization-OrgEopForest | GCC02 |
| X-MS-Exchange-Organization-MessageDirectionality | Incoming |
| X-MS-Exchange-Organization-Id | 726003d6-df89-4f29-896a-515cf07df7dc |
| X-MS-Exchange-Organization-FFO-ServiceTag | GCC02B |
| X-MS-Exchange-Organization-TenantServiceProvider | FOPE |
| X-MS-Exchange-Organization-Cross-Premises-Headers-Processed | SA2PEPF00002251.namprd09.prod.outlook.com |
| X-MS-Exchange-Organization-OriginalTenant-OriginalArrivalTime | 15 Nov 2024 18:28:20.6196 (UTC) |
| X-MS-Exchange-Organization-OriginalTenant-Network-Message-Id | 2a2328df-bdc3-4a84-7f0c-08dd05a34875 |
| X-MS-Exchange-Organization-OriginalTenant-Id | 3672ec2f-700d-42a5-8329-71f66235757e |
| X-MS-Exchange-Organization-OriginalAttributedTenantConnectingIp | TenantId=3672ec2f-700d-42a5-8329-71f66235757e; Ip=[173.195.100.199]; Helo=[cloudfare.com] |
| X-MS-Exchange-Organization-OriginalTenant-AuthSource | DU6PEPF0000B621.eurprd02.prod.outlook.com |
| X-MS-Exchange-Organization-OriginalTenant-AuthAs | Anonymous |
| X-MS-Exchange-Organization-OriginalTenant-FromEntityHeader | HybridOnPrem |
| X-MS-Exchange-Transport-CrossTenantHeadersStripped | SA2PEPF00002251.namprd09.prod.outlook.com |
| X-MS-Exchange-Transport-CrossTenantHeadersPromoted | SA2PEPF00002251.namprd09.prod.outlook.com |
| X-MS-Exchange-Organization-ConnectingIP | 40.107.247.116 |
| X-MS-Exchange-Organization-ConnectingEHLO | EUR02-AM0-obe.outbound.protection.outlook.com |
| X-MS-Exchange-Organization-AS-LastExternalIp | 40.107.247.116 |
| X-MS-Exchange-Organization-IsBipIncludedAtpTenant | true |
| X-MS-Exchange-Organization-IsAtpTenant | true |
| X-MS-Exchange-Organization-AntiSpam-ArcTrustedDomains | checkpointcloudsec.com |
| X-MS-Exchange-Organization-Originating-Country | NL |
| X-MS-Exchange-Organization-OriginalEnvelopeRecipients | kelly.swanson@montrose-env.com |
| X-MS-Exchange-Organization-PtrDomains | mail-am0eur02on2116.outbound.protection.outlook.com |
| X-MS-Exchange-Organization-EhloAndPtrDomain | EUR02-AM0-obe.outbound.protection.outlook.com; mail-am0eur02on2116.outbound.protection.outlook.com |
| X-MS-Exchange-Organization-MxPointsToUs | true |
| X-MS-Exchange-Organization-RecipientDomainMxRecord-PFAFD | montrose-env.com#montroseenv-com02b.mail.protection.outlook.com |
| X-MS-Exchange-Organization-RecipientDomainMxInfo | montrose-env.com#Office365#montroseenv-com02b.mail.protection.outlook.com |
| X-MS-Exchange-Organization-CompAuthRes | pass |
| X-MS-Exchange-Organization-CompAuthReason | 100 |
| X-MS-Exchange-Organization-SpoofDetection-Frontdoor-DisplayDomainName | generous-minds.com |
| X-MS-Exchange-Organization-SenderRep-Score | 5 |
| X-MS-Exchange-Organization-SenderRep-Data | IpClassLargeGrayOther_GrayOther_SmallGrayOther |
| X-MS-Exchange-Organization-VBR-Class | GrayOther |
| X-MS-Exchange-Organization-HMATPModel-Spf | 1 |
| X-MS-Exchange-Organization-HMATPModel-Recipient | <PII:H100055(Zau5Zpy6qEWbUrJisQKW+Ajm7drlik0oN1OxhvuYO2g=)>@montrose-env.com |
| X-MS-Exchange-Organization-TransportTrafficType | |
| X-MS-Exchange-Organization-TransportTrafficSubType | |
| X-MS-PublicTrafficType | |
| X-MS-Exchange-Organization-OrderedPrecisionLatencyInProgress | LSRV=BL0PR0901CA0028.namprd09.prod.outlook.com:TOTAL-FE=0.216|SMR-PEN=0.216(RENV=0.214); 2024-11-15T18:28:37.645Z |
| X-MS-Exchange-Organization-MessageLatency | SRV=BL0PR0901CA0028.namprd09.prod.outlook.com:TOTAL-FE=0.425|SMR-PEN=0.425(RENV=0.214|SMRPROXY-PEN=0.209(SMSC=0.136|SMS-PEN=0.073)) |
| X-MS-Exchange-Forest-ArrivalHubServer | SJ0PR09MB11746.namprd09.prod.outlook.com |
| X-MS-Exchange-Organization-AuthSource | SA2PEPF00002251.namprd09.prod.outlook.com |
| X-MS-Exchange-Organization-AuthAs | Anonymous |
| X-MS-Exchange-Organization-FromEntityHeader | Internet |
| X-MS-Exchange-Organization-MessageScope | cfa23dee-c63e-4018-a908-33fd0686894c |
