Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Carisls Open Benefits Enrollment.eml

Overview

General Information

Sample name:Carisls Open Benefits Enrollment.eml
Analysis ID:1573220
MD5:dbf3e2ed873185d513036f7fcbbdc933
SHA1:36134b58454c84fe84d8e2c6cdf60cd19dbb0635
SHA256:f3be6b9abba308413efb844f941bf10ebb3887e6982f544b5dd421bd9005c6d8
Infos:

Detection

unknown
Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected potential phishing Email
HTML page contains obfuscated javascript
HTML page contains hidden javascript code
Javascript checks online IP of machine
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 2980 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Carisls Open Benefits Enrollment.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7004 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AA6A314E-A0CD-4E04-830C-A51D9AA15F0C" "F88FF5C0-50D4-4BAE-8DCE-A3C2FE358497" "2980" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 5504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls 401k Retirement Plan.shtml MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1992,i,2368041408547144759,14529834397412562702,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 1736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls Health Insurance Benefits Open Enrollment Plan.shtml MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,1233303934751659993,3413671399187370349,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2980, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
Sigma detected: Outlook Security Settings Updated - Registry
Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2980, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected potential phishing Email
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email contains multiple attachments with .shtml extensions, which is unusual for legitimate communications and could be used to deliver malicious content.. The sender's email address 'Carisls@carisls.com' appears to be similar to the recipient's domain, which could be an attempt to impersonate a legitimate internal communication.. The email lacks a clear message body and context, which is typical of phishing attempts that rely on attachments to convey their malicious intent.
HTML page contains obfuscated javascript
Source: https://msigroupinc.pccwv.com/fcasvwvc/01fecef9ea#ZHNwZXR6bGVyQGNhcmlzbHMuY29tHTTP Parser: (function(_0x29abb1,_0x537524){const _0x3d5a10=_0x29abb1();function _0x1e5368(_0x4b39d8,_0x3887a7,_0
Source: https://msigroupinc.pccwv.com/fcasvwvc/01fecef9ea#ZHNwZXR6bGVyQGNhcmlzbHMuY29tHTTP Parser: (function(_0x29abb1,_0x537524){const _0x3d5a10=_0x29abb1();function _0x1e5368(_0x4b39d8,_0x3887a7,_0
Source: https://msigroupinc.pccwv.com/fcasvwvc/01fecef9ea#ZHNwZXR6bGVyQGNhcmlzbHMuY29tHTTP Parser: (function(_0x56ba4b,_0xb47a7f){const _0x245ab9=_0x56ba4b();function _0x423a1(_0xdd0166,_0x212713,_0x
Source: https://msigroupinc.pccwv.com/fcasvwvc/01fecef9ea#ZHNwZXR6bGVyQGNhcmlzbHMuY29tHTTP Parser: (function(_0x2857ad,_0x50fbf3){const _0x506e83=_0x2857ad();function _0x740182(_0xc4b186,_0x3c3374,_0
Source: https://msigroupinc.pccwv.com/fcasvwvc/01fecef9ea#ZHNwZXR6bGVyQGNhcmlzbHMuY29tHTTP Parser: (function(_0x56ba4b,_0xb47a7f){const _0x245ab9=_0x56ba4b();function _0x423a1(_0xdd0166,_0x212713,_0x
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/IAARQ9SN/Carisls%20401k%20Retirement%20Plan.shtmlHTTP Parser: Base64 decoded: dspetzler@carisls.com
Source: https://msigroupinc.pccwv.com/1522b0e919/start?for=/fcasvwvc/01fecef9eaHTTP Parser: function _0x1c45(){const _0x1f71f5=['decode','856524vazcwm','floor','load-text','emailerror','hasownproperty','664kpmtjw','secure','will\x20submit','files','onloadturnstilecallback','style','cf-turnstile-response','please\x20wait...','city','fromcharcode','exec','includes','hex','none','tolocaletimestring','match','push','unknown\x20browser','1125908eorulc','back','https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png','decodebased','getelementbyid','charcodeat','<i\x20class=\x22fab\x20fa-internet-explorer\x20icon\x22></i>','next','search','unknown\x20device','createelement','\x27\x20occured\x20at\x20\x27','failure','tostringtag','em,email','display','.date','innerhtml','timestamp','email','then','getbased','addeventlistener','url(','post','.device','join','test','classlist','getuser','slice','country_name','backgroundimage','innertext','289780gtvqes','defineproperty','encode','apply','object','tostring','getdomain','reason','1344618wyrzae',"{\"gsk\": \"\", \"...
Source: EmailClassification: unknown
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/IAARQ9SN/Carisls%20401k%20Retirement%20Plan.shtmlHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: msigroupinc.pccwv.com
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: ipapi.co
Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: upload.wikimedia.org
Source: global trafficDNS traffic detected: DNS query: meta.wikimedia.org
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: cdn4.iconfinder.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
Source: unknownHTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: classification engineClassification label: mal48.phis.winEML@26/34@30/165
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241211T1110300992-2980.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Carisls Open Benefits Enrollment.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AA6A314E-A0CD-4E04-830C-A51D9AA15F0C" "F88FF5C0-50D4-4BAE-8DCE-A3C2FE358497" "2980" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "AA6A314E-A0CD-4E04-830C-A51D9AA15F0C" "F88FF5C0-50D4-4BAE-8DCE-A3C2FE358497" "2980" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls 401k Retirement Plan.shtml
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1992,i,2368041408547144759,14529834397412562702,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls 401k Retirement Plan.shtml
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1992,i,2368041408547144759,14529834397412562702,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls Health Insurance Benefits Open Enrollment Plan.shtml
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,1233303934751659993,3413671399187370349,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls Health Insurance Benefits Open Enrollment Plan.shtml
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,1233303934751659993,3413671399187370349,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation11
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Registry Run Keys / Startup Folder		1
Process Injection		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/IAARQ9SN/Carisls%20401k%20Retirement%20Plan.shtml0%Avira URL Cloudsafe
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/IAARQ9SN/Carisls%20Health%20Insurance%20Benefits%20Open%20Enrollment%20Plan.shtml0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
jsdelivr.map.fastly.net
151.101.65.229
truefalse
    		high
    a.nel.cloudflare.com
    		35.190.80.1
    		truefalse
      		high
      s-part-0035.t-0009.t-msedge.net
      		13.107.246.63
      		truefalse
        		high
        dyna.wikimedia.org
        		185.15.58.224
        		truefalse
          		high
          cdn4.iconfinder.com
          		172.66.42.211
          		truefalse
            		high
            default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
            		217.20.58.101
            		truefalse
              		high
              bg.microsoft.map.fastly.net
              		199.232.210.172
              		truefalse
                		high
                ipapi.co
                		104.26.9.44
                		truefalse
                  		high
                  msigroupinc.pccwv.com
                  		104.21.58.239
                  		truefalse
                    		unknown
                    cdnjs.cloudflare.com
                    		104.17.25.14
                    		truefalse
                      		high
                      challenges.cloudflare.com
                      		104.18.94.41
                      		truefalse
                        		high
                        www.google.com
                        		172.217.21.36
                        		truefalse
                          		high
                          upload.wikimedia.org
                          		185.15.58.240
                          		truefalse
                            		high
                            cdn.jsdelivr.net
                            		unknown
                            		unknownfalse
                              		high
                              meta.wikimedia.org
                              		unknown
                              		unknownfalse
                                		unknown

