Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg

Overview

General Information

Sample name:FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg
Analysis ID:1582896
MD5:3788fd03f90a29667a904d0c8804c3e9
SHA1:3f68e64fde079fb557d0587e653389173d00a0e9
SHA256:46a6214104c2a01147a11817842530afd133b6ac23cee974b3badc8d434a2621
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected suspicious Javascript
AI detected suspicious URL
Connects to many different domains
HTML page contains hidden javascript code
HTML page contains string obfuscation
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 3612 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 7032 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A3A8C159-FE34-4C0A-B7BF-9FB236CB14A2" "FA09F39C-6FC0-4FCD-93DE-D0D9CFE6E23E" "3612" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 5884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com%3Futm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=760e9ef62ca68fd16395c6a5f168f46590e94f7e MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 5532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2020,i,6151704404722752872,3464288322973886892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6136 --field-trial-handle=2020,i,6151704404722752872,3464288322973886892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 3552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=91898966d6fe36791625c29dfd3935a7b6f970e2 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 4884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1992,i,6601905524306076401,15530034896921034523,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No yara matches
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 3612, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

Phishing

barindex
Source: 0.44.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://www.google.com/recaptcha/api2/anchor?ar=1&... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code. While the script may have a legitimate purpose, such as reCAPTCHA integration, the use of techniques like the `Function` constructor and encoded strings raises significant security concerns. Further investigation is warranted to determine the true nature and intent of this script.
Source: EmailJoe Sandbox AI: AI detected Brand spoofing attempt in URL: https://clicktime.cloud.postoffice.net
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: Base64 decoded: https://www.jacquielawson.com:443
Source: https://ak.jacquielawson.com/js/ga_helper.jsHTTP Parser: Found new string: script /* Basic page tracking using google analytics... Meant as a replacement for the legacy omniture tracking system... Legacy javascript calls would be of the form omniture.swap_vars_and_ping(vars),. where vars would be a hash of data to be tracked... The most common data being tracked would be page name... For more info on google analytics tracking see the following:. http://code.google.com/apis/analytics/docs/tracking/asyncUsageGuide.html.*/..var googleAnalytics={};..// Fire off a tracking ping to google analytics. Only for ga.js..googleAnalytics.trackPageview = function(page) {.. if(page) {. ga('send', 'pageview', page);. } else {. ga('send', 'pageview');. }..};..// Retrieve the page name for tracking if availible..googleAnalytics.getPageName = function(vars) {. var page_name = '';.. for (var label in vars) {. if (label.indexOf('pageName') != -1) {. page_name = vars[label];. break;. }. }.. return page_name;.};..// Track ...
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: <input type="password" .../> found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: <input type="password" .../> found
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=91898966d6fe36791625c29dfd3935a7b6f970e2HTTP Parser: No favicon
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No favicon
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="author".. found
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="author".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="author".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="author".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="author".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="author".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="author".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="author".. found
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="copyright".. found
Source: https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="copyright".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="copyright".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="copyright".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="copyright".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="copyright".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="copyright".. found
Source: https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentHTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:50041 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 29MB
Source: unknownNetwork traffic detected: DNS query count 39
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: clicktime.cloud.postoffice.net
Source: global trafficDNS traffic detected: DNS query: www.jacquielawson.com
Source: global trafficDNS traffic detected: DNS query: ak.jacquielawson.com
Source: global trafficDNS traffic detected: DNS query: images.contentstack.io
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: tags.tiqcdn.com
Source: global trafficDNS traffic detected: DNS query: ak.imgag.com
Source: global trafficDNS traffic detected: DNS query: collect.tealiumiq.com
Source: global trafficDNS traffic detected: DNS query: d38xvr37kwwhcm.cloudfront.net
Source: global trafficDNS traffic detected: DNS query: connect.facebook.net
Source: global trafficDNS traffic detected: DNS query: ad.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: s.yimg.com
Source: global trafficDNS traffic detected: DNS query: cnstrc.com
Source: global trafficDNS traffic detected: DNS query: cdn.quantummetric.com
Source: global trafficDNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: www.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: 8724108.fls.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: td.doubleclick.net
Source: global trafficDNS traffic detected: DNS query: adservice.google.com
Source: global trafficDNS traffic detected: DNS query: sp.analytics.yahoo.com
Source: global trafficDNS traffic detected: DNS query: analytics.tiktok.com
Source: global trafficDNS traffic detected: DNS query: www.facebook.com
Source: global trafficDNS traffic detected: DNS query: ingest.quantummetric.com
Source: global trafficDNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global trafficDNS traffic detected: DNS query: cloud.postoffice.net
Source: global trafficDNS traffic detected: DNS query: api.filepicker.io
Source: global trafficDNS traffic detected: DNS query: cdn.dynamicyield.com
Source: global trafficDNS traffic detected: DNS query: st.dynamicyield.com
Source: global trafficDNS traffic detected: DNS query: rcom.dynamicyield.com
Source: global trafficDNS traffic detected: DNS query: async-px.dynamicyield.com
Source: global trafficDNS traffic detected: DNS query: dialog.filepicker.io
Source: global trafficDNS traffic detected: DNS query: www.filepicker.io
Source: global trafficDNS traffic detected: DNS query: players.brightcove.net
Source: global trafficDNS traffic detected: DNS query: edge.api.brightcove.com
Source: global trafficDNS traffic detected: DNS query: metrics.brightcove.com
Source: global trafficDNS traffic detected: DNS query: house-fastly-signed-us-east-1-prod.brightcovecdn.com
Source: global trafficDNS traffic detected: DNS query: manifest.prod.boltdns.net
Source: global trafficDNS traffic detected: DNS query: cf-images.us-east-1.prod.boltdns.net
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49865
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49983
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
Source: unknownNetwork traffic detected: HTTP traffic on port 49932 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49898 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50131 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50211 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50234 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50257 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
Source: unknownNetwork traffic detected: HTTP traffic on port 50039 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50314 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49970
Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50074 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50325 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50107 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50268 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50292 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49969
Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49968
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
Source: unknownNetwork traffic detected: HTTP traffic on port 50120 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50189 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50246 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50130 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50108 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50291 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50073 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49933 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50303 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50269 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 50326 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
Source: unknownNetwork traffic detected: HTTP traffic on port 50119 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
Source: unknownNetwork traffic detected: HTTP traffic on port 50280 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50142 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50051 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50153 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49949
Source: unknownNetwork traffic detected: HTTP traffic on port 50210 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50235 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49948
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49945 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49968 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50221 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50324 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50026 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50293 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50301 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50270 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49898
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
Source: unknownNetwork traffic detected: HTTP traffic on port 50144 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50335 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49891
Source: unknownNetwork traffic detected: HTTP traffic on port 50282 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50247 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50095 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50155 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50258 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
Source: unknownNetwork traffic detected: HTTP traffic on port 50336 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
Source: unknownNetwork traffic detected: HTTP traffic on port 50313 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50166 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50281 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
Source: unknownNetwork traffic detected: HTTP traffic on port 50143 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50110 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50259 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50236 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49998
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
Source: unknownNetwork traffic detected: HTTP traffic on port 50121 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
Source: unknownNetwork traffic detected: HTTP traffic on port 49923 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50220 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50109 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50072 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50132 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49934 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50302 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50199 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50216
Source: unknownNetwork traffic detected: HTTP traffic on port 50277 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50215
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50336