| X-MS-Exchange-Forest-MessageScope | cfa23dee-c63e-4018-a908-33fd0686894c |
| X-MS-Exchange-Organization-Antispam-ProtocolFilterHub-ScanContext | ProtocolFilterHub:SmtpOnEndOfData; |
| X-MS-Office365-Filtering-Correlation-Id-Prvs | 2a2328df-bdc3-4a84-7f0c-08dd05a34875 |
| X-MS-Exchange-Organization-P2SenderDisplayNamePII | H100055(g0rqra/nkf8Kd2tpjMppDdG+n3CJOpHCR2fptHV5FxA=) |
| X-MS-Exchange-Organization-P2SenderPII | <PII:H100055(FlWml3KlDCf/DyULONqE+txwmt7WItOAY7cR5BERycg=)>@generous-minds.com |
| X-MS-Exchange-Organization-Auth-DmarcStatus | Pass |
| X-MS-Exchange-Organization-VerifiedDkimDomainsList | generousminds.onmicrosoft.com |
| X-MS-Exchange-Organization-Antispam-AuthResults | {"SpfDomain":"generous-minds.com", "SpfAuthStatus":"Pass", "DkimDomain":"generousminds.onmicrosoft.com", "DkimAuthStatus":"Pass", "DkimSubStatus":"None", "DmarcAuthStatus":"Pass", "DmarcAction":"None", "ArcAuthStatus":"2", "ArcSubStatus":"0"} |
| X-MS-Exchange-Organization-PFAHub-Total-Message-Size | 143210 |
| X-MS-Exchange-Organization-OriginalSize | 143210 |
| X-MS-Exchange-Organization-HygienePolicy | Premium |
| X-MS-Exchange-Organization-ReplicationInfo | ReplicaId=c5b5dc19-460f-44c3-1045-7b52a305dd08; ReplicatingServerFqdn=PH0PR09MB11757.namprd09.prod.outlook.com |
| X-MS-Exchange-Organization-PhishSim-Rules-Execution-History | 225c5842-f453-4d69-93d1-5592be3f6e44 |
| X-MS-Exchange-Organization-Antispam-PreContentFilter-PolicyLoadTime | PSOSUB:151; PSOSUBLOAD:148; PSOSUBRUN:1; PSOSUBCOUNT:1; SMORES:71; SMORESLOAD:69; SMORESRUN:0; SMORESCOUNT:0; SAORES:147; SAORESLOAD:72; SAORESRUN:0; SAORESCOUNT:1; SLORES:76; APORES:146; APORESLOAD:73; RSORES:73; SLORESLOAD:72; SLORESRUN:0; SLORESCOUNT:1; |
| X-MS-Exchange-Organization-MessageFingerprint | D5DDD02C.C22ADC8.ADCB3E2.C0EBC0AB.201F4 |
| X-MS-Exchange-Organization-ExtractedBarcode | |
| X-MS-Exchange-Organization-AttachmentDetailsInfo-ChunkCount | 1 |
| X-MS-Exchange-Organization-AttachmentDetailsInfo-0 | [{"ID":0, "FS":82368, "SHA256":"344938f2e50ce50316a1400fd8965085dd859889721d47756645e6ca532e895d", "HFH":"NEk48uUM5QMWoUAP2JZQhd2FmIlyHUd1ZkXmylMuiV0=", "FE":"png", "AF":2048, "AFT":"{784:\"jeminiqw2.png\", 789:\"png\"}", "AFT2":"{784:\"jeminiqw2.png\", 789:\"png\", 2919:1120, 2920:540, 2921:32, 2923:1, 2934:\"png\"}", "FPR":{"IF0":"IF0_00FF05FFF1182F1007FFFF1A7FFBBA007FFFF55"}}, {"ID":1, "FS":0, "FE":"", "AF":0, "AFT":"{784:\"ilil.pdf\"}", "AFT2":"{784:\"ilil.pdf\", 3147:1}"}] |
| X-MS-Exchange-Organization-URLFeatureReduction | 17; 2; 0; 13; 0; 0; 0; 0; 9; 2; 1; 89; 0; 0; 0; 1; 0; 0 |
| X-MS-Exchange-Organization-Persisted-Urls-ChunkCount | 5 |
| X-MS-Exchange-Organization-Persisted-Urls-0 | [{"ID":1, "OU":"https://www.google.es/url?q=querywbir(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fcondominioanacarolina.com.br%2flockeq%2fwtolwzl224moscrjiovolvgdhya1s0oym4bi4/a2VsbHkuc3dhbnNvbkBtb250cm9zZS1lbnYuY29t", "U":"https://www.google.es/url?q=querywbir(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnit |
| X-MS-Exchange-Organization-Persisted-Urls-1 | ed%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fcondominioanacarolina.com.br%2flockeq%2fwtolwzl224moscrjiovolvgdhya1s0oym4bi4/a2VsbHkuc3dhbnNvbkBtb250cm9zZS1lbnYuY29t", "IAR":false, "LI":{"TN":"a", "IC":true, "BF":2, "SI":-1, "EndIndex":-1}, "SRCI":1, "IU":null, "NU":"www.google.es/url?q=querywbir(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2 |