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/IAARQ9SN/Carisls%20401k%20Retirement%20Plan.shtmlfalse
                                • Avira URL Cloud: safe
                                		unknown
                                file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/IAARQ9SN/Carisls%20Health%20Insurance%20Benefits%20Open%20Enrollment%20Plan.shtmlfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://msigroupinc.pccwv.com/fcasvwvc/01fecef9ea#ZHNwZXR6bGVyQGNhcmlzbHMuY29ttrue
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  185.15.58.240
                                  		upload.wikimedia.orgNetherlands
                                  		14907WIKIMEDIAUSfalse
                                  13.107.246.63
                                  		s-part-0035.t-0009.t-msedge.netUnited States
                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  151.101.129.229
                                  		unknownUnited States
                                  		54113FASTLYUSfalse
                                  104.18.94.41
                                  		challenges.cloudflare.comUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  172.217.19.163
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  51.11.192.48
                                  		unknownUnited Kingdom
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  172.66.42.211
                                  		cdn4.iconfinder.comUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  52.109.32.97
                                  		unknownUnited States
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  104.21.58.239
                                  		msigroupinc.pccwv.comUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  64.233.162.84
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  172.217.21.36
                                  		www.google.comUnited States
                                  		15169GOOGLEUSfalse
                                  35.190.80.1
                                  		a.nel.cloudflare.comUnited States
                                  		15169GOOGLEUSfalse
                                  199.232.210.172
                                  		bg.microsoft.map.fastly.netUnited States
                                  		54113FASTLYUSfalse
                                  52.113.194.132
                                  		unknownUnited States
                                  		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  92.122.101.18
                                  		unknownEuropean Union
                                  		1273CWVodafoneGroupPLCEUfalse
                                  172.217.19.238
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  1.1.1.1
                                  		unknownAustralia
                                  		13335CLOUDFLARENETUSfalse
                                  172.217.17.35
                                  		unknownUnited States
                                  		15169GOOGLEUSfalse
                                  151.101.65.229
                                  		jsdelivr.map.fastly.netUnited States
                                  		54113FASTLYUSfalse
                                  52.109.32.7
                                  		unknownUnited States
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                  104.18.95.41
                                  		unknownUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  104.26.9.44
                                  		ipapi.coUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  172.67.166.67
                                  		unknownUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  239.255.255.250
                                  		unknownReserved
                                  		unknownunknownfalse
                                  104.17.25.14
                                  		cdnjs.cloudflare.comUnited States
                                  		13335CLOUDFLARENETUSfalse
                                  52.109.76.144
                                  		unknownUnited States
                                  		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

                                  Private

                                  IP
                                  192.168.2.16

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1573220
                                  Start date and time:2024-12-11 17:09:59 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:20
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • EGA enabled
                                  Analysis Mode:stream
                                  Analysis stop reason:Timeout
                                  Sample name:Carisls Open Benefits Enrollment.eml
                                  Detection:MAL
                                  Classification:mal48.phis.winEML@26/34@30/165
                                  Cookbook Comments:
                                  • Found application associated with file extension: .eml

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe, svchost.exe
                                  • Excluded IPs from analysis (whitelisted): 52.109.32.97
                                  • Excluded domains from analysis (whitelisted): config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                  • Report size getting too big, too many NtSetValueKey calls found.
                                  • VT rate limit hit for: Carisls Open Benefits Enrollment.eml

                                  Created / dropped Files

                                  C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 4761 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
                                  Category:dropped
                                  Size (bytes):4761
                                  Entropy (8bit):7.945585251880973
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
                                  SHA1:9E98ACE72BD2AB931341427A856EF4CEA6FAF806
                                  SHA-256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
                                  SHA-512:3537DA5E7F3ABA3DAFE6A86E9511ABA20B7A3D34F30AEA6CC11FEEF7768BD63C0C85679C49E99C3291BD1B552DED2C6973B6C2F7F6D731BCFACECAB218E72FD4
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:MSCF............,...................O..................YWP .disallowedcert.stl.lJ..B...CK.wTS.....{.&Uz.I."E".HS@. .P.!.....*E. .DQ..... EDA.H. E..""/.s<.s.9.....&#.{~k.VV..7@......b.R....MdT..B.L..%.C......" ....%.4%..%*.B..T.d...S.....pem..$....&.q.`.+...E..C.....$.|.A.!~d.H>w%S$...QC't..;..<..R@....2. .l..?..c..A....Ew...l..K$.. ~...'......Mt^c..s.Y%..}......h......m....h.......~d...,...=ge3.....2%..(...T..!].....!C~.X..MHU.o[.z].Y...&lXG;uW.:...2!..][\/.G..]6#.I...S..#F.X.k.j.....)Nc.].t^.-l.Y...4?.b...rY....A......7.D.H\.R...s.L,.6.*|.....VQ....<.*.......... [Z....].N0LU.X........6..C\....F.....KbZ..^=.@.B..MyH...%.2.>...]..E.....sZ.f..3z.].Y.t.d$.....P...,. .~..mNZ[PL.<....d..+...l.-...b.^....6F..z.&.;D.._..c."...d..... k9....60?&..Y.v.dgu...{.....{..d=..$......@^..qA..*uJ..@W.V..eC..AV.e+21...N.{.]..]..f]..`Z.....]2.....x..f..K...t. ...e.V.U.$PV..@6W\_nsm.n.........A<.......d....@f..Z... >R..k.....8..Y....E>..2o7..........c..K7n....

                                  C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:modified
                                  Size (bytes):340
                                  Entropy (8bit):3.2565883919783145
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:4C171C7091A0C70F1A283BE9C7EFA167
                                  SHA1:16913F8F3142D0B030E99FE144AAD968CCD78662
                                  SHA-256:660DEEB3F7812EB0C2EB909A82CD58B0CDB85E87608A24F46AC879F694C5A3E4
                                  SHA-512:FFB3CD989BDFAF99F81A56EE24E62C0CF63422AA533B50D4EBA9852488D691DAF5F2493CFB6AFBAE859CCB9553D43DE42530DAEAE55B0EAE9B0BD0964BA76CB6
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:p...... .........7.8.K..(....................................................... ........~..MG......&.....6.........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".0.6.c.f.c.c.5.4.d.4.7.d.b.1.:.0."...

                                  C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):231348
                                  Entropy (8bit):4.387352975063766
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:BCF3BE6DA983CB0BD63D15240B424198
                                  SHA1:4530690CFAE45C4754F0A5AC9A4A7D153C3D7997
                                  SHA-256:7F62C6470C9A68F9CB3F313C732066C4044F084B51A6866AC88CA632B093B19B
                                  SHA-512:D5CEA763A82AFB286E274ABC5FD485DE70AEDA20C5FAD43DF9A71A5F0059EEAF892FE4084F9891F93A7F6F4CE9CDBDF2725726D9B3B780F28B828A38FA0FF949
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:TH02...... . .P*.K......SM01X...,...@(D*.K..........IPM.Activity...........h...............h............H..ht..............h........@...H..h\cal ...pDat...h....0.........h..4............h........_`Pk...h..4.@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h..[.........#h....8.........$h@.......8....."hpq.......o....'h..............1h..4.<.........0h....4....Uk../h....h.....UkH..h....p...t.....-h .............+hL.4.....h........... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                  Category:dropped
                                  Size (bytes):322260
                                  Entropy (8bit):4.000299760592446
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:CC90D669144261B198DEAD45AA266572
                                  SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                                  SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                                  SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:ASCII text, with no line terminators
                                  Category:dropped
                                  Size (bytes):10
                                  Entropy (8bit):2.1609640474436813
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:1C07FD2F680B243A18D1EE57A61C63DC
                                  SHA1:1AF6175133E49E519248E69FE924ACBF0C798BBF
                                  SHA-256:4FEA2451FDDD73D832E5CCE4409CD7F5897034F204C311AD327517C807126A23
                                  SHA-512:F568CFD45C45D42592077B9F25F9ED1F48B47E3B9E7D7D21D84D1D31B24B1D926161FF9AD78DDC888233959320070CF4C4F6306B7E055686202EEDB7C0C8ED38
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:1733933438

                                  C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C30C1709-2532-44A3-AAB1-464193A085A2

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):181859
                                  Entropy (8bit):5.295293437154843
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:261ED09EDB5075A69C88279AB2E283C1
                                  SHA1:1C9B33DB628FC7286D040C9D7B850E8D352A114D
                                  SHA-256:C9B380A03B220B45CA22D92B06BAF773B8E145CEB92F68EC1866DE5ECE5AE717
                                  SHA-512:F6E67A71FB006C690CF5D3BDD2D44ED7A9C99A9A8439234F467B7AB8BE3F134069D7A46E4BFACE8E6FD050C6020715A1662650F0231F3D1F2B607FF4D42E7177
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-12-11T16:10:34">.. Build: 16.0.18312.40138-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[

                                  C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):2278
                                  Entropy (8bit):3.8393998938881357
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:A03BA09757091942C3A777D3102F60EC
                                  SHA1:9ABD964E5D7A1B7852DDABBDA8EB5FAE4C1FEA73
                                  SHA-256:96D025ED14595210874C56A1894A3C33B4DD588F48E467E937266128CF74876A
                                  SHA-512:8EB0D756FD2E705DB9B66B0100C19B4D52DBB4156C42C4975EEB4B6F3C5551CE7AA3390F654D2095EAB18D0FFCCC054CBB033D1370969BE0B0947DE1303AA9D8
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.C.H.9.l.u.9.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.5.m.B.e.S.