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50218
Source: unknownNetwork traffic detected: HTTP traffic on port 50254 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50217
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50219
Source: unknownNetwork traffic detected: HTTP traffic on port 50139 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50151 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50116 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50210
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50331
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50212
Source: unknownNetwork traffic detected: HTTP traffic on port 50225 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50333
Source: unknownNetwork traffic detected: HTTP traffic on port 50059 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50202 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50211
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50332
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50214
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50335
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50213
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50334
Source: unknownNetwork traffic detected: HTTP traffic on port 50305 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50328 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50227
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50105
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50226
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50108
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50229
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50107
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50228
Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50060 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50109
Source: unknownNetwork traffic detected: HTTP traffic on port 49929 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50186 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50221
Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50220
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50102
Source: unknownNetwork traffic detected: HTTP traffic on port 50243 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50104
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50225
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50103
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50224
Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50289 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50128 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50162 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50197 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50117
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50238
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50116
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50119
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50118
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50239
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50230
Source: unknownNetwork traffic detected: HTTP traffic on port 50317 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50111
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50232
Source: unknownNetwork traffic detected: HTTP traffic on port 49930 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50110
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50231
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50234
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50112
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50233
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50115
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50236
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50114
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50235
Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49963 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50288 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50127 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50198 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50213 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50232 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50128
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50249
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50006
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50127
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50248
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50129
Source: unknownNetwork traffic detected: HTTP traffic on port 50255 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50120
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50241
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50240
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50122
Source: unknownNetwork traffic detected: HTTP traffic on port 50150 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50243
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50121
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50242
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50124
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50245
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50123
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50126
Source: unknownNetwork traffic detected: HTTP traffic on port 50224 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50247
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50125
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50246
Source: unknownNetwork traffic detected: HTTP traffic on port 50266 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50250
Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50306 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50105 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50164 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50315 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50129 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50267 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50304
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50303
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50306
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50305
Source: unknownNetwork traffic detected: HTTP traffic on port 50117 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50308
Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50307
Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50278 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50309
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50201 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50300
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50302
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50301
Source: unknownNetwork traffic detected: HTTP traffic on port 50046 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50141 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50304 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50212 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50233 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50315
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50314
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50317
Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50316
Source: unknownNetwork traffic detected: HTTP traffic on port 50256 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50319
Source: unknownNetwork traffic detected: HTTP traffic on port 50118 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50318
Source: unknownNetwork traffic detected: HTTP traffic on port 50279 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50311
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50310
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50313
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50312
Source: unknownNetwork traffic detected: HTTP traffic on port 49908 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50163 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50140 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50205
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50326
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50204
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50325
Source: unknownNetwork traffic detected: HTTP traffic on port 49998 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50207
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50328
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50196 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50206
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50327
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50329
Source: unknownNetwork traffic detected: HTTP traffic on port 50245 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50316 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50320
Source: unknownNetwork traffic detected: HTTP traffic on port 49931 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50058 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50201
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50322
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50321
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50203
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50324
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50202
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50323
Source: unknownNetwork traffic detected: HTTP traffic on port 50290 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50185 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50327 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49949 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50054
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50296
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50053
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50295
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50056
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50298
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50297
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50058
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50057
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50299
Source: unknownNetwork traffic detected: HTTP traffic on port 50319 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50059
Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50180
Source: unknownNetwork traffic detected: HTTP traffic on port 50263 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50286 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50060
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50181
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50063
Source: unknownNetwork traffic detected: HTTP traffic on port 50102 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50045 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50125 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50320 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49950 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50274 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50065
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50186
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50064
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50185
Source: unknownNetwork traffic detected: HTTP traffic on port 50056 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50331 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50189
Source: unknownNetwork traffic detected: HTTP traffic on port 50205 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50240 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50216 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50191
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50190
Source: unknownNetwork traffic detected: HTTP traffic on port 49915 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50072
Source: unknownNetwork traffic detected: HTTP traffic on port 50159 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50192
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50074
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50195
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50073
Source: unknownNetwork traffic detected: HTTP traffic on port 50308 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50204 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50227 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50252 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50195 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50275 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49972 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50147 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50197
Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50075
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50196
Source: unknownNetwork traffic detected: HTTP traffic on port 50057 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50078