| X-MS-Exchange-Organization-Persisted-Urls-2 | CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fcondominioanacarolina.com.br%2flockeq%2fwtolwzl224moscrjiovolvgdhya1s0oym4bi4/a2VsbHkuc3dhbnNvbkBtb250cm9zZS1lbnYuY29t", "UFT":"{101:17, 102:2, 105:13, 108:3, 110:6, 111:9, 112:2, 114:6, 115:3, 116:1, 118:3, 119:6, 121:4, 122:2, 123:1, 125:2, 128:3, 131:89, 135:\"F538357B, 59CF2A9A, FB1140DA, F224BA67, 5FC87847, 52040AC8\", 142:0, 146:\"google.es\", 205:-1, 206:-1, 207:-1, 208:-1, 209:-1, 210:-1, 211:-1, 212:-1, 213:-1, 214:-1, 215:-1, 216:-1, 217:-1, 218:-1, 219:-1, 220:-1, 221:-1, 222:-1, 223:-1, 224:-1, 225:-1, 226:-1, 227:-1, 228:-1, 229:-1, 230:-1, 231:-1, 232:-1, 233:-1, 234:-1, 235:-1, 236:-1, 237:-1, 238:-1, 239:-1, 240:-1, 241:-1, 242:-1, 243:-1, 244:-1, 245:-1, 246:-1, 247:-1, 248:-1, 249:10, 250:10, 251:11, 252:11}", "UFT2":"{101:17, 102:2, 105:13, 108:3, 110:6, 111:9, 112:2, 114:6, 115:3, 116:1, 118:3, 119:6, 121:4, 122:2, 123:1, 125:2, 128:3, 131:89, 142:0, 146:\"google.es\", 150:1, 153:1, 166:1, 168:1, 180:4, 181:1, 182:1083, 183:4, 188:1, 189:9, 205:-1, 206:-1, 207:-1, 208:-1, 209:-1, 210:-1, 211:-1, 212:-1, 213:-1, 214:-1, 215:-1, 216:-1, 217:-1, 218:-1, 219:-1, 220:-1, 221:-1, 222:-1, 223:-1, 224:-1, 225:-1, 226:-1, 227:-1, 228:-1, 229:-1, 230:-1, 231:-1, 232:-1, 233:-1, 234:-1, 235:-1, 236:-1, 237:-1, 238:-1, 239:-1, 240:-1, 241:-1, 242:-1, 243:-1, 244:-1, 245:-1, 246:-1, 247:-1, 248:-1,249:10,250:10,251:11,252:11,1501:\"-1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; 10; 10; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; 10; 10\",2899:10,2900:10,2901:11,2902:11}","DPD":{"UF":"17 |
| X-MS-Exchange-Organization-Persisted-Urls-3 | 367296","CH":"6450191611200192869","SCHM":"Https","CNT":"1","MLFP":"UESELV3=20; UEBUFV0=1104","SL":"1","LOG":"1"},"PROC":[]},{"ID":1,"OU":"https://www.google.es/url?q=queryyuoc","U":"https://www.google.es/url?q=queryyuoc","IAR":false,"LI":{"BF":1,"SI":-1,"EndIndex":-1},"SRCI":1,"IU":null,"NU":"www.google.es/url?q=queryyuoc","UFT":"{101:17,102:2,105:13,108:3,110:6,111:9,112:2,114:6,115:3,116:1,118:3,119:6,121:4,122:2,123:1,125:2,128:3,131:89,135:\"F538357B,59CF2A9A,FB1140DA,F224BA67,5FC87847,52040AC8\",142:0,146:\"google.es\",205:-1,206:-1,207:-1,208:-1,209:-1,210:-1,211:-1,212:-1,213:-1,214:-1,215:-1,216:-1,217:-1,218:-1,219:-1,220:-1,221:-1,222:-1,223:-1,224:-1,225:-1,226:-1,227:-1,228:-1,229:-1,230:-1,231:-1,232:-1,233:-1,234:-1,235:-1,236:-1,237:-1,238:-1,239:-1,240:-1,241:-1,242:-1,243:-1,244:-1,245:-1,246:-1,247:-1,248:-1,249:10,250:10,251:11,252:11}","UFT2":"{101:17,102:2,105:13,108:3,110:6,111:9,112:2,114:6,115:3,116:1,118:3,119:6,121:4,122:2,123:1,125:2,128:3,131:89,142:0,146:\"google.es\",150:1,151:1,166:1,180:1,181:1,182:12,183:4,188:1,189:9,205:-1,206:-1,207:-1,208:-1,209:-1,210:-1,211:-1,212:-1,213:-1,214:-1,215:-1,216:-1,217:-1,218:-1,219:-1,220:-1,221:-1,222:-1,223:-1,224:-1,225:-1,226:-1,227:-1,228:-1,229:-1,230:-1,231:-1,232:-1,233:-1,234:-1,235:-1,236:-1,237:-1,238:-1,239:-1,240:-1,241:-1,242:-1,243:-1,244:-1,245:-1,246:-1,247:-1,248:-1,249:10,250:10,251:11,252:11,1501:\"-1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; 10; 10; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; -1; 10; 10\",2899:10,2900:10,2901:11,2902:11}","DPD":{"UF":"18940160","CH":"11610247541619752066","SCHM":"Https","CNT":"1","M |
| X-MS-Exchange-Organization-Persisted-Urls-4 | LFP":"UESELV3=20; UEBUFV0=888","SL":"1","LOG":"1"},"PROC":[]}] |
| X-MS-Exchange-Organization-PersistedUrlCount | 2 |
| X-MS-Exchange-Organization-FeatureTable | {255:11, 256:11, 261:10, 262:10, 341:3, 342:0, 343:1, 344:0, 345:1, 346:0, 347:3, 348:0, 349:1, 350:0, 351:1, 352:0, 353:14, 354:7, 355:13, 356:6, 357:33, 358:8, 382:"173.195.100.199", 383:"cloudfare.com", 384:"generous-minds.com", 385:"generous-minds.com", 386:"True", 387:"True", 421:48, 422:0, 423:48, 424:0, 425:75, 426:7, 427:75, 428:7, 429:89, 430:7, 452:1, 453:1, 454:"40FCF4D@montrose-env.com", 455:"NEI", 457:429, 458:63, 459:217, 460:1671277, 461:209, 462:1231801, 463:209, 464:1231801, 501:1, 502:1, 503:1, 504:1, 506:1, 507:1, 508:"generousminds.onmicrosoft.com", 509:"generous-minds.com", 510:"generous-minds.com", 