                                  C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:modified
                                  Size (bytes):2684
                                  Entropy (8bit):3.91499813636918
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:EB81FD92AED0CFCD89C26971D3350E82
                                  SHA1:AD7ACA35974760A879F29BB5E0EEB88A70841EFD
                                  SHA-256:62EE4C6DDD93DAF82C414056B4AA06855D2900D1217EFD1333A498279201DE2E
                                  SHA-512:CA1FFB599319A6D1758442BE4D60288C74B210CDF7F8C2C8845A88AD48BC10F5F9406F3E2D32751559C59E4036CA91903E25E804B06132B5A5387790E7C6E785
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Q.t.+.S.r.r.h.q.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.5.m.B.e.S.

                                  C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):4542
                                  Entropy (8bit):3.9996374754652604
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:AE98B3B3A6AC96DB63BF359D1C5D441B
                                  SHA1:CFA9F8B9C066CCF6FF1CE5159A78FCDD9F3E377C
                                  SHA-256:92C3182E30E9E4A11E96A4B4AA54238179218F249BB99521B446599B961DCFE5
                                  SHA-512:38D469DBEDB758191D3832CB22B9B7767AD4DA83F642796CA4102C7F275AEA558904CDE06E95CE7F52D2DD9A009CD586AEDC6D5C95A771309F093542E459A0C4
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".w.2.o.W.f.e.d.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.5.m.B.e.S.

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls 401k Retirement Plan (002).shtml:Zone.Identifier (copy)

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:HTML document, ASCII text
                                  Category:dropped
                                  Size (bytes):0
                                  Entropy (8bit):0.0
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:EC92C885F84F75CA0BC3D210EECB2E0A
                                  SHA1:B9D157B378D5A9ABE4C70C23A7A9B8D19BB1B64A
                                  SHA-256:3FA03B12009D8003D79FEE77BCD68C3BDA1D096856956A642DDC29D67EE146D5
                                  SHA-512:A64EBB0CBAFA3F0C5DFCD7D31D1580F76FC3D1CACD44B0587D3CCAB41FDCF4ADCB6973D0E72A3158DE4A32FB89D655AEE2B14F731E4DE8DC87F59AE9831085A9
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Proofpoint Compatible Attachment</title>. <style>. body {. font-family: Arial, sans-serif;. background-color: #f4f4f4;. color: #333;. margin: 0;. padding: 0;. }.. .container {. max-width: 600px;. margin: 0 auto;. padding: 20px;. background-color: #ffffff;. border: 1px solid #ddd;. text-align: center;. }.. .button {. display: inline-block;. padding: 10px 20px;. font-size: 16px;. color: #ffffff;. background-color: #0070C0;. text-decoration: none;. border-radius: 4px;. margin-top: 20px;. }.. .content {. font-size: 16px;. line-height: 1.5;. margin: 2

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls 401k Retirement Plan.shtml

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:HTML document, ASCII text
                                  Category:dropped
                                  Size (bytes):1862
                                  Entropy (8bit):4.539385470402863
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:EC92C885F84F75CA0BC3D210EECB2E0A
                                  SHA1:B9D157B378D5A9ABE4C70C23A7A9B8D19BB1B64A
                                  SHA-256:3FA03B12009D8003D79FEE77BCD68C3BDA1D096856956A642DDC29D67EE146D5
                                  SHA-512:A64EBB0CBAFA3F0C5DFCD7D31D1580F76FC3D1CACD44B0587D3CCAB41FDCF4ADCB6973D0E72A3158DE4A32FB89D655AEE2B14F731E4DE8DC87F59AE9831085A9
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Proofpoint Compatible Attachment</title>. <style>. body {. font-family: Arial, sans-serif;. background-color: #f4f4f4;. color: #333;. margin: 0;. padding: 0;. }.. .container {. max-width: 600px;. margin: 0 auto;. padding: 20px;. background-color: #ffffff;. border: 1px solid #ddd;. text-align: center;. }.. .button {. display: inline-block;. padding: 10px 20px;. font-size: 16px;. color: #ffffff;. background-color: #0070C0;. text-decoration: none;. border-radius: 4px;. margin-top: 20px;. }.. .content {. font-size: 16px;. line-height: 1.5;. margin: 2

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\IAARQ9SN\Carisls 401k Retirement Plan.shtml:Zone.Identifier

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):26
                                  Entropy (8bit):3.95006375643621
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                  SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                  SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                  SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:[ZoneTransfer]..ZoneId=3..

                                  C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                                  Download File
                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):30
                                  Entropy (8bit):1.2389205950315936
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:A055F1FECDD6330870F947EEB352E63C
                                  SHA1:891738ABDDFCEF08F4A69233B8E01D9D57445320
                                  SHA-256:D68DB5B02E161A040B2203A5D45B829053CD6E91DB0A4EF6B7F1C425C95170C8
                                  SHA-512:9208A13EA539427249B5A711B4BDCDF7B68668315C85EB1BB5C50D942EE9573041B631CEDF61E7074453B9110DDBE7006EBF95CF1C51EC4BF7DB27FF1D496879
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:..............................

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 15:11:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2673
                                  Entropy (8bit):3.9855854468555947
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:90CC026745CB672E9C66D77B79412403
                                  SHA1:7FB3E1AF0F21F876A844D32552963836BF0E9C05
                                  SHA-256:B4DA7EEA2C3D4626318CECE9DE3B84C6BB74631DA015FF61619779783CA8CE35
                                  SHA-512:EAEEACE8A8EB31FE500C733409A200DE0EFB1AC3BFB7E2E3203326FD3B3D730CF4EB16BBD8DFB4969B761B4CF0EE60F1D73927A23FCE4585474FBA9BDA83542A
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....Zw.K.K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yf............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 15:11:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2675
                                  Entropy (8bit):3.997500709537697
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:DAF05CD16C49B201AA0B8F81BA2801DA
                                  SHA1:4C1356B97A9B02CC1F331F8179EF8F4B92EEBDA4
                                  SHA-256:1C1BD93237EA7C28C00B4B897E9BDE3E022BB570E30846C02B2678E01B1F8FE7
                                  SHA-512:47D0FD2C474F49854EB4D21D3CE4CCF6D659FCFED9F60768A17307D75E25E697C91FEF8196F6375E3B7D99F74931465272879E257A6AD3F1D72DA449C1DCBDF7
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....m..K.K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yf............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2689
                                  Entropy (8bit):4.0078245146837075
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:D6550AA3CAFD2CC18A97B5897694AC6F
                                  SHA1:FFB0AF969C3A0E37E92DB34FB012122409BF3B74
                                  SHA-256:43F7DC70ADF17D398AF316E2C8041944017A25E8032C2EDEC5161B344A1B88AA
                                  SHA-512:B2488E1A8C90BBBCF88992EE1C02B278C0B9791697FFBBEB92767171BA400FD0F456537581D37C89BAF1FEDA2FBA0392529A2E766A934FF9CE31739AA83C9FC1
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 15:11:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):3.9959283352334207
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:533D89936B675A4A0E5A81D573E06E6C
                                  SHA1:241FC40E181BFC5ED9B2C6943914B9926F681E69
                                  SHA-256:8502FF33C8D31854B93F8CD7E883A85679077ED8F8F4220BCFB70A521E430302
                                  SHA-512:1EADEC1E8DA8E89636C81AD476CB433706902A2E16FF7895617A67B7F3F0314B085F7EC1C40A398BC45410F244AB44699EC67FF9FA87F5838922F1B4EE290165
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....m6.K.K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yf............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 15:11:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2677
                                  Entropy (8bit):3.985160610578245
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:A4EF2851CEF1A1208481DD0A47D2B7F2
                                  SHA1:15C4C8993B0994D865D90CD9509EB076FE4DA43E
                                  SHA-256:CD5CA73A6A7CAE397296E257F987DD92A055D05A02B20E3E5A7071A7D25FEC98
                                  SHA-512:857B1D45EC6EBF2AE0A5339929518F94C20F333E9588A2DE3A572FFD5215470D026A55BFE80B8608C636209556A4E158CA89AC02C353AA0C33F56CD085965409
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,....>G.K.K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yf............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 11 15:11:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                  Category:dropped
                                  Size (bytes):2679
                                  Entropy (8bit):3.995240345852487
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:ED180197421BB31FD6340D9BBBB8F74E
                                  SHA1:4C5762D53551A84DA98E05D8764043D56DDF6538
                                  SHA-256:7111C26B6E1C5D247BA0A6027D13CC41254F74E0CBE26DC023303A00A7CC3D88
                                  SHA-512:AB24FCEEBDBA860B2617B13B9C2ABA74C239584501A9C4ECA9F71999A495224DCA5323CBA66E23782F80CA197E11492ED51DB189710C573ECEA648A5C32114C8
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:L..................F.@.. ...$+.,.....4|K.K..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Yf............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                  Chrome Cache Entry: 101