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50199
Source: unknownNetwork traffic detected: HTTP traffic on port 50332 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50114 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50198
Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50297 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50087
Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50089
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50088
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50090
Source: unknownNetwork traffic detected: HTTP traffic on port 50241 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50136 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49983 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50095
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50139
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50138
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50259
Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49974 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50149 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50032 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50131
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50252
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50130
Source: unknownNetwork traffic detected: HTTP traffic on port 49916 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50133
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50254
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50132
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50253
Source: unknownNetwork traffic detected: HTTP traffic on port 50090 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50135
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50256
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50134
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50255
Source: unknownNetwork traffic detected: HTTP traffic on port 50078 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50137
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50258
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50136
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50257
Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50161 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50140
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50261
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50260
Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50215 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50230 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50029
Source: unknownNetwork traffic detected: HTTP traffic on port 50253 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50149
Source: unknownNetwork traffic detected: HTTP traffic on port 50299 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50021
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50142
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50263
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50141
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50262
Source: unknownNetwork traffic detected: HTTP traffic on port 50318 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50144
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50265
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50143
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50264
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50146
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50267
Source: unknownNetwork traffic detected: HTTP traffic on port 50226 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50266
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50269
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50026
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50147
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50268
Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50264 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50270
Source: unknownNetwork traffic detected: HTTP traffic on port 50021 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50151
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50272
Source: unknownNetwork traffic detected: HTTP traffic on port 50138 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50150
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50271
Source: unknownNetwork traffic detected: HTTP traffic on port 50103 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50329 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50039
Source: unknownNetwork traffic detected: HTTP traffic on port 50298 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50011 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50032
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50153
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50274
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50273
Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:50041 version: TLS 1.2
Source: classification engineClassification label: mal48.winMSG@31/32@158/671
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241231T1328290372-3612.etl
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A3A8C159-FE34-4C0A-B7BF-9FB236CB14A2" "FA09F39C-6FC0-4FCD-93DE-D0D9CFE6E23E" "3612" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A3A8C159-FE34-4C0A-B7BF-9FB236CB14A2" "FA09F39C-6FC0-4FCD-93DE-D0D9CFE6E23E" "3612" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com%3Futm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=760e9ef62ca68fd16395c6a5f168f46590e94f7e
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2020,i,6151704404722752872,3464288322973886892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com%3Futm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=760e9ef62ca68fd16395c6a5f168f46590e94f7e
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2020,i,6151704404722752872,3464288322973886892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=91898966d6fe36791625c29dfd3935a7b6f970e2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1992,i,6601905524306076401,15530034896921034523,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6136 --field-trial-handle=2020,i,6151704404722752872,3464288322973886892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=91898966d6fe36791625c29dfd3935a7b6f970e2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1992,i,6601905524306076401,15530034896921034523,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6136 --field-trial-handle=2020,i,6151704404722752872,3464288322973886892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation2
Browser Extensions
1
Process Injection
1
Masquerading
OS Credential Dumping1
Process Discovery
Remote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading
1
DLL Side-Loading
1
Process Injection
LSASS Memory13
System Information Discovery
Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder
1
Registry Run Keys / Startup Folder
1
DLL Side-Loading
Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Extra Window Memory Injection
1
Extra Window Memory Injection
NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
dart.l.doubleclick.net
172.217.23.102
truefalse
    high
    cloud.postoffice.net
    165.212.65.209
    truefalse
      high
      d22rbd88eku03j.cloudfront.net
      18.245.86.58
      truefalse
        unknown
        cdn.quantummetric.com
        104.18.11.213
        truefalse
          high
          cnstrc.com
          99.86.4.29
          truefalse
            high
            adservice.google.com
            142.250.184.194
            truefalse
              high
              spdc-global.pbp.gysm.yahoodns.net
              54.246.144.89
              truefalse
                high
                async-px.dynamicyield.com
                13.35.58.109
                truefalse
                  high
                  scontent.xx.fbcdn.net
                  157.240.251.9
                  truefalse
                    high
                    ingest.quantummetric.com
                    35.224.156.207
                    truefalse
                      high
                      collect.tealiumiq.com
                      52.59.81.109
                      truefalse
                        high
                        cdnjs.cloudflare.com
                        104.17.25.14
                        truefalse
                          high
                          www.google.com
                          142.250.184.228
                          truefalse
                            high
                            star-mini.c10r.facebook.com
                            157.240.253.35
                            truefalse
                              high
                              ad.doubleclick.net
                              142.250.185.102
                              truefalse
                                high
                                maxcdn.bootstrapcdn.com
                                104.18.10.207
                                truefalse
                                  high
                                  d2uyh1ncuzni57.cloudfront.net
                                  18.244.18.27
                                  truefalse
                                    unknown
                                    metrics.brightcove.com
                                    35.244.232.184
                                    truefalse
                                      high
                                      dh29jf0q5erm3.cloudfront.net
                                      3.160.150.127
                                      truefalse
                                        unknown
                                        ax-0001.ax-msedge.net
                                        150.171.27.10
                                        truefalse
                                          high
                                          d38xvr37kwwhcm.cloudfront.net
                                          18.66.107.172
                                          truefalse
                                            high
                                            brightcove.map.fastly.net
                                            151.101.194.27
                                            truefalse
                                              unknown
                                              d1nna0ec3lv40t.cloudfront.net
                                              18.66.122.78
                                              truefalse
                                                unknown
                                                googleads.g.doubleclick.net
                                                142.250.185.162
                                                truefalse
                                                  high
                                                  www.cloudflare.com
                                                  104.16.123.96
                                                  truefalse
                                                    high
                                                    dualstack.us-eu.brightcove.map.fastly.net
                                                    199.232.194.27
                                                    truefalse
                                                      unknown
                                                      clicktime.cloud.postoffice.net
                                                      165.212.65.140
                                                      truefalse
                                                        high
                                                        dualstack.brightcove.map.fastly.net
                                                        151.101.2.27
                                                        truefalse
                                                          unknown
                                                          td.doubleclick.net
                                                          142.250.185.194
                                                          truefalse
                                                            high
                                                            edge.gycpi.b.yahoodns.net
                                                            87.248.119.252
                                                            truefalse
                                                              high
                                                              dzfq4ouujrxm8.cloudfront.net
                                                              13.33.187.58
                                                              truefalse
                                                                high
                                                                sp.analytics.yahoo.com
                                                                unknown
                                                                unknownfalse