511:"pass", 512:100, 603:0, 604:0, 651:2, 653:1, 668:0, 669:15, 721:"4.02", 722:"3.3", 723:1, 725:114, 726:3, 728:495, 730:366, 735:"4.01", 738:1, 739:1, 740:1, 741:1, 742:3,743:7,744:1,748:"account; notice; attach; alert; delete; notif; stor",749:"Latn",750:"centene.com",755:710,758:"ECDDD03C.C32ADC8.EDCB32E.C4EB922A.201AB",781:2,782:13,802:1,803:6,804:1,805:1,810:1,811:1,817:1,818:3,819:366,820:6,821:28,822:3764,823:206,824:17,825:2,827:13,832:9,833:2,834:1,838:"html:1; head:1; meta:2; body:1; div:8; p:72; a:6; img:1; br:9; b:21; style:1; o_p:44; span:40; strong:1; hr:1",841:1,844:1,845:0,849:1,850:1,1010:0,1011:"EDAFD3BE; ",1028:5844,1029:5502,1030:23,1031:341,1032:5844,1033:5502,1034:23,1035:341,1051:-1,1052:-1,1053:-1,1054:-1,1101:"0.162",1401:0,1402:0,1403:0,1404:0,1405:0,1406:0,1407:845,1408:901,1409:2598,1410:2676,1411:2598,1412:2676,1413:8,1414:6621897,1417:9,1418:430146155,1423:24,1424:23615729263} |
| X-MS-Exchange-Organization-Antispam-PreContentFilter-ScanContext | CategorizerOnSubmitted; CategorizerOnResolved; |
| X-MS-Exchange-Organization-AVScannedByV2 | true |
| X-MS-Exchange-Organization-AVScanComplete | true |
| X-MS-Exchange-Organization-UrlSelected | 1 |
| X-MS-Exchange-Organization-UrlLogged | 1 |
| X-MS-Exchange-Organization-OffboxClassificationInfo | {"EndpointId":"DCS", "OperationIds":{}, "OperationStates":{}, "Classifiers":[], "RuleInfos":[], "CorrelationId":"13002a4f-0ad5-4fed-a0e0-bd98f435a70c", "TotalClassificationLatency":"00:00:00"} |
| X-MS-Exchange-Organization-ExternalRoutingTopologyAnalysis | |
| X-MS-Exchange-Organization-Recipient-Limit-Verified | True |
| X-MS-Exchange-Organization-TotalRecipientCount | 1 |
| X-MS-Exchange-Organization-ExternalRecipientCount | 0 |
| X-MS-Exchange-Organization-IsSingleRepresentative | True |
| X-MS-Exchange-Organization-ASDirectionalityType | 1 |
| X-MS-Exchange-Organization-HVERecipientsForked | 1.0 |
| X-MS-Exchange-Organization-SafeAttachmentPolicy | Montrose Environmental Group_SafeAttachments |
| X-MS-Exchange-Organization-SafeLinksPolicy | Montrose Environmental Group_SafeLinks |
| X-MS-Exchange-Organization-SafeAttachmentPolicy-Enable | 1 |
| X-MS-Exchange-Organization-SafeLinksPolicy-EnableSafeLinksForEmail | 1 |
| X-MS-Exchange-Organization-SafeLinksPolicy-EnableSafeLinksForInternalSenders | 1 |
| X-MS-Exchange-Organization-SenderRecipientCommunicationState | NEI |
| X-MS-Exchange-Organization-Boomerang-Verdict | None |
| X-MS-Exchange-AtpMessageProperties | SA|SL |
| X-MS-Exchange-Organization-CommunicationStateSummary | NEI |
| X-MS-Exchange-Organization-FirstContactSummary | ST=2; MRG=0; EXT=0; UN=1; ORCT=1; EV=1; FC=0; NESI=1; NES=0; ESTI=0; EST=0; INS=0; MP=0; UD=0; QE=0; ERR=0 |
| X-MS-Exchange-Organization-SenderIntelligence-P2SenderOrgDomainTenantId | {"stringProperties":{"_STATUS":"Success"}, "numericProperties":{"EntityFound":1}} |
| X-MS-Exchange-Organization-Antispam-AnalystFeatureFilter-ScanContext | CategorizerOnResolved; |
| X-MS-Exchange-Organization-Rules-Execution-History | 840307d7-f778-4c70-a034-a340d4158cf3%%%3c413034-47db-4e6b-aa64-97b9c0127e20%%%5c98d247-f9f5-4ebd-b36f-b831ca05fd4a%%%1505d861-8e55-4175-ac63-cf4b867c9923%%%e1599244-1ef7-44ce-af49-9e9aed630215%%%8871f4fc-ceda-4805-8477-49ec9738b59d%%%852f0044-a720-400d-947f-d271699e6c76%%%a2dada09-e6db-4574-9859-3955c1899e56%%%b2c5fc93-63ac-465a-85f6-fdce9661c755%%%30538bd7-f3ab-4841-9c1f-91de110279e6%%%5c01f245-e559-4d00-8586-10e45b16d1d2%%%f5bddc86-b6fd-4267-80f0-3c9a5cb9f503 |
| X-MS-Exchange-Organization-Disclaimer-Hash | 701c2b241f95b3174788fda1995bba19225f4fc03a97f7214d64c495fd69afd6 |
| X-MS-Exchange-Organization-Rules-Execution-Log | a11f404c-6206-4380-b021-16ffcfcdfb9b |
| X-MS-Exchange-Organization-RuleName-Execution-Log | TGVnYWwgRGlzY2xhaW1lcg== |