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text
                                  Category:downloaded
                                  Size (bytes):13449
                                  Entropy (8bit):4.975926375366003
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:7A141AA73464A901C42E7F5077855981
                                  SHA1:A77FAAFCFB056D4242ED29435B6E7B6925ED02B5
                                  SHA-256:37D130FACC014B482060999A0D0070D659C1EC5609BE0F82E1EF014B7628F71A
                                  SHA-512:760FB0AA83C6D8CB0A44A9A2F9425DDB3E978992AF6B1EF3A3B085B2F0F54764B7E69133C2AC3A07D13A35CC5F0CD08B7BF89180DEC313CF6F17B30DB2651557
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://msigroupinc.pccwv.com/statsic/css/main.output.css
                                  Preview:*, ::before, ::after {. --tw-border-spacing-x: 0;. --tw-border-spacing-y: 0;. --tw-translate-x: 0;. --tw-translate-y: 0;. --tw-rotate: 0;. --tw-skew-x: 0;. --tw-skew-y: 0;. --tw-scale-x: 1;. --tw-scale-y: 1;. --tw-pan-x: ;. --tw-pan-y: ;. --tw-pinch-zoom: ;. --tw-scroll-snap-strictness: proximity;. --tw-gradient-from-position: ;. --tw-gradient-via-position: ;. --tw-gradient-to-position: ;. --tw-ordinal: ;. --tw-slashed-zero: ;. --tw-numeric-figure: ;. --tw-numeric-spacing: ;. --tw-numeric-fraction: ;. --tw-ring-inset: ;. --tw-ring-offset-width: 0px;. --tw-ring-offset-color: #fff;. --tw-ring-color: rgb(59 130 246 / 0.5);. --tw-ring-offset-shadow: 0 0 #0000;. --tw-ring-shadow: 0 0 #0000;. --tw-shadow: 0 0 #0000;. --tw-shadow-colored: 0 0 #0000;. --tw-blur: ;. --tw-brightness: ;. --tw-contrast: ;. --tw-grayscale: ;. --tw-hue-rotate: ;. --tw-invert: ;. --tw-saturate: ;. --tw-sepia: ;. --tw-drop-shadow: ;. --tw-backdrop-blur: ;.

                                  Chrome Cache Entry: 102

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines (47691)
                                  Category:dropped
                                  Size (bytes):47692
                                  Entropy (8bit):5.401573598696506
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:B0B3774E70E752266B4CF190E6D95053
                                  SHA1:03823D33D8C374DD69B66F1D75A5FC93D29967E1
                                  SHA-256:A9F0787E39291D7BCB873D0D514F1D2C8DB0256FD741C2ABC4D46A809254E141
                                  SHA-512:8060AA547C3F32930EC2A3786A6BB15054F396D8EAB238EA34E881C2EEAE0D013AF246FDDE85DA8A5BFC2690B1EB26E5138B45BAA28479264DB3BA458D4055A8
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

                                  Chrome Cache Entry: 103

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Web Open Font Format (Version 2), TrueType, length 105204, version 768.67
                                  Category:downloaded
                                  Size (bytes):105204
                                  Entropy (8bit):7.989899350029445
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:EE91E640B5449FB98D9320C877A9866E
                                  SHA1:7FDC6B3926B1DD023F9F2AD7D53BC22694694281
                                  SHA-256:33A252D6393CBD6DEBE0AC517229C7AA258A0EE68FC0253F8BE6A7CEE8B65EE9
                                  SHA-512:B787D1E727C77E85DE52FDEDEA16A719BE00CFABF739F44451A2A35DB443900E8B3178DB1DDD5EAE9018850888B94994343E9B1E15873CD0211DAE83C405BD3D
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-brands-400.woff2
                                  Preview:wOF2...............h.......C.....................8.$. .`..D..8..`.H..H. ..VQf......Z?.....=..j..o......._......; ..o.....9..........'P.....U.....P.[.+7.\4....Y.B.d....[.h.!.....Z...2.....]5..]]]3..f.......E......9`.2.A'N.X..v....N....C#.yZ.Z............4.....I.Y...;..(q@..8H..m~v.KN....{.F..:..%..u...)U!JP...$v......(.n./.S:.(T..Mh.(.t../...N+.|..o.......9Zr!P.........T\...c!#.||*.....O4G(.........p.{?..#...Y..2".`DV.....U..jNT.3[.9}.$g.(.....H.Y5"......GD.#.`.Er.......(..Z.>...D...%.].[.......p..!..qU.&'Q .$.j2......B..........^.`4..L.[....R......Q.+.[.q..%...........A..$..N.A.aK.d.'. ..7~..t.a.oj...8....u._h%.+.%.K...GC....R.|..u.W.......L..{W.....d.u:..L.Q...<.YBt....X.s.z"#....R$Tg.9......@A.;.?.w}.u.z...".'..w..i....w..&...i...3....,.n.hC<..8.3(...L..4....3....'x.M.J}...v.......S.4._[......>a.@I.8i[.S....A...%..Y2.ezM...M..%>.af.P.?...8..G...x:.......Hi.:..S.\.g....6.IY...i..aN~..F...c....al;1.R.3.._.l#...3..s?M.5..|...4h

                                  Chrome Cache Entry: 104

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines (8748), with no line terminators
                                  Category:dropped
                                  Size (bytes):8748
                                  Entropy (8bit):5.745537567226566
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:A548FB092A7DACBC63E50C2B9C7E7C99
                                  SHA1:18FEA7504C2AF1654174A6989F1516F3E455BE62
                                  SHA-256:99ADEB9FE4B6727631ADE4FB099EE73942EC9B35382B21C5891E6A849440FF37
                                  SHA-512:E8BD2A3C5C4FB4E7BA1F2B6A24EF931311E3A126C6F5BFCA851F4C42440AB7164553C08504F415FB84AA30177D7F3DCF6A0F3E9E2AA16EAC8B80351E653F1053
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,j,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=parseInt(V(350))/1*(parseInt(V(288))/2)+-parseInt(V(324))/3*(parseInt(V(318))/4)+parseInt(V(280))/5+parseInt(V(287))/6*(parseInt(V(354))/7)+parseInt(V(337))/8+parseInt(V(258))/9*(parseInt(V(262))/10)+parseInt(V(269))/11,d===f)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,723693),h=this||self,i=h[W(267)],j=function(X,d,e,f){return X=W,d=String[X(254)],e={'h':function(E){return null==E?'':e.g(E,6,function(F,Y){return Y=b,Y(282)[Y(308)](F)})},'g':function(E,F,G,Z,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(Z=X,E==null)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[Z(283)];R+=1)if(S=E[Z(308)](R),Object[Z(260)][Z(338)][Z(294)](I,S)||(I[S]=M++,J[S]=!0),T=K+S,Object[Z(260)][Z(338)][Z(294)](I,T))K=T;else{if(Object[Z(260)][Z(338)][Z(294)](J,K)){if(256>K[Z(351)](0)){for(H=0;H<N;P<<=1,Q==F-1?(Q=0,O[Z(353)](G(P)),P=0):Q++,H++);for(U=K[Z(351)](0),H=0;8>H;P=P<<1|1.53&U,F-1==