                                                                  high
                                                                  dialog.filepicker.io
                                                                  unknown
                                                                  unknownfalse
                                                                    unknown
                                                                    edge.api.brightcove.com
                                                                    unknown
                                                                    unknownfalse
                                                                      high
                                                                      manifest.prod.boltdns.net
                                                                      unknown
                                                                      unknownfalse
                                                                        high
                                                                        api.filepicker.io
                                                                        unknown
                                                                        unknownfalse
                                                                          high
                                                                          ak.imgag.com
                                                                          unknown
                                                                          unknownfalse
                                                                            high
                                                                            www.jacquielawson.com
                                                                            unknown
                                                                            unknownfalse
                                                                              unknown
                                                                              cdn.dynamicyield.com
                                                                              unknown
                                                                              unknownfalse
                                                                                high
                                                                                rcom.dynamicyield.com
                                                                                unknown
                                                                                unknownfalse
                                                                                  high
                                                                                  www.facebook.com
                                                                                  unknown
                                                                                  unknownfalse
                                                                                    high
                                                                                    st.dynamicyield.com
                                                                                    unknown
                                                                                    unknownfalse
                                                                                      high
                                                                                      www.filepicker.io
                                                                                      unknown
                                                                                      unknownfalse
                                                                                        unknown
                                                                                        images.contentstack.io
                                                                                        unknown
                                                                                        unknownfalse
                                                                                          high
                                                                                          cf-images.us-east-1.prod.boltdns.net
                                                                                          unknown
                                                                                          unknownfalse
                                                                                            high
                                                                                            connect.facebook.net
                                                                                            unknown
                                                                                            unknownfalse
                                                                                              high
                                                                                              players.brightcove.net
                                                                                              unknown
                                                                                              unknownfalse
                                                                                                high
                                                                                                8724108.fls.doubleclick.net
                                                                                                unknown
                                                                                                unknownfalse
                                                                                                  unknown
                                                                                                  ak.jacquielawson.com
                                                                                                  unknown
                                                                                                  unknownfalse
                                                                                                    unknown
                                                                                                    s.yimg.com
                                                                                                    unknown
                                                                                                    unknownfalse
                                                                                                      high
                                                                                                      house-fastly-signed-us-east-1-prod.brightcovecdn.com
                                                                                                      unknown
                                                                                                      unknownfalse
                                                                                                        unknown
                                                                                                        analytics.tiktok.com
                                                                                                        unknown
                                                                                                        unknownfalse
                                                                                                          high
                                                                                                          tags.tiqcdn.com
                                                                                                          unknown
                                                                                                          unknownfalse
                                                                                                            high
                                                                                                            NameMaliciousAntivirus DetectionReputation
                                                                                                            https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=91898966d6fe36791625c29dfd3935a7b6f970e2false
                                                                                                              unknown
                                                                                                              https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0?source=jl999&utm_medium=pickup&utm_source=email&utm_campaign=receivercontentfalse
                                                                                                                unknown
                                                                                                                https://www.jacquielawson.com/?utm_medium=pickup&utm_source=email&utm_campaign=receivercontentfalse
                                                                                                                  unknown
                                                                                                                  • No. of IPs < 25%
                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                  • 75% < No. of IPs
                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                  172.217.16.136
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  2.18.64.26
                                                                                                                  unknownEuropean Union
                                                                                                                  6057AdministracionNacionaldeTelecomunicacionesUYfalse
                                                                                                                  216.58.212.142
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  151.101.194.27
                                                                                                                  brightcove.map.fastly.netUnited States
                                                                                                                  54113FASTLYUSfalse
                                                                                                                  3.160.150.127
                                                                                                                  dh29jf0q5erm3.cloudfront.netUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  13.33.187.58
                                                                                                                  dzfq4ouujrxm8.cloudfront.netUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  151.101.2.27
                                                                                                                  dualstack.brightcove.map.fastly.netUnited States
                                                                                                                  54113FASTLYUSfalse
                                                                                                                  142.250.185.102
                                                                                                                  ad.doubleclick.netUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  20.189.173.1
                                                                                                                  unknownUnited States
                                                                                                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                  34.121.127.184
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  142.250.185.227
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  2.18.64.21
                                                                                                                  unknownEuropean Union
                                                                                                                  6057AdministracionNacionaldeTelecomunicacionesUYfalse
                                                                                                                  13.35.58.109
                                                                                                                  async-px.dynamicyield.comUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  199.232.194.27
                                                                                                                  dualstack.us-eu.brightcove.map.fastly.netUnited States