| X-MS-Exchange-Forest-RulesExecuted | SJ0PR09MB11746 |
| X-MS-Exchange-Organization-RulesExecuted | SJ0PR09MB11746 |
| X-MS-Exchange-Organization-DlpRules-Execution-History | d5e0fe8e-cd66-415e-8bc6-ea1e10710488%%%84e94896-f620-462f-b192-36b8ef5c36a6%%%a36dce59-96ef-4f5b-9875-3edc640e8647%%%420edc01-3b29-45f9-9fed-98ac47253c00%%%360d04be-2e66-49ef-8d9b-070005a1a60c%%%1f2635fc-2932-4a08-bdf1-4a05d6d84334%%%ae9e41b0-1e1d-4b70-8063-0234eab4ff6a%%%1e6498aa-3c99-478b-943f-150af2d11730%%%52e853eb-20ed-464f-9070-79fecdd7e72a%%%95054209-e623-44be-93cd-4fc05e2f32f9%%%865988f9-99b1-4994-8396-8e12938e5e2a%%%d5db9455-159e-4ef6-84df-7561e5a986ad%%%9b037508-ad43-4a8d-896d-36ea7e380cef%%%7430f60d-d0ce-42bb-9c8d-743032d57ad6%%%fb234191-4114-4685-91eb-f1e5655cb1cb%%%da1843b1-a77b-4fdd-a798-38ec4e5b4436 |
| X-MS-Exchange-Organization-DlpRulesExecuted | SJ0PR09MB11746 |
| X-MS-Exchange-Organization-Antispam-ContentFilter-ScanContext | CategorizerOnResolved; |
| X-MS-Exchange-Organization-CFA-UserOption | 0 |
| X-MS-Exchange-Organization-CompAuth | compauth=pass reason=100 |
| X-MS-Exchange-Organization-ContainsAttachments | true |
| X-MS-Exchange-Organization-Feature-Long | 0 201:10363 202:1990 203:1 205:114 206:3 208:495 210:366 215:10351 219:1 220:6 221:1 222:1 227:1 228:1 234:1 235:2 236:1 238:1 239:1 240:1 241:1 242:1 243:3 244:7 245:1 246:1 247:1 248:1 252:1 256:2 257:13 260:3 261:366 262:6 263:28 264:3764 265:206 1006:account; notice; attach; alert; delete; notif; stor 1007:Latn 1008:centene.com 1013:173.195.100.199 1014:generousminds.onmicrosoft.com 1015:generous-minds.com 1019:cloudfare.com 1020:generous-minds.com 1030:generous-minds.com 1034:40FCF4D@montrose-env.com 1035:generous-minds.com |
| X-MS-Exchange-Organization-ExtractionTagsSubject | [External] - MONTROSE-ENV: You have a Voice Mail (if) |
| X-MS-Exchange-Organization-ExtractionTagsFrom | "Audio.calls" <rbeuk@generous-minds.com> |
| X-MS-Exchange-Organization-ExtractionTagsSubjectNormalized | external rnontrose env you have a volce rnall lf |
| X-MS-Exchange-Organization-ExtractionTags | 1IMG;SUB64; |
| X-MS-Exchange-Organization-ExtractionTagsURLFound | URL |
| X-MS-Exchange-Organization-ATPDetonationContext | Email_EnterpriseATP_Mailflow |
| X-MS-Exchange-Organization-Antispam-SpamFilter-ScanContext | CategorizerOnResolved; |
| X-MS-Exchange-Organization-Antispam-AnalystRuleHits | (13230040)(4073199012)(35042699022)(12062699021)(22003199012)(5073199012)(5063199012)(4076899003)(8096899003) |
| X-MS-Exchange-Organization-Antispam-ScanContext | DIR:Incoming; SFV:NSPM; SKIP:0; |
| X-MS-Exchange-Organization-Antispam-PostContentFilter-ScanContext | CategorizerOnResolved; CategorizerOnRouted; |
| X-MS-Exchange-Organization-SCL | 1 |
| X-Microsoft-Antispam | BCL:0; ARA:13230040|4073199012|35042699022|12062699021|22003199012|5073199012|5063199012|4076899003|8096899003; |
| X-MS-Exchange-Organization-EmailFingerprintsDetailsInfo-ChunkCount | 1 |
| X-MS-Exchange-Organization-EmailFingerprintsDetailsInfo-0 | [{"Type":"VA5", "Val":"VA5_35679BBB759096F6ADD50C075CDA94742C0BEBA0C422CCEF7EDFEA0F7D8EACA1", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA4", "Val":"VA4_32098211BEC4F3412D61AD134799A15CB09DBEB2C9305F982C8C21F5530B112E", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA33", "Val":"VA33_AF95782C2AC71E270B4B43D39DA81BA9AF00CC37ABB5DA2101F239A1FFA26551", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA32", "Val":"VA32_CF3BD79EED1636B8ACDA4B58E1D7417E62D22348C94A721E14081AC262236068", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA31", "Val":"VA31_8058BE99423A5EE9C92979FE2D1ED90CC62F1C83649BBB9BC4B063830B629CC1", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA30", "Val":"VA30_1F5639DAFCF8E35E7F687591A1A386957FF77AB6FCD4D0822562711B3E07053E", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA11", "Val":"VA11_BF700B5CA432B5291DDA5E8D07F071C5F43A75A97983C7DCEF934E20D6507461", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA10", "Val":"VA10_B334A70E22C2F7B899AECFBC6B1932FDFB8161B37119D8E0D00E37B418CFED3B", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA61", "Val":"VA61_4B7261ED3058F0FB9947B38E8A3315AED561A7DCA432E2AF700941BF5A497B5A", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA60", "Val":"VA60_1B464C25833D382637CEB0490087E2CA7E216D2E9F178C57767EFE9D5BB8B4AD", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA3", "Val":"VA3_ECDDD03C.C32ADC8.EDCB32E.C4EB922A.32BE2111", "Func":"None", "FF":0, "PD":{}}, {"Type":"VA2", "Val":"VA2_34E3A4EA98750E7AF3212B7E959904BCB40252464F251D84A973CEA012AA772B", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA1", "Val":"VA1_269D4CDD7A97F04CCE851A2058C64BB311746EE00D0A83A7C2A9B8BC7E2946ED", "Func":"SHA256", "FF":0, "PD":{}}, {"Type":"VA0", "Val":"VA0_7C47C2F5F27A2BEF4904A08748E73F4D01FDF78F4F7D0E6EA48D45613C4D1C20", "Func":"SHA256", "FF":0, "PD":{}}] |
| X-Microsoft-Antispam-Message-Info | fbswAe5PMqroWN1aIeROOL5COJCJUOb8ePCvnI8qsKUikXX1rUyT5wAg0cDXooWfF7fwh8o535O87wMmGhmYblJ4N1tjDdtsQ4h9ml4Zwly+gn4txl3yHiq1Rl82Ucm1Hgt5YsWwj9k2SSrJT/V/8cKMMEVrT/nCtb2GyIu6iiQqptgFxxJF+l7K3Wy63uTAY8KmcDlwnGcNqCvNBDVfmUdEUjqpxYzW3KJSKpEwX6W2pBWOmItmDamiWaCCfluxwHU1HgQ+xq+J4dWsccCleosxr2kkAIfGQfe94fE0h78ggP54JOu4h9WljFWn7AIs8dsWyd9r/E0FvIdUMslwbRngy3X57dIXai/k6Clf0gqF/gt501raIRoQNh/AIIfXoOikROCziZ+OToCEISftuDPor9OKtkSG4JIjleRp+1m+ffgKqkmWTtUqKoilV6+6f9eyvr372pPvcVVdeNYqF3uuLEoTWXixBn6AEy3d9F5uaHkA2GyYTs3QmFF33r1txIbaA23CDBWxqnQPsm2lAbnfKD7L94wP5zUCW5GLV2z1Mz63ZaEgRz9MidIG5zHCFGd/rYEmuKUaB0w5SNIadj2ECXxDnxoUkDIJ3u9JdkUeB/18xtOPLrSsn+mdpyTwPcyj3U6fXFyz+Kr1Ab5IDA2wD/Qte02WVai2DksQ3fNSXnV519j+39+1oxG0yEXLi8vAANVLv+BWGbVNzYQqJLu1MIAspUbZqR72qNX/1lFfqubxlIkTPVa/nGwu3+KGkBBX2+wsigJiEihhQQhAaJ4Ag6rapEWBB+1qUkU2dg4T8Io6Awl2VcC9pV9SotNjAwpJfGdPT+X2cXCgSYZJQ6nLTnYsWU9NU3ml7UeFaHylwciopS8A/sisLaKjCbGYyiSmGl8qKiEQXs8X7VZJzvAPY9wDHme5txQLVDpb8Gtic7Glt+L3dyISKQwDbI/IfoJXItJSbFUtnGaHZet2GH3i3cEmuNLgbeza+w44OKuIkJdAJnGS9f5XnUGjY0nvLSvrABHfbxkzyTWsucBPB9fHbT9qjCEEjOmX8c1SFAWbabSST/OCtP1vFHve3UKEZglZqz6GulgNs3owKfQ4AhcEiYLYzJuEdOQyKNaVhhIr6aSVNt1I0gFYDYQ0E1GFQC5br65jnL2XpwGSq5IFXROIGhAsh+4qE2JVE/Vh2Jz7WXWxH1pOWW+n7JgQ3qDKGoXjexkn22SwrkdIol6iQ6nUC2MLxl1RFXs3E5JgYmbxkYk4dlmJuJ9fXIkTKaxnsL1pRVsRAieMoXZ/wtIBhNTSOKcI865ixB1823E1qUQg0fMdhDJHH5TXA8fT+qctgjxLlUJE0o73t11I+LHe1BOFmcPAbBDCzVQKKnJr7pXF2ouamEozONl5lDXgQZlK4oa50KLIPk5nCM09GojE2GkffLuQL6aFfqOTh9NlJZCKm0GI6hixdw2NcatuZ1HC5n4MK6DuvZh+rkn5fupKPTUxmpoHJ+Dw/f2cNaxEaVpTIy+jJcyyn6RcOzad14IUP5Gco/rR0rY7XnTsHBEI60sCgcULWAtDXoZWbTRqTjYI0DzgRVDsEgiV4VhWFmMA6W4zfg7Sb7SUd5G7yQjJ7MPb71wxdhNlgEqTBKlYvrCXwjjfOE7YkqSY0CujRXW4kThmBzgwbxEjo3/XkmhVOp9WuJV6YMUP6vayorNEY4cg5g1ZutcLBGS1ENX4rOOnTa7EWhV5EOI/QnpaToucvR03Q+ZwHl8YXxuxKpzTXfm0FTxDU2MgvTHZA0I1UUidyC+FrNfoGFfY1QtUjEB7akZB2vBkC4UW2pBx9+aFP2oGAe4JT4pQwh1uo5Cwk9dF0pab8eLyMeM3mrR1/R7po7DDXRNfYDE6DwRVbzFQmy+WogBL53GA5+RMZdu4oHUzF+EwIn9RqGMWgFC9H841Q8ca8hU4EAzVdjBw73U7mR00r2ZluHaZIVV3Mz+57jaLeUdU2q8XvtWmbWa4OyW//h/m/dOPQxaOnQQEjb0ewR4= |
| X-Forefront-Antispam-Report | CIP:40.107.247.116; CTRY:NL; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:EUR02-AM0-obe.outbound.protection.outlook.com; PTR:mail-am0eur02on2116.outbound.protection.outlook.com; CAT:NONE; SFTY:9.25; SFS:(13230040)(4073199012)(35042699022)(12062699021)(22003199012)(5073199012)(5063199012)(4076899003)(8096899003); DIR:INB; SFTY:9.25; |
| X-MS-Exchange-Organization-GroupForkPerf | VCL=0;VL=0 |
| X-MS-Exchange-Forest-Language | en |