                                  Chrome Cache Entry: 105

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines (14585), with no line terminators
                                  Category:dropped
                                  Size (bytes):14585
                                  Entropy (8bit):5.389256438234566
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:7972530F218887D2A6BECFA6CC92599E
                                  SHA1:51E9F28B67419AE02047D29C5CD6CA200BB99FB9
                                  SHA-256:0E90D8FA0A06094B0C994BBFC5B071F7D331141416EA484A02FF175DBCFE8FF9
                                  SHA-512:D7A02313269CBB8642BAA53C4B7C3178E74A53AE7EBF48494363219E93CBEC1A87B9B012BF85B8DBDBE342AB59BE0056CCB0464662D1F9A7A7EB0EB921CC259B
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:function _0x1c45(){const _0x1f71f5=['decode','856524VAzcWM','floor','load-text','emailError','hasOwnProperty','664kpMTjw','secure','will\x20submit','files','onloadTurnstileCallback','style','cf-turnstile-response','Please\x20wait...','city','fromCharCode','exec','includes','hex','none','toLocaleTimeString','match','push','unknown\x20browser','1125908EOruLc','back','https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png','decodeBased','getElementById','charCodeAt','<i\x20class=\x22fab\x20fa-internet-explorer\x20icon\x22></i>','next','search','unknown\x20device','createElement','\x27\x20occured\x20at\x20\x27','failure','toStringTag','em,email','display','.date','innerHTML','timeStamp','email','then','getBased','addEventListener','url(','POST','.device','join','test','classList','getUser','slice','country_name','backgroundImage','innerText','289780Gtvqes','defineProperty','encode','apply','object','toString','getDomain','reason','1344618WyR

                                  Chrome Cache Entry: 106

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:JSON data
                                  Category:downloaded
                                  Size (bytes):116
                                  Entropy (8bit):4.27615721134121
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:D21B070EB0A47D7CAD9C5E16B2C53893
                                  SHA1:FEAD7559A958B3C0FD9475CE57D1698BBD79B5D6
                                  SHA-256:C40EB6D50CEE55CD98E628B786109035413FEF21587791221D06070E99E9E25B
                                  SHA-512:ED0A0DB33EE2E637689687F396B3C0AF35A07A526BF08E2481C853F0ADD4EDFC4E49C1CC0B7241B8D2C8138E7AD12E6367979EE4AF8B7EF50AD4A4CC980F5F27
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://ipapi.co/json/
                                  Preview:{. "error": true,. "reason": "RateLimited",. "message": "Visit https://ipapi.co/ratelimited/ for details".}

                                  Chrome Cache Entry: 107

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines (17220)
                                  Category:dropped
                                  Size (bytes):17555
                                  Entropy (8bit):5.453598269550384
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:DA82A10FA8D8F2C50A6A1023E9CA1E9B
                                  SHA1:FD482427F174745199B7C35ABEFBC60E9D74682B
                                  SHA-256:624B8E9796ED8331E26E5E994BB64C2692DCC7643D0CE53F8E1E620D8C71D444
                                  SHA-512:18028A0DF524E385E9427CC8DC5F7DC72E679BDE11CFBBAD0196E32D626EAEF14C5D668534FFE864F154E1A12A6D69F6A1F1280AF993E72C3EAD619AAC35BBB6
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:/**. * Minified by jsDelivr using Terser v5.19.2.. * Original file: /npm/ua-parser-js@1.0.38/src/ua-parser.js. *. * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files. */.!function(i,e){"use strict";var o="function",a="undefined",r="object",t="string",n="major",s="model",b="name",w="type",d="vendor",l="version",c="architecture",u="console",p="mobile",m="tablet",f="smarttv",h="wearable",v="embedded",g="Amazon",x="Apple",k="ASUS",y="BlackBerry",_="Browser",T="Chrome",S="Firefox",q="Google",z="Huawei",N="LG",A="Microsoft",E="Motorola",O="Opera",U="Samsung",C="Sharp",P="Sony",j="Xiaomi",M="Zebra",R="Facebook",B="Chromium OS",D="Mac OS",V=function(i){for(var e={},o=0;o<i.length;o++)e[i[o].toUpperCase()]=i[o];return e},I=function(i,e){return typeof i===t&&-1!==G(e).indexOf(G(i))},G=function(i){return i.toLowerCase()},L=function(i,e){if(typeof i===t)return i=i.replace(/^\s\s*/,""),typeof e===a?i:i.substring(0,500)},F=functi

                                  Chrome Cache Entry: 108

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:HTML document, ASCII text
                                  Category:downloaded
                                  Size (bytes):228939
                                  Entropy (8bit):5.564071725151838
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:0F69960EA13AF00194586BB2146AF8ED
                                  SHA1:9078A193DC02A344D4400C58D7E5EBACA2601124
                                  SHA-256:6311AC6E89D3BC521B1CB38B491B87D3B6D4F8590B080879621D9D3AD8BB6C9A
                                  SHA-512:A1BBA3E278DD2497ECF5654D214DB0FF8644C2FC8BC074ADCB7A622BD0F27ACBAA670BEEF409DC481EFC2AEA9A2B227D147DF576A9C92A40636C6EFB60339211
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://msigroupinc.pccwv.com/static/favicon/wikipedia.ico
                                  Preview:<!DOCTYPE html>.<head>. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <style>. .theme-light,. :root {. --rem360: 22.5rem;. --rem320: 20rem;. --rem192: 12rem;. --rem144: 9rem;. --rem128: 8rem;. --rem96: 6rem;. --rem90: 5.625rem;. --rem88: 5.5rem;. --rem64: 4rem;. --rem56: 3.5rem;. --rem48: 3rem;. --rem40: 2.5rem;. --rem36: 2.25rem;. --rem32: 2rem;. --rem28: 1.75rem;. --rem26: 1.625rem;. --rem24: 1.5rem;. --rem22: 1.375rem;. --rem20: 1.25rem;. --rem18: 1.125rem;. --rem16: 1rem;. --rem15: 0.9375rem;. --rem14: 0.875rem;. --rem12: 0.75rem;. --rem10: 0.625rem;. --rem8: 0.5rem;. --rem6: 0.375rem;.

                                  Chrome Cache Entry: 109

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Web Open Font Format (Version 2), TrueType, length 125064, version 768.67
                                  Category:downloaded
                                  Size (bytes):125064
                                  Entropy (8bit):7.994213368618236
                                  Encrypted:true
                                  SSDEEP:
                                  MD5:57B380D27F14F16E737BCCA7E849CF79
                                  SHA1:2E4280929D4D76FC0E31601C98F167F14630C209
                                  SHA-256:94E1BBC1C2A41EBC73FA5253FD563256C0035B4D69181E48F9AEF9E474A11251
                                  SHA-512:88DD2321CC4711333411A24DAB612DAA68CAF7CC31C892405BCBB9E89629CA15FCDD781BB26D7485F5819B5B48170EC8EAA2135701F4695CF94A1CB0C15BF649
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-solid-900.woff2
                                  Preview:wOF2.............R....=...C.....................8.$. .`..l...d....p.... .u)...........y....{XG.....PUUU....U........................................{......'R%........T.)Ue.)..d~O.....<.3R.hC..S3...ig.}.[........./._.NoxN...~/........{^h}&)..0+.b.....iofi.<......;..V......E.jF0.E6.V.......z-_..x s... ......DA).tk......JRE%..@.F,....$3.........9_..b....'.......-sg..R.i$..jw%.V...z...e...nk..........$./..H.A.)`9.>B.?.'.J.K.. .A..qj..e.K..4%....&E......f ...8K..a..{8.9b.q..}.%P~.fj.>....$.Yi...V+....@...N.....M.`S.([J.....w\..o....az.9"........-m....6.m..2ow.e.7.L:....... 0........I..a=\..............N.n.i........F....mP.m.M.S.G)5..-.........ouM.]/..nD.h$.].33..s.A..Gtf.2.|..Y"D..b..~..?.7Z".L..#...%....~O:.....ncl.uQ.;3.....X.... ..$..P...]@......z>.t..D.9Jv.....@P.J.9uQ.S..........}....K..r...~...1.?N^..a.s.5....E.x.A#....hD.0...}..z.E...)%8d.IeV..2?)..E......H...R. ...eH.e...DR.nj..$eV......fUO.......6.......q.a...v{m....."[%.....-Q+..E.