                                                                                                                  54113FASTLYUSfalse
                                                                                                                  52.111.243.40
                                                                                                                  unknownUnited States
                                                                                                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                  142.250.184.226
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  142.250.186.110
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  184.28.89.92
                                                                                                                  unknownUnited States
                                                                                                                  16625AKAMAI-ASUSfalse
                                                                                                                  142.250.184.228
                                                                                                                  www.google.comUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  104.16.124.96
                                                                                                                  unknownUnited States
                                                                                                                  13335CLOUDFLARENETUSfalse
                                                                                                                  142.250.185.66
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  142.250.185.68
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  1.1.1.1
                                                                                                                  unknownAustralia
                                                                                                                  13335CLOUDFLARENETUSfalse
                                                                                                                  142.250.186.38
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  142.250.184.194
                                                                                                                  adservice.google.comUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  142.250.185.234
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  142.250.185.232
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  239.255.255.250
                                                                                                                  unknownReserved
                                                                                                                  unknownunknownfalse
                                                                                                                  52.109.28.47
                                                                                                                  unknownUnited States
                                                                                                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                  172.217.23.102
                                                                                                                  dart.l.doubleclick.netUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  142.250.185.194
                                                                                                                  td.doubleclick.netUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  54.246.144.89
                                                                                                                  spdc-global.pbp.gysm.yahoodns.netUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  157.240.253.35
                                                                                                                  star-mini.c10r.facebook.comUnited States
                                                                                                                  32934FACEBOOKUSfalse
                                                                                                                  18.66.107.68
                                                                                                                  unknownUnited States
                                                                                                                  3MIT-GATEWAYSUSfalse
                                                                                                                  34.57.181.87
                                                                                                                  unknownUnited States
                                                                                                                  2686ATGS-MMD-ASUSfalse
                                                                                                                  18.245.86.58
                                                                                                                  d22rbd88eku03j.cloudfront.netUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  104.17.25.14
                                                                                                                  cdnjs.cloudflare.comUnited States
                                                                                                                  13335CLOUDFLARENETUSfalse
                                                                                                                  18.66.122.43
                                                                                                                  unknownUnited States
                                                                                                                  3MIT-GATEWAYSUSfalse
                                                                                                                  3.70.81.237
                                                                                                                  unknownUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  104.18.10.207
                                                                                                                  maxcdn.bootstrapcdn.comUnited States
                                                                                                                  13335CLOUDFLARENETUSfalse
                                                                                                                  142.250.186.170
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  142.250.186.174
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  35.244.232.184
                                                                                                                  metrics.brightcove.comUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  18.66.107.172
                                                                                                                  d38xvr37kwwhcm.cloudfront.netUnited States
                                                                                                                  3MIT-GATEWAYSUSfalse
                                                                                                                  18.244.18.27
                                                                                                                  d2uyh1ncuzni57.cloudfront.netUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  99.86.4.79
                                                                                                                  unknownUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  157.240.0.6
                                                                                                                  unknownUnited States
                                                                                                                  32934FACEBOOKUSfalse
                                                                                                                  216.58.206.35
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  165.212.65.140
                                                                                                                  clicktime.cloud.postoffice.netUnited States
                                                                                                                  14454PERIMETER-ESECURITYUSfalse
                                                                                                                  13.35.58.129
                                                                                                                  unknownUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  13.33.187.116
                                                                                                                  unknownUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  87.248.119.252
                                                                                                                  edge.gycpi.b.yahoodns.netUnited Kingdom
                                                                                                                  203220YAHOO-DEBDEfalse
                                                                                                                  99.86.4.29
                                                                                                                  cnstrc.comUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  142.250.185.163
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  52.59.81.109
                                                                                                                  collect.tealiumiq.comUnited States
                                                                                                                  16509AMAZON-02USfalse
                                                                                                                  150.171.28.10
                                                                                                                  unknownUnited States
                                                                                                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                  142.250.185.162
                                                                                                                  googleads.g.doubleclick.netUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  18.66.122.78
                                                                                                                  d1nna0ec3lv40t.cloudfront.netUnited States
                                                                                                                  3MIT-GATEWAYSUSfalse
                                                                                                                  151.101.194.137
                                                                                                                  unknownUnited States
                                                                                                                  54113FASTLYUSfalse
                                                                                                                  104.18.11.213
                                                                                                                  cdn.quantummetric.comUnited States
                                                                                                                  13335CLOUDFLARENETUSfalse
                                                                                                                  142.250.184.202
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  52.113.194.132
                                                                                                                  unknownUnited States
                                                                                                                  8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                  165.212.65.209
                                                                                                                  cloud.postoffice.netUnited States
                                                                                                                  14454PERIMETER-ESECURITYUSfalse
                                                                                                                  142.250.186.162
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  104.18.10.213