| X-MS-Exchange-Forest-IndexAgent-0 | AQ0CZW4BH80DW3sNCiAgImluZGV4IjogMCwNCiAgIkF0dGFjaG1lbn RQcm9wZXJ0aWVzIjogew0KICAgICJleHRlbnNpb24iOiAicG5nIiwN CiAgICAidXJscyI6IFtdLA0KICAgICJpbm5lckZpbGVzIjogW10sDQ ogICAgImRldGVjdGVkRm9ybWF0IjogInBuZyIsDQogICAgIm5hbWUi OiAiamVtaW5pcXcyIiwNCiAgICAidHlwZSI6ICJTdHJlYW1BdHRhY2 htZW50IiwNCiAgICAiZnJvbUNhY2hlIjogZmFsc2UNCiAgfQ0KfSwN CnsNCiAgImluZGV4IjogMSwNCiAgIkF0dGFjaG1lbnRQcm9wZXJ0aW VzIjogew0KICAgICJleHRlbnNpb24iOiAicGRmIiwNCiAgICAidXJs cyI6IFtdLA0KICAgICJpbm5lckZpbGVzIjogW10sDQogICAgImRldG VjdGVkRm9ybWF0IjogbnVsbCwNCiAgICAibmFtZSI6ICJpbGlsIiwN CiAgICAidHlwZSI6ICJTdHJlYW1BdHRhY2htZW50IiwNCiAgICAiZn JvbUNhY2hlIjogZmFsc2UNCiAgfQ0KfV0AAYkFAAAPAAADH4sIAAAA AAAEAL1Va28bRRSd9dubuO0nkMqXK5BQKjmtH0lKTIRqpUkblKRVkg Ll22R3nJ12H2ZnnNR8QPwH/iE/gV/AmZn1pjQmKghRbZ153Hvn3HPO zv5xt+NvbvQ2Nzr+a6Ho919/o+f8UlCaacpFIOSlCEkoLROuxUM6i3 j6VtHuPA3lw45vpzTPZt2O/20WpXREz0WeJzxNO/7p3sl3B7t7dDQ+ Hj/bO+n4z2Uc00EoeCy4El06PNzt+I83eutbw+H6sNfvr72YTGQgHm B1sLG+Oeyv9/vbm2u7Io4fXEcO+hu9tX3+DkvrN/51/P08S0YOIR1x fTnntBMkdvBERTzJs+DtTMtY6rnOuYxF/jDIkm+AV6R6RN+LMBUq5P Musuc07NKgNxhSvz/qD2l8hJ6zEdleF53SzpuoGD6J0KJcdFjU3Q1G dCKDiOchnYgZIgTt5LkbLcn4mg6l4vTjlRQK6Ggn/rkYLi1/Ojt/Iw IgP9kb0cHTvfHh3vh0j4aDwTYQP8Kg/1Vvq+O/SqUuJiQVyZR0JEhF 2fRhsflFkWNM8FSGRlcSl0BwITRx+mmWaUGTLEciCmQpJDwgJURKSL 7iipTmuYZfzmea4iyDUWL5VthzpthRdCVyDLGbpSb3yhgiMnZDSGKP saVD1Kbx6fjl+xajX4inISUcFaXBc5ELrglKIep9uY2S+SV8ROMwka lUkFkD9Zc0DoJslgLHiXU2P48FggtP0CtnCjpzrlBAmAZ4O3o9Os5y HdEuDAI2xpcinaH3Y3FFp5qn2jTzckz9za3HA2fd7cEm/vd617Ot7e 1t2h//sPDnP3LQ7c7sjTavnfkvfP9/+fMWbz7LMiib5alML4oWjAnh ENALQ+mMgkhAI+MAOM5ZV3M9gw8ndjaDg9WisgkrrH4lSoflzr3n2T tcbVMuc/XfXGE7asoRvPvieB89Hp8djA8Pzl7T8Ysz5I5wZwoKMvRh nGfRwuIigQSUCKX4hbB4eTonrjUPosRGcsCVJisEASqLRTwvXj7Eh2 GOVCHW1IPirZjbMzhea/ydQIRUSx53aZpn01wKvJlzE/kIFTC/hP4X qCtTlIRJZJaWdc4FYZPHOA/JGtohcALXUihVEGdqluNLcDCxL6VBab 4VQNXxS7j4csipBISy30WnrgGZEyap7pq5/CAkwk1ybm6VRZdWf3MY moM0WY6uLP8kk0SEEl8mYIUkuXbGMCCg89zIjB3HtWkPuymFIhZa/P XMpQK4hKKIJQAgclJzpUXysQx0yyBjQGBCrJxI01SE68scek1rl2bG VVhQAleX1aULQadzvBiWLIWbzPJ4k1fj//fxS3Mh5zLQTshInksoCc t7lTpjddasskaN1aus1mLtFvMbrFlnrTpruHWPVbDYZK0ma2PaZitV D8Gs6rFVr2YHtRpj2Gp47aXrNa+5dL3K7tdYAwc1UNxjn7PWJ+xTe2 jDnsJW8LCax6o1r95iDDAqDLkY+22Pfcb8DruDeCw6eC2P3Wdtt3gz DAGIbHtokAGq+WUtVLaDZoVV8VRN/WbNa9hFtFOzK4Yc8GA5cVNDCw YuBafjt76gsRxUbJZhwD4u1z5NR69bqRhuXPEFG6zVYfcgh89W8Ysp eilot/UBuGEPNU15VaPjUpK9xt8wDwxLKLqd+ZtKfTzzH9LO6k3jMe RVHPmOW/e4FdNpIUQTyEuZkFsGN5l/m1FtR3fZPcdVyxigSHeS4Vlh q27LnGJX2sz37OlO2VV2x8Ug12crbuym2EUwCkKmyiLFPmCg3TakVV 2nrsH6wmZu0anvwlzBupG1iSNcgyUzpfGwUuaW4EvL2YDWMiQrJbEt Sw7Gvsmtd9hd+15UHcgSrSuOgTHhn6i7u0MdDAAA |
| X-MS-Exchange-Forest-IndexAgent | 1 1893 |
| X-MS-Exchange-Forest-EmailMessageHash | 68D071B1,2043FC0C,00000000 |
| X-MS-Exchange-Organization-RoutingMessageBlockingAgent-Checked | true |
| X-MS-Exchange-Organization-FeatureTableV2 | {255:11, 256:11, 261:10, 262:10, 341:3, 342:0, 343:1, 344:0, 345:1, 346:0, 347:3, 348:0, 349:1, 350:0, 351:1, 352:0, 353:14, 354:7, 355:13, 356:6, 357:33, 358:8, 382:"173.195.100.199", 383:"cloudfare.com", 384:"generous-minds.com", 385:"generous-minds.com", 386:"True", 387:"True", 421:48, 422:0, 423:48, 424:0, 425:75, 426:7, 427:75, 428:7, 429:89, 430:7, 452:1, 453:1, 454:"40FCF4D@montrose-env.com", 455:"NEI", 457:429, 458:63, 459:217, 460:1671277, 461:209, 462:1231801, 463:209, 464:1231801, 501:1, 502:1, 503:1, 504:1, 506:1, 507:1, 508:"generousminds.onmicrosoft.com", 509:"generous-minds.com", 510:"generous-minds.com", 511:"pass", 512:100, 603:0, 604:0, 651:2, 653:1, 668:0, 669:15, 723:1, 738:1, 739:1, 740:1, 741:1, 742:3, 743:7, 744:1, 749:"Latn", 756:0, 757:0, 758:"ECDDD03C.C32ADC8.EDCB32E.C4EB922A.201AB",824:17,825:2,827:13,832:9,833:2,834:1,844:1,845:0,848:"20101999007",951:36,952:1623,954:2684,964:92,965:51,966:546,967:37,968:2830,973:20,1010:0,1011:"EDAFD3BE; ",1028:5844,1029:5502,1030:23,1031:341,1032:5844,1033:5502,1034:23,1035:341,1036:"8075",1051:-1,1052:-1,1053:-1,1054:-1,1229:"1",1230:"0",1231:"SectionFuzzyEqual",1232:"Voice",1401:0,1402:0,1403:0,1404:0,1405:0,1406:0,1407:845,1408:901,1409:2598,1410:2676,1411:2598,1412:2676,1413:8,1414:6621897,1417:9,1418:430146155,1423:24,1424:23615729263,2501:0,2502:0,2503:0,2504:0,2505:0,2506:0,2507:0,2508:0,2509:0,2510:0,2511:0,2512:0,2513:0,2514:0,2515:0,2516:0,2517:0,2518:0,2519:0,2520:0,2521:0,2522:0,2523:0,2524:0,2525:0,2526:0,2527:0,2528:0, 