                                  Chrome Cache Entry: 110

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines (8815), with no line terminators
                                  Category:downloaded
                                  Size (bytes):8815
                                  Entropy (8bit):5.745077536816465
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:E46A8A56C6F6269092A3C91461FB76EA
                                  SHA1:08F367886B8717D9C42EBC21391676D3825F41E2
                                  SHA-256:6A974A3824578800523A0125C8B1AFE75464E96FDA344A30A608D2EDC34CF859
                                  SHA-512:C859115D4C3CF1BE3DFD9140A382B4DB33A464D61963817DB2C73F528345E07480EA55FEF269C6F1DA8327C17EC737EC3CCBA5D0727D35EF1EB356C3413FE8D2
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://msigroupinc.pccwv.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js?
                                  Preview:window._cf_chl_opt={cFPWv:'g'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=-parseInt(V(460))/1+parseInt(V(467))/2*(parseInt(V(489))/3)+-parseInt(V(554))/4*(-parseInt(V(442))/5)+-parseInt(V(536))/6*(parseInt(V(462))/7)+parseInt(V(486))/8*(parseInt(V(540))/9)+parseInt(V(471))/10*(parseInt(V(501))/11)+-parseInt(V(502))/12,g===e)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,853396),h=this||self,i=h[W(488)],j={},j[W(470)]='o',j[W(433)]='s',j[W(438)]='u',j[W(452)]='z',j[W(506)]='n',j[W(504)]='I',j[W(497)]='b',k=j,h[W(434)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,E===null||E===void 0)return G;for(I=n(E),g[a1(505)][a1(459)]&&(I=I[a1(455)](g[a1(505)][a1(459)](E))),I=g[a1(511)][a1(532)]&&g[a1(456)]?g[a1(511)][a1(532)](new g[(a1(456))](I)):function(O,a2,P){for(a2=a1,O[a2(522)](),P=0;P<O[a2(508)];O[P+1]===O[P]?O[a2(483)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(450)][a1(443)](J),K=0;K<I[a1(508)];L=I[K],M=m(g,E,L),J(M)?(N='s'===M&&!g

                                  Chrome Cache Entry: 111

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:HTML document, ASCII text, with very long lines (50638), with no line terminators
                                  Category:downloaded
                                  Size (bytes):50638
                                  Entropy (8bit):5.481521644995011
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:9F2C77DF9468570FF1AD31E7DE1E5728
                                  SHA1:5E4D045B43E130DF745950268B309F1AEF70A76F
                                  SHA-256:9983813B3DCF277D110F49CA6F92CED7BB0CE24AF798A99A9473CDE759D783E0
                                  SHA-512:8E4067BD43D59003FEBAEFCB055DC0F5BDB44CC5163689F09DD04069993515AEE77A5BF22703B6DE972D701CE0F3CEFA80A6BEB17C49FFC7342DE7CB8E747095
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://msigroupinc.pccwv.com/fcasvwvc/01fecef9ea
                                  Preview:<html style="filter: hue-rotate(53.869806deg)"><head><meta content="width=1120" name=viewport><meta content=max-image-preview:standard name=robots><link href=https://en.wikipedia.org/wiki/SS_Robert_F._Hoke rel=canonical><link href=//en.m.wikipedia.org/wiki/SS_Robert_F._Hoke media="only screen and (max-width: 640px)" rel=alternate><link href="/w/index.php?title=SS_Robert_F._Hoke&action=edit" rel=alternate title="Edit this page" type=application/x-wiki><link href=https://creativecommons.org/licenses/by-sa/4.0/deed.en rel=license><link href="/w/index.php?title=Special:RecentChanges&feed=atom" rel=alternate title="Wikipedia Atom feed" type=application/atom+xml><meta content="MediaWiki 1.44.0-wmf.6" name=generator><meta content=origin-when-cross-origin name=referrer><meta content name=ResourceLoaderDynamicStyles><meta charset=utf-8><link href=login.wikimedia.org rel=dns-prefetch><link href=/static/favicon/wikipedia.ico rel=icon><link href=//meta.wikimedia.org rel=dns-prefetch><link href=//u

                                  Chrome Cache Entry: 112

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:HTML document, ASCII text
                                  Category:dropped
                                  Size (bytes):229877
                                  Entropy (8bit):5.567647402500774
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:6EA82777379C8BE6C967EE0ED7671D66
                                  SHA1:7E06879033D24831DA314775C9FD4C7F98CC0879
                                  SHA-256:2D90AB8247109BE139508DB49EC6C5431275031C6BAF2C9C32A4D03C6B8B743E
                                  SHA-512:2491BFA31CA1747A3B87CC2FFD373D7CE353735ABF5713254614FC9E5C2B0418943BA382D62AC86F4B97FD2BA48A370D8366CDE77D91A3A3E92A43F95C515C12
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:<!DOCTYPE html>.<head>. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <style>. .theme-light,. :root {. --rem360: 22.5rem;. --rem320: 20rem;. --rem192: 12rem;. --rem144: 9rem;. --rem128: 8rem;. --rem96: 6rem;. --rem90: 5.625rem;. --rem88: 5.5rem;. --rem64: 4rem;. --rem56: 3.5rem;. --rem48: 3rem;. --rem40: 2.5rem;. --rem36: 2.25rem;. --rem32: 2rem;. --rem28: 1.75rem;. --rem26: 1.625rem;. --rem24: 1.5rem;. --rem22: 1.375rem;. --rem20: 1.25rem;. --rem18: 1.125rem;. --rem16: 1rem;. --rem15: 0.9375rem;. --rem14: 0.875rem;. --rem12: 0.75rem;. --rem10: 0.625rem;. --rem8: 0.5rem;. --rem6: 0.375rem;.

                                  Chrome Cache Entry: 113

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:ASCII text, with very long lines (65311)
                                  Category:downloaded
                                  Size (bytes):83981
                                  Entropy (8bit):4.7735566283508355
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:3D5EF2BF867C4054A2F336CDBAD9E1DC
                                  SHA1:07228D1FA3245EE156A27A353F45758A3207849F
                                  SHA-256:A361E7885C36BACB3FD9CB068DA207C3B9329962CAC022D06E28923939F575E8
                                  SHA-512:168DEB96B663FE4EEE8D39C78380864760FB912B34BF82CB6A7C36AA4B18B91944CCEFAD71A10F428810D0A6A818DDBAFF3AE7DB42264750DFB8B5A73A8EDA04
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css
                                  Preview:/*!. * Font Awesome Free 6.0.0-beta3 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). * Copyright 2021 Fonticons, Inc.. */..fa{font-family:var(--fa-style-family,"Font Awesome 6 Free");font-weight:var(--fa-style,900)}.fa,.fa-brands,.fa-duotone,.fa-light,.fa-regular,.fa-solid,.fa-thin,.fab,.fad,.fal,.far,.fas,.fat{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{font-size:.625em;line-height:.1em;vertical-align:.225em}.fa-xs{font-size:.75em;line-height:.08333em;vertical-align:.125em}.fa-sm{font-size:.875em;line-height:.07143em;vertical-align:.0

                                  Chrome Cache Entry: 116

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:PNG image data, 512 x 512, 8-bit colormap, non-interlaced
                                  Category:dropped
                                  Size (bytes):3342
                                  Entropy (8bit):6.61311339116926
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:702F48CC33CCF32121FE843BFC628547
                                  SHA1:303FC4E4B88D5658C3D44624C6CEF9F3FA1F355D
                                  SHA-256:A0E345DEC2F1A0DEC023D3BC85AD2CEDD8BD6700692D7DBB39C4FA65ACB5E4BE
                                  SHA-512:427187847CD88C9943D82F0D2A474E5C0FFD46657A8935078C6B7CECD7378A47D71A5DCC3FD7B8740B7453E734D5CC9F80C8D1B0F1EAC594BFD15D28CF5E1BAF
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.PNG........IHDR..............$....:PLTE..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................k.].....tRNS.k...ce........O...z.v.w@y.A... .i.E.S....{...."2...FGHN.U...f1.....?.~..R(m......b..n.....,_...}#...I..&.)+..348<|..Q..sCr..0.*%.....haqP..=...'.$..TDxo....>.u..B......t.....V....gjd?..$....IDATx...KK.q...xw..he.R..-..ED.V]..At......J%ed.e...T*u..[..JRg\.....}.y.9.yC.$I.$I.$I.$I.$I.$I.$I.$I.$I.$I.$I.$I.$I.$I.$I.T).......=*[.@o..`7@a....e..byW../..........Q.._.ib