                                                                                                                  unknownUnited States
                                                                                                                  13335CLOUDFLARENETUSfalse
                                                                                                                  216.58.206.67
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  150.171.27.10
                                                                                                                  ax-0001.ax-msedge.netUnited States
                                                                                                                  8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                  157.240.251.9
                                                                                                                  scontent.xx.fbcdn.netUnited States
                                                                                                                  32934FACEBOOKUSfalse
                                                                                                                  151.101.2.137
                                                                                                                  unknownUnited States
                                                                                                                  54113FASTLYUSfalse
                                                                                                                  104.18.11.207
                                                                                                                  unknownUnited States
                                                                                                                  13335CLOUDFLARENETUSfalse
                                                                                                                  2.16.168.119
                                                                                                                  unknownEuropean Union
                                                                                                                  20940AKAMAI-ASN1EUfalse
                                                                                                                  142.250.181.227
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  151.101.2.133
                                                                                                                  unknownUnited States
                                                                                                                  54113FASTLYUSfalse
                                                                                                                  142.250.185.174
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  64.233.184.84
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  184.28.90.27
                                                                                                                  unknownUnited States
                                                                                                                  16625AKAMAI-ASUSfalse
                                                                                                                  34.72.171.43
                                                                                                                  unknownUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  35.224.156.207
                                                                                                                  ingest.quantummetric.comUnited States
                                                                                                                  15169GOOGLEUSfalse
                                                                                                                  157.240.251.35
                                                                                                                  unknownUnited States
                                                                                                                  32934FACEBOOKUSfalse
                                                                                                                  104.16.123.96
                                                                                                                  www.cloudflare.comUnited States
                                                                                                                  13335CLOUDFLARENETUSfalse
                                                                                                                  104.102.34.241
                                                                                                                  unknownUnited States
                                                                                                                  16625AKAMAI-ASUSfalse
                                                                                                                  IP
                                                                                                                  192.168.2.16
                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                  Analysis ID:1582896
                                                                                                                  Start date and time:2024-12-31 19:28:02 +01:00
                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                  Overall analysis duration:
                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                  Report type:full
                                                                                                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                  Number of analysed new started processes analysed:21
                                                                                                                  Number of new started drivers analysed:0
                                                                                                                  Number of existing processes analysed:0
                                                                                                                  Number of existing drivers analysed:0
                                                                                                                  Number of injected processes analysed:0
                                                                                                                  Technologies:
                                                                                                                  • EGA enabled
                                                                                                                  Analysis Mode:stream
                                                                                                                  Analysis stop reason:Timeout
                                                                                                                  Sample name:FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg
                                                                                                                  Detection:MAL
                                                                                                                  Classification:mal48.winMSG@31/32@158/671
                                                                                                                  Cookbook Comments:
                                                                                                                  • Found application associated with file extension: .msg
                                                                                                                  • Exclude process from analysis (whitelisted): dllhost.exe
                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.113.194.132, 184.28.90.27, 52.109.28.47, 2.16.168.119, 2.16.168.101
                                                                                                                  • Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, fs.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, uks-azsc-000.roaming.officeapps.live.com, s-0005.s-msedge.net, e16604.g.akamaiedge.net, ecs.office.trafficmanager.net, prod.fs.microsoft.com.akadns.net, omex.cdn.office.net.akamaized.net, a1864.dscd.akamai.net
                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                  • VT rate limit hit for: FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):231348
                                                                                                                  Entropy (8bit):4.3906465257604035
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:8D98B6AB5A7CFE270A5F84FB9A3A10C1
                                                                                                                  SHA1:2DA4F59DDEB360D491F0B3C4FFB46EAEB4D77672
                                                                                                                  SHA-256:6E771FEF3149F28E36A62538F742EA97C4624A504550B08BEE629CD392681913
                                                                                                                  SHA-512:3A6847AF2785C35574CD73BAFE30C7441B95EA9406E784463D68FE3E23320F55C556477D40CD6AA7E7521433713AFE6A900DF545480F84BB1E360EF92B934765
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:TH02...... ..el..[......SM01X...,.....^..[..........IPM.Activity...........h...............h............H..h4..............h........H...H..h\cal ...pDat...h.E..0..........h#............h........_`Pk...h..@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h@I[...........#h....8.........$hH.......8....."h.............'h..............1h#.<.........0h....4....Uk../h....h.....UkH..h.g..p...4.....-h ............+h......(................... ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1869
                                                                                                                  Entropy (8bit):5.087185003438556
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:2ACAEF36811B25BFB6387DFD80AF676D
                                                                                                                  SHA1:828951FAE96AC64195882149A8FFAE364A43EFC9
                                                                                                                  SHA-256:4FADD1CF7ED277FA4D07C7FB9B98B0CC7831E922F82FC3F6EFD3BDFCB15B731A
                                                                                                                  SHA-512:C3FBF186C74ABC5F69283D105F493852AB4B5B750DC15C5B5295B3D695DC1C512428D6A1BF0C4EC35C32EFDAB06E0F425D1965D656C01D84FA8538824317E4F7
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-12-31T18:28:30Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-12-31T18:28:30Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:JSON data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):521377
                                                                                                                  Entropy (8bit):4.9084889265453135
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:C37972CBD8748E2CA6DA205839B16444
                                                                                                                  SHA1:9834B46ACF560146DD7EE9086DB6019FBAC13B4E
                                                                                                                  SHA-256:D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
                                                                                                                  SHA-512:02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):773040
                                                                                                                  Entropy (8bit):6.55939673749297
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:4296A064B917926682E7EED650D4A745
                                                                                                                  SHA1:3953A6AA9100F652A6CA533C2E05895E52343718
                                                                                                                  SHA-256:E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
                                                                                                                  SHA-512:A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:........... OS/29....(...`cmap.s.,.......pglyf..&....|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N......*...!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&........*......&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q...............*...{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...*p..