2529:0, 2530:0, 2531:0, 2532:0, 2533:0, 2534:0, 2535:0, 2536:0, 2537:0, 2538:0, 2539:0, 2683:555, 2684:446, 2685:538, 2686:446, 2687:538, 2747:-24748, 2753:1, 2760:1, 2769:0, 2770:0, 2771:0, 2772:15, 2773:429, 2774:255, 2775:7, 2776:90, 2777:255, 2778:7, 2779:90, 2780:1005415, 2781:1005415, 2782:0, 2783:16, 2784:271, 2785:8, 2786:109, 2787:1339222, 2788:63, 2801:8, 2802:35, 2803:44, 2804:15679077391, 2805:15, 2806:8, 2807:15, 2808:7, 2809:18, 2810:248354939, 2811:20, 2812:3728208, 2813:0, 2814:0, 2815:0, 2816:0, 2817:0, 2818:0, 2819:0, 2820:1275, 2821:1275, 2822:0, 2823:0, 2824:395, 2825:0, 2830:0, 2831:0, 2832:0, 2833:0, 2834:0, 2835:0, 2836:1353, 2837:1353, 2842:0, 2843:0, 2844:451, 2909:10, 2910:10, 2911:11, 2912:11, 2913:-1, 2914:-1, 2915:-1, 2916:-1, 2917:-1, 2918:-1, 2924:"CorrectlyConfigured",3083:"3.99",3084:"3.11",3086:124,3088:14,3089:385,3096:"3.99",3099:2,3100:13,3101:1,3102:5,3118:"div:7; p:70; a:6; img:1; br:9; b:21; html:1; head:1; meta:3; style:1; body:1; o_p:44; span:41; strong:1",3120:1,3121:1,3124:"0.241",3145:"centene.com",3148:"account"} |
| X-MS-Exchange-Organization-ATPSafeLinks-MsgData | {"IsUrlBeingScanned":"", "UrlWriteTime":"11/15/2024 6:28:42 PM","ASDirectionality":"1","PhishEdu":"0","MsgScanSuspicionLevel":"0"} |
| X-MS-Exchange-Organization-Antispam-SafelinksWrappingInMDFA | True |
| X-MS-Exchange-Organization-Cross-Session-Cache | 03Ptl2FprThreshold=; SRESV_Ptl3FprThreshold=; SRESV_Ptl4FprThreshold=; BKEMB_ModelName=; BKEMB_VerdictVersion=; BKEMB_P2BCLFprThreshold=; BKEMB_NonP2BCLFprThreshold=; BKEMS_FprThreshold=; CLEPV_ModelName=; CLEPV_VerdictVersion=; CLEPV_HCPhishFprThreshold=; CLEPV_LCPhishFprThreshold=; SAEPV_ModelName=; SAEPV_VerdictVersion=; SUEPV_ModelName=SUEPV; SUEPV_VerdictVersion=; UESELV3_ModelName=; UESELV3_VerdictVersion=; BMCSV_ModelName=; BMCSV_VerdictVersion=; BMCSV_FprThreshold=; BKCMB_ModelName=; BKCMB_VerdictVersion=; BKCMB_FprThreshold=; BKCMS_FprThreshold=; SPCPV_ModelName=; SPCPV_VerdictVersion=; SPCPV_FprThreshold=; M3CSV_ModelName=; M3CSV_VerdictVersion=; M3CSV_FprThreshold=; M3CSV_FC_FprThreshold=; SRCSV_ModelName=SDRCB; SRCSV_VerdictVersion=2; UCSELV3_ModelName=; UCSELV3_VerdictVersion=; BMHPV_ModelName=; BMHPV_VerdictVersion=; BMHPV_Ptl1FprThreshold=; BMHPV_Ptl2FprThreshold=; BMHPV_Ptl3FprThreshold=; BMHPV_Ptl4FprThreshold=; M3HPV_ModelName=; M3HPV_VerdictVersion=; M3HPV_Ptl1FprThreshold=; M3HPV_Ptl2FprThreshold=; M3HPV_Ptl3FprThreshold=; M3HPV_Ptl4FprThreshold=; M3HSV_ModelName=; M3HSV_VerdictVersion=; M3HSV_Ptl1FprThreshold=; M3HSV_Ptl1FprThreshold_FC=; M3HSV_Ptl2FprThreshold=; M3HSV_Ptl2FprThreshold_FC=; M3HSV_Ptl3FprThreshold=; M3HSV_Ptl3FprThreshold_FC=; M3HSV_Ptl4FprThreshold=; M3HSV_Ptl4FprThreshold_FC=; BMEPV_ModelName=BPMV3; BMEPV_VerdictVersion=1; BMEPV_Ptl1FprThreshold=12; BMEPV_Ptl2FprThreshold=11; BMEPV_Ptl3FprThreshold=11; BMEPV_Ptl4FprThreshold=9; SRCSV_FprThreshold=240; CrossModelsConfigDestination=; CLEPV_FP=8; CLEPV=8; M3EPV_FP=51; M3EPV=51; M3ESV_FP=546; M3ESV=546; M3EIV_FP=92; M3HPV_FP=37; M3HPV=37; M3HSV_FP=2451; BMESV_FP=2684; BMESV=2684; BMHPV_FP=36; BMHPV=36; BKEMB_FP=-2; BKEMS_FP=10000; SUEPV_FP=521; SAEPV_FP=294; ATCHF_DBG=SKPD:11; FSC=15; FSCID=9301044456; ASC=0; FFV=NSPM; FFV_CL=1; FV=NSPM; FVS=Filters; FSCL=1; TAP_EP=; SFTY_FS=FC;SFTY=9.25;TIP_CULTURE=en-US |
| X-MS-Exchange-Organization-Processed-By-Gcc-Journaling | Journal Agent |
| customer | montrose |
 | |
| Icon Hash: | 46070c0a8e0c67d6 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node