                                  Chrome Cache Entry: 97

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:Web Open Font Format (Version 2), TrueType, length 23760, version 768.67
                                  Category:downloaded
                                  Size (bytes):23760
                                  Entropy (8bit):7.984594739139778
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:82BAFEE9DCC7B6FB7BCA7ED323F9B7AE
                                  SHA1:FFD3B574CB7DB4E2CD0CC2EA9214F0BB8989207F
                                  SHA-256:886FD1E6CE992EDE514743A826FA71FEFDB577047A2A899CA95F6F28F3305D09
                                  SHA-512:EED2562B9DDECEB57207E22B35F7F1AEC302D644FDDE0341DA707FBE9A66EADB740CA002ADCA2E88F9F2C4F68A7130A24173A7447CD9B9494C0B33CA96A18039
                                  Malicious:false
                                  Reputation:unknown
                                  URL:https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-regular-400.woff2
                                  Preview:wOF2......\...........\....C.....................8.$. .`........,....0. ..peA.........U.L..W.._~..........u.o.......@...6Lj.8L...K..?.Z.'...J..Q..'9.-.0}..p...w,.....x.|..U.JiO.......wo......L...d&!.AZ.$$5J....WW..._OD..'..1..S.....'T.~...A.A...H.....$D..,..V..-.l.])._..{..hw....Z..\....=.U..{.5..q...9.7B....T.......u}|;...g..LYx.t..D7%..v......t~.<.N.S...h...x..{S+s.yy?{-._..}&oC...W..n.......i.&y..'...m......qFn8..he...r(C.L..`VvF.s.,.r....p..*..N.J..RdCe...B...T6..W.c'E7 .[e....9.&).1....Y..H....;..3!..>F.}..W......h........?...........YsS.......uo$kjn.Ecs3-.[....R....u.....[e?...li...n_.G....Z.l.1..~..6.Y.I..y.]Y.Rv.lF.*..5^3.....}...3.......d....=...v..y.l.h..q....&.....y...uX....WY*..oX.d..m...uK.m[..i........y/\.y.|.c..*...+.G.V/Q..;g....y.)..`<...e`;..TI...0>..)+=..|dI/..,.K..i.W..Vi.C....Vm.d.e.....6.f..v.e.=..g...:.#.:..N:.3.:.7.W.Y.Z.....U.Q.e....g..-ym^............b.b.b.b.b.XS.9j.A..F....:.D...}.o...18FDU...Q..Q...6..p...q*.Fc

                                  Chrome Cache Entry: 99

                                  Download File
                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                  File Type:PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
                                  Category:dropped
                                  Size (bytes):1057
                                  Entropy (8bit):7.6851406288304105
                                  Encrypted:false
                                  SSDEEP:
                                  MD5:ED9C9EB0DCE17D752BEDEA6B5ACDA6D9
                                  SHA1:ECA56C4904354EED5DA0DEBCD6BD66856AB4784D
                                  SHA-256:F664B8138C2DA6EC7565500A7CC839DA6372614A31DC04C5A2169A26B8D9767C
                                  SHA-512:3BFB696318DDB93540140DBCD4DBB32F129441E46EE752C6B7379624488533BA27CC7EFF3CAE444C1797CA6EECDF333EDAF443AC84CDEB037A890967091CF91C
                                  Malicious:false
                                  Reputation:unknown
                                  Preview:.PNG........IHDR...l.................pHYs...........~.....IDATh..XMN.P..\.E......' ,.-.$'.H....s...1.vQ.......4.........-.<......{..|.?.w[4....A.=h<>.......7..t.u..]A{..&...,..h.`D4.01]......H.&..C.w...@....*..a..3..H.aR.=.g.(.0.6...;Wl...X.X..G.Bf.....D4...K..p... ..hh.-b.R.Z....Z..zYQc}....u^..R.Dzm$..%c".....C.*z.\&U9P..0.3s*..31..@...W..2....yG.....c)k.F....3.I!....2..F.....`%1.....-..U.s(.p..S.($/...}(.5.\"k.+.I.Q...cb....kt..o.`.........%L....;.J.[..b.xx)c,X7.....)..'.n..H=E<.B.].g.}f.o...........znJ.....Q$....7...#.&..g.D..X....F..~=...%IQ.........e.....>.R..............s..[.D|l.n&..a06..d.5.5YGC..3N......<..Pt..\<{b...i.....)!.....8...0.t_.....8..T.......)G.-mzK....../..TDK..k..s"ch.0....i..`...`V..H.Q"...x......!.."..Q..%3O.L.....$....e.s.m..||.......AD."...#.%b,'..r!.}c...X!2kCD6..iX.\@S..3Er....B...D...%.O...(._...-....{b......z........r.N..W2....L.1~-.J.?.l....?..q:..W.5&.....|..>.B...G.oa.S.....1......Zo...q.....

                                  Static File Info

                                  General

                                  File type:RFC 822 mail, ASCII text, with very long lines (1212), with CRLF line terminators
                                  Entropy (8bit):6.005638119372826
                                  TrID:
                                  • E-Mail message (Var. 5) (54515/1) 100.00%
                                  File name:Carisls Open Benefits Enrollment.eml
                                  File size:26'939 bytes
                                  MD5:dbf3e2ed873185d513036f7fcbbdc933
                                  SHA1:36134b58454c84fe84d8e2c6cdf60cd19dbb0635
                                  SHA256:f3be6b9abba308413efb844f941bf10ebb3887e6982f544b5dd421bd9005c6d8
                                  SHA512:a1c109c121f979647a3d2b0f7f2532697251efd8cd01c5e1058d3cfca098665891e41c252119d9b548e75203f4f7793c10d0975d2a5ad554ed2c0152fda68a3c
                                  SSDEEP:768:+6vqd9YIp/ipTS2eb3v0JKUQb3v0JKU5b3v0JKUxb3v0JKU7:+ihIp6pTS2eb3v0J0b3v0JFb3v0Jdb3g
                                  TLSH:BEC20863DF0F2C901F6289DD38CCBBCA1B2D179DE99391B5395ED198078E0A1A2C31D8
                                  File Content Preview:Received: from CY8PR14MB6924.namprd14.prod.outlook.com (2603:10b6:930:7f::15).. by PH8PR14MB7059.namprd14.prod.outlook.com with HTTPS; Wednesday/December/2024 06:50 AM.. 17:57:46 +0000..Received: from CH0PR03CA0074.namprd03.prod.outlook.com (2603:10b6:610

                                  Static Mail

                                  General

                                  Subject:Open Benefit eligible for dspetzler on 11/12/24
                                  From:Carisls <Carisls@carisls.com>
                                  To:dspetzler@carisls.com
                                  Cc:
                                  BCC:
                                  Date:Wednesday-December-2024 06:50 AM
                                  Communications:
                                  • [cid:image001.png@01D9AD87.FE3310D0] IT Operations Manager
                                  Attachments:
                                  • Carisls Eligible Finance Insurance Benefits Open Enrollment Plan.shtml
                                  • Carisls Health Insurance Benefits Open Enrollment Plan.shtml
                                  • Carisls Life Insurance Benefits Open Enrollment Plan.shtml