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):322260
                                                                                                                  Entropy (8bit):4.000299760592446
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:CC90D669144261B198DEAD45AA266572
                                                                                                                  SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                                                                                                                  SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                                                                                                                  SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                  Category:modified
                                                                                                                  Size (bytes):10
                                                                                                                  Entropy (8bit):2.7219280948873625
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:EDB8B28D33B8FB5B487E85EA8E6F8A61
                                                                                                                  SHA1:767FCF0D493BDBD89E788B9D761D598B4A60B3A0
                                                                                                                  SHA-256:3C81B364F44E516C446027DB382CEA99A59F6620FC94233B1F463635FEA25D7E
                                                                                                                  SHA-512:FB87D8F2E4BCA9B208D411D3E6374BC7E8FFE035560B21D2206F2618FF9DCF6E7AE85F3314D1860113767C31B9F2C0AC60819707E6A6C2A0633E3DC055D6B0D9
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:1735669712
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:SQLite Rollback Journal
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):4616
                                                                                                                  Entropy (8bit):0.1384465837476566
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:C5D5F257E5A9B0C0B23BC1966B3E7CC1
                                                                                                                  SHA1:0216E92144D06059356EB1503B3E1550968690E0
                                                                                                                  SHA-256:8488D96BE4002947D8E6F0DD6B5AB388AB19DA9F7F7E5FECD6402A46D5C87EAA
                                                                                                                  SHA-512:95787EBD4CA90C4B7E33F44493829CB5112C6FA5D74D347825BFDE70EAB256779ED539F1C1F9C1448F352F83E829C328005CD49E001C5AAB8EBF7427DC088D53
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.... .c.......P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................K.................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1860
                                                                                                                  Entropy (8bit):6.623899730306515
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:6D5AA0AF714319F04ABED5C1A94E29F1
                                                                                                                  SHA1:3D383727C84687FB097CB4E95C44CD8C1586A4E9
                                                                                                                  SHA-256:875CB6025FAD3912244185662A2A218BA2C65E151FEBF8033A1071D0B071085A
                                                                                                                  SHA-512:BEB1F11E47B053BC00904A7274EC746EFE58A1B1F39299CD15A24DFE79C7D0D228875415BE267F17721DCA78386A123353B21A1FB5DADD8958F991A4B53D732F
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR... ... .....szz.....pHYs..........+..... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)" xmp:CreateDate="2018-10-29T09:14:28+01:00" xmp:ModifyDate="2018-10-29T09:22:04+01:00" xmp:MetadataDate="2018-10-29T09:22:04+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:88ed77f4-832b-4105-96d1-9ef05b800c86" xmpMM:DocumentID="xmp.did:88ed77f4-832b-4105-96d1-9ef05b800c86" xmpMM:Ori
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1649
                                                                                                                  Entropy (8bit):6.249308989292645
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:B30466201F9D88ABB240D8B578F04815
                                                                                                                  SHA1:DF67E70631A480B4CE68AE5F51D36CBB2B484DAD
                                                                                                                  SHA-256:ACA415DF8EA41388963B66983E337C07B8503423AD611CDEF20B6FD017ED3E4A
                                                                                                                  SHA-512:267B628F171D4CABFA0EFB7E1677A86CCA5ECF70F5840ADCD51E1B856EE92C53B93A5F625EDEC34C2A4F36D0C2DA733F1319CB39EAAF5B9F896A371456C44371
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR... ... .....szz.....pHYs..........+..... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)" xmp:CreateDate="2018-10-29T09:14:28+01:00" xmp:ModifyDate="2018-10-29T09:21:59+01:00" xmp:MetadataDate="2018-10-29T09:21:59+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:1c4872f2-803d-4e4c-bb42-f8ea222a267a" xmpMM:DocumentID="xmp.did:1c4872f2-803d-4e4c-bb42-f8ea222a267a" xmpMM:Ori
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:PNG image data, 266 x 220, 8-bit/color RGBA, non-interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):10625
                                                                                                                  Entropy (8bit):7.949609233378373
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:B226D214AFF5D3B147AEA44B19EB45D8
                                                                                                                  SHA1:6C3A5445606BD03E52022CE846A57BDE8D4CCF48
                                                                                                                  SHA-256:E51A8086594B4090E19423F4C85A6E356AC2474C55658DA405875F7D05A911E2
                                                                                                                  SHA-512:AA5069AE4CDFF90DC97086539377598392C70C5EEAF4DC3F40799922D67397E7E441C628CE99631AD9294D24BC93EE14F67785120AA6AD09C41FFD34000DBD94
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR................O....sRGB.........gAMA......a.....pHYs..!...!........).IDATx^...dE}..A|.]..E......`.W$~6..0..=.#..6.Qa.....W.1..D......k.."K.?bdY..`Ye...y....v...w.=u....._.:}....|..{N.._U}NUMwO..<..r...a...c^H...g.io;z....i.Q.w.v".F.ut..........ct.!......V.6.n...f.'.N-..I..:Apr.Z....C............=..aA._....E.1...Ct9.]./...m#.......d.Zhr.J[.z..Bx.......l.....PQ..RU.z..x....P.@.....C#{...I.F.......!.L...*.x<6..J.YTJ}{...,...z.....Zw ...1...2.(...Eae...x..V.......\}.Q.......+.x............n...a.z-.m..OU!..'.g.i.m.......h.S.....rO.IrC.l...}._v....N9....<.q....@.._..E...&.r.Z/..J!....?......}..=1..FE!.||l.Gj.."...%ys..jT...t..G...P<U..n<.5.|.........k...&.'.G...<.]j......[7.+.Q..{.Z.h,T........&.7.3jYV..z/.02C...J.8.:Oz.q0...{.)!.F.%.%.t...Mx.....0....7...jl.S~.R|.....j.T.)..._..O......V.4.T...;.{.<.....1t.)....).'.i.....~.7.?....oL...I..O9........7.hiX.....U{*..o.8....{;,.e).vcd3.`... .^......y...!...A..Oq..=.h`.p..1.f.<..<...
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:PNG image data, 66 x 74, 8-bit colormap, interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1221
                                                                                                                  Entropy (8bit):7.348630153514487
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:772F379C2F5D7EA39DF9CAE3E922DE6C
                                                                                                                  SHA1:175CCF0D552E8DF76537170E29358C93A192EFAF
                                                                                                                  SHA-256:05238BCE970B7F813CEA7F921FF735312C9153EC3F547C1259116D255DC1D672
                                                                                                                  SHA-512:E0AD7431B3134E6B93C47EB909F5544A3E3C68ED0D8B56CA608830B95008CDAEB68F4E3E3AFF43A743010643712D1B146C2FCD7D6108F40DFFD53F2197CA6D4D
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR...B...J.....O.B!....sRGB.........gAMA......a.....PLTE...".."........".....".."........"..!.....!.. ..!..". .. ..... ..".....".....".....". ...!..... ..!..!..#..". "..... ..!..!.....!.."..... ..".....!.. ..".....!.. ..... .."..!..!..".....!..... .."..!.."..!.."..... ..!.."..#..!..............!..".."..".....#. .,'....UtRNS....I...%]..k......t...$.4.5.@.._..y....s....Q...lF.".w...&d.K..}....0u..S.HL...,. @.z.....pHYs..!...!..........IDATHK..z.A..E..CL..K.@(..{...U.F.{{........F...9.8.(fC5B,>.p.aT0...P...F..:*.%........0......MioZA$..k55.DU.p%NG..-.|.........A....,...r.VQN.O ......R.....B....Kh1...7.O.r...B..cr..D..W..j..J....Ti.)0i6^....r.H.....1.u..@.r ..;.tq.t.../....6.y".K.>ox.x.~T>r....h...p...u...G..3.....C..k.....l...P...Py..aVkKI..qT*(...9.%Q.&.e>...Rq.<.X..h.v..Ty..N..I....A.....|Rt..$....v6r....=.....Mn1..r.......u....x...Z.G?:#.....c...........A..c.......u...*t.d.`?..'.rk.!....t@.x...%...4.....W....&'XNPNP.......\g;...".($.Q.