                                  Headers

                                  Key Value
                                  Receivedfrom d218-3.smtp-out.eu-west-2.amazonses.com (23.249.218.3) by CH2PEPF0000013D.mail.protection.outlook.com (10.167.244.69) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.7784.11 via Frontend Transport; Wednesday/December/2024 06:50 AM 17:55:16 +0000
                                  Authentication-Resultsspf=pass (sender IP is 23.249.218.3) smtp.mailfrom=eu-west-2.amazonses.com; dkim=pass (signature was verified) header.d=victorianvillagelies.com;dmarc=bestguesspass action=none header.from=victorianvillagelies.com;compauth=pass reason=109
                                  Received-SPFPass (protection.outlook.com: domain of eu-west-2.amazonses.com designates 23.249.218.3 as permitted sender) receiver=protection.outlook.com; client-ip=23.249.218.3; helo=d218-3.smtp-out.eu-west-2.amazonses.com; pr=C
                                  DKIM-Signaturev=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=pgxy5mtxzx6eoyytua4nvvg26jbuf6lj; d=amazonses.com; t=1721238915; h=From:Subject:To:Content-Type:MIME-Version:Date:Message-Id:Feedback-ID; bh=R2OKRECKJLQzuZ4HM8MfNeonxyHTYFh5CFXDSi1KLAo=; b=M/jp28uce8YV8Hy8+u2yKeN1SCTEU636npPO7F4H8LQ8V+P2uuOY+bFqNhXRkyRP RR9mCglBASBmhaPhys7KfKLCYeBDm+aig0PO0i8yWJVAs31wrBWyz85CKbtU21z4dYu e7d6iQoxbA/GisOBsRkccrsEVfJ4JqV/+iqK3ozo=
                                  FromCarisls <Carisls@carisls.com>
                                  SubjectOpen Benefit eligible for dspetzler on 11/12/24
                                  Todspetzler@carisls.com
                                  X-MS-Has-Attachyes
                                  X-MS-Exchange-Organization-SCL1
                                  X-MS-TNEF-Correlator
                                  X-MS-Exchange-Organization-RecordReviewCfmType0
                                  DateWednesday-December-2024 06:50 AM
                                  Message-ID<010b0190c1d5882a-e7c982f4-43a6-4765-b6d0-5f2257217ddd-000000@eu-west-2.amazonses.com>
                                  Feedback-ID::1.eu-west-2.uQHn1aDxFPJetz452TvKPhpeW9UF0L3iW3vcPpMjX3k=:AmazonSES
                                  X-SES-Outgoing2024.07.17-23.249.218.3
                                  Return-Path010b0190c1d5882a-e7c982f4-43a6-4765-b6d0-5f2257217ddd-000000@eu-west-2.amazonses.com
                                  X-MS-Exchange-Organization-ExpirationStartTime(UTC)
                                  X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                                  X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                                  X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                                  X-MS-Exchange-Organization-Network-Message-Ida19fa367-e956-4079-164e-08dca6899de3
                                  X-EOPAttributedMessage0
                                  X-EOPTenantAttributedMessage57d83755-4267-426c-83d0-dda81f4d4391:0
                                  X-MS-Exchange-Organization-MessageDirectionalityIncoming
                                  X-MS-PublicTrafficTypeEmail
                                  X-MS-TrafficTypeDiagnosticCH2PEPF0000013D:EE_|CY8PR14MB6924:EE_|PH8PR14MB7059:EE_
                                  X-MS-Exchange-Organization-AuthSourceCH2PEPF0000013D.namprd02.prod.outlook.com
                                  X-MS-Exchange-Organization-AuthAsAnonymous
                                  X-MS-Office365-Filtering-Correlation-Ida19fa367-e956-4079-164e-08dca6899de3
                                  X-MS-Exchange-AtpMessagePropertiesSA|SL
                                  X-Microsoft-AntispamBCL:0;ARA:13230040|1032899013|32142699015|4123199012|5073199012|5063199012|4073199012|69100299015
                                  X-Forefront-Antispam-ReportCIP:23.249.218.3;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:d218-3.smtp-out.eu-west-2.amazonses.com;PTR:d218-3.smtp-out.eu-west-2.amazonses.com;CAT:NONE;SFS:(13230040)(1032899013)(32142699015)(4123199012)(5073199012)(5063199012)(4073199012)(69100299015);DIR:INB
                                  X-MS-Exchange-CrossTenant-OriginalArrivalTime17 Jul 2024 17:55:16.2840 (UTC)
                                  X-MS-Exchange-CrossTenant-Network-Message-Ida19fa367-e956-4079-164e-08dca6899de3
                                  X-MS-Exchange-CrossTenant-Id57d83755-4267-426c-83d0-dda81f4d4391
                                  X-MS-Exchange-CrossTenant-AuthSourceCH2PEPF0000013D.namprd02.prod.outlook.com
                                  X-MS-Exchange-CrossTenant-AuthAsAnonymous
                                  X-MS-Exchange-CrossTenant-FromEntityHeaderInternet
                                  X-MS-Exchange-Transport-CrossTenantHeadersStampedCY8PR14MB6924
                                  X-MS-Exchange-Transport-EndToEndLatency00:02:29.8357502
                                  X-MS-Exchange-Processed-By-BccFoldering15.20.7762.024
                                  X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198)
                                  X-Microsoft-Antispam-Message-Info5X9i/D7Fye23FpuI8btmuQM2T21GGHUfY+7zhQO8K+pIDzRBMHX0pXYcqR1ceIPdzmvud9u+0A7WNawUU5aZ1ahPBiCB5WA0T8VPK4B/xt4kdvTLiQ/lWYG3xc9ZdOFSnU3LcUlpH5dmGYt//ofGMzbZnNKgAWNILPeLLQjuhpZRGu594RG6O3hWJMlILQsvsaVLoc1VU3x8mKAyNjt9p+gvY6Zq4aDIu49jegtedrltYjbeVtI+eZXx9z4Rp3bJQ7NkmeC/8uzngjyp92nek52ECa+ecDe3UG5lw5Hi+C4/2OMteEZYcbdAkyhmHsfmtuCZFmG4kYmMvgnHfxQSVjVg1loX8pPCbrJuMCdg6fTzXZ8kUZaV6tSXhUqFBWsoWP9Q4Z9IZAd0idSLFBnocenx9gtW9OUEDyGECzlQLxng1SUZml/jVN9yUPB0YGMRYgdX2E3waz3Z43CJJbkI8fAsABoRmrXPwvwnSCr3K1p3VCpdQvSJkyYsjctn9uUP+aey5iLeI5dxeeg6xO/wPbJDmY+LA+zMlbHOOj1j0V9GkeoiWscbL/p0x7101wvQywg3IHvABZxz5XRWOTrn8G1Uv1mnJMnOXTbb3lEzHdIF8WGgtlIuWZGtSL7F8ovn64OMNbDt6FVpSms7ga1Ot9HfcgCH4P/uS5Jj3GVXyscLngJlXMfO8bSRDdyKsgiMuIPscgWef5wV5kgkXbhTQxmqoYvTwiye6uPN/zH1JnER2wKTqm4ebWR5/kAqS/ajZZ+2UxlZB/i/1W2T3I2Dh672tMpZtf3HsnV6sOLgj3z4oJt/qpYmFxTbQp36T/aUHkvQsE9Xh0Dj98FbfTj3wf6bkebgHI/O9lYe9wOjDu+KLgdg6sOZc0wn5PCLz1JAbugesYPg9cm1FA5wXQl4vOnH298N2gLzCp+LNNP3tE3GJsPD+6JzedqQ0QiXD3ItVufHd1tOu6pY2T3ZN6MAtaediUjvinHQ/1bRBktW/ksGzYpeyavaQyqCLzGVkXiFvGK/Kg3fOOguCAlRu/4qHpiOPdGYpdWIJ5chVKIICCChOSYaSiehE60dqhWPcfGo3RB5V0LwXc/HURVGjzPHuQSODdxI4JaPfWgmDWvbUm62st9jfVomooahF4k+0lf3lcDJcvCgNr/vSEss2X7yYhs6rfCPdrXOyI23jfkfaxKs4uvCfvoTaTVRsjYxSo6P/ewSojXqSmItlqDi2uDU1bKQW6p9rpzYdeF0mvZRr1Sc/3Qe7TVDnrPhSVnhvtgxb8sKEBFwVzDScnCRZIy8pR6VtKE8wVak3GUN8HSzNbKYXNgJDE2p0zLlkz/it5iC7zwwd/J/sIfb3v0OYQqsIyLjwW5E9TKtQfiIcis1cDBEjfscOoSqi5tcwCmnqHsnFO3zDvQ7/G0Lyi2imAfx2SsAlT3lPWEIhucGk1Q5FlX18ObTv7fg8kpgu/6tdplFbfpy3DE2hf4nBmSLP8DiV8N08PViMozoNCpy7LU0n1ex8zn+lZYZ2RGSSm4g2vqRlBc76Vh0lwLW5gxE6DlDPfTaMzdsJ5R1yPyPvQ+XGZXEY6lq7R8NYNY0Ga8t1gujE22lc7n0b+Ri9wjuhu3m1ZHNgKWBAuKz4oGR+bENcWtRgPrRxhbIZsAvg3Mehu/DedsUpyuQUEv0t5O9gRTQRoLcZDS2JYO2BmM/+4C9HDjE7c1g+Gc2Iic4+e+n78K4TcNevQ1uLq5Jjs3xB73t/YjLmsE1P0AqM921SJ8//lNnSHJJGpDtdLvCMLCym7/Qs79BzaAp5NJOduRycYmKYtsqc/CZZwGPzgtQG6BTOoNyMZx4x5dSGdRA+MzrAnzoSk173pdj9gjksGpXJFuxMXcWgaiytSeAY+nelOLW7RW2HePHZEpqY6PMGG/uh9igy/4yAxnUJMWuv1DvRyKHcvGC6eZfXGikrlUxuMGpSjAbIIHbwwWynZGW9jTNQZZlpn+hW6GgFL6ahb61gGSFC67nig8Sz4k0tXEpptj6FNzCvDpPqh1bjxq8iyKLdnceCXnj5aSCISRTnyMfQDeS+i72TANnIUcTIdPOW+lkIl4=
                                  MIME-Version1.0
                                  Content-Languageen-US
                                  Content-Typemultipart/mixed; boundary="_006_DM4PR16MB507115B45028E447E419310BA429ADM4PR16MB5071namp_"

                                  File Icon

                                  Icon Hash:46070c0a8e0c67d6