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:PNG image data, 225 x 220, 8-bit/color RGBA, non-interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):13805
                                                                                                                  Entropy (8bit):7.9496219834249935
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:F78A23C400C84C81641A3A5E57243003
                                                                                                                  SHA1:A026B25B50D1AB8CF04227DEAA26C53A2937DA77
                                                                                                                  SHA-256:5E6716AED3454179B2DA5315E9EA26BEE3CACF032296E0A5C6893CD0CF57AAE9
                                                                                                                  SHA-512:907176115911F1A57B314EE41B5C5A289959EE179C1C4249F1A299052C3CAEC1EA9FF9F60AE6206C262FDE1B9A5AD754B35DB140D894B2D8FD3359D01324BBD3
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR..............W......sRGB.........gAMA......a.....pHYs..!...!........5.IDATx^.g..U..Y...Yk.w.3..O3*"...M.n.d.Q@AT." ..P..3.#..AA........ .H.(...H..s.._..N..v......_...OU.:g.[7T.aH>f.f.......u..i}...z....z.&...&/;.e^n..R.$J.....h0T..s....>U..]w....!.y.F.....U&.s.Q`...j.......M..tQNfw5..C..k....i...."......*....T..5o...9s.EK..LX?...I..*a........I.;....f=:HL.d....~WJ.qTCj0D..H.Pq...@O5a?........^>.]./R.G.{.A\Q..1.W.&.v.......7j.=...X......)..y.Y...QCoHw..M..$Z.........8...k}...K..X..b......!./.a..q.V.M.MQSaH7.s.fJA...J..../.M...o`.<.Ny3f..H../...D..oi...q..+.a>....;...%R.DR.b.I...).Qf.G...OM.......0^.8F..U...H...I.......LWI.b'PgL...z...}.~K...(.o8a....R...:5.I...(.z...:.x..y.........!....U..p...k..4."...Y.1p.J.-.....^..$.I.?...8.>RSjH..r..K.)...-b.p.....\...xa.....K."*7.bC.R.S/K.<A......4g.|;...=F..."`.0..Oi.I..i.$..[_M.!..&.OR..F?5...X.W..`<1.O..W.w.4_~RSoH4..Y....$M:.C.vv..b..}...<......W.`H..H.&..u..~F...C<i..w..4/PY.bq>%..0..Fu
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1693
                                                                                                                  Entropy (8bit):6.360003493727701
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:728B8ABA94D88CC5555487E0527B0209
                                                                                                                  SHA1:F704FB5B562AE8955216CD363BAF9CAA87374569
                                                                                                                  SHA-256:094B77B6C3D2350E27E8A78863BBEFC32B42516002122116E66569FC46CDC0D1
                                                                                                                  SHA-512:6A4B75DC69AEADA174F6234FD374CA6C1AC923235AEB47BDF3E0CC20D7A39FDDB55B3D86684D60CA93BD9FAF2905E80F6F8C3C5BC5DD0D7DF86F0090485F43E7
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR... ... .....szz.....pHYs..........+..... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)" xmp:CreateDate="2018-10-29T09:14:28+01:00" xmp:ModifyDate="2018-10-29T09:22:19+01:00" xmp:MetadataDate="2018-10-29T09:22:19+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c8b34f84-8e37-4524-bfc8-a3343bcf5b40" xmpMM:DocumentID="xmp.did:c8b34f84-8e37-4524-bfc8-a3343bcf5b40" xmpMM:Ori
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 220x220, segment length 16, baseline, precision 8, 222x220, components 3
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):26564
                                                                                                                  Entropy (8bit):7.889636477834128
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:F1D56B102EC6E2431A761916DCC2F267
                                                                                                                  SHA1:48997AF373EE52ED1F470E10113E98B11BA77792
                                                                                                                  SHA-256:7ABCA5B9906BBA0C8D61A25D51075D5A723E4FB2A0CF5D4256BD4AF1F4A47673
                                                                                                                  SHA-512:E58E9F919B0F7D9EBE9C14594B92F1CE6996F15AA14EFC4FEC4F10E0F68312DECE7384871C2F7859A9FA6A55239DB0FA8E883D073637538F4053D072D76E0E8B
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(....8.A<P.2.Z.{.-k^.|;..k...v...'..*..._...P?.9+.H...............}.].A.[yFF......6.105..3L..J....Q.....vI..8Z..EY-../...;.j.v.e.....ko...y.....'.=.|..R...b?......X|W.....8]VM.Jf..@.*..CHc?.U`?._................SV..5.../..G..P....4.=-..<.{2IzB...9BSr.5...)....?.|'..y.D..........-KA..ldh.....5.p........r+.j....i^."..f..ev./.2K[;...<...X..ktN....i.V?X>=..
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1731
                                                                                                                  Entropy (8bit):6.398040463872698
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:31A6D82252B782E1AC6C11600FD8C624
                                                                                                                  SHA1:7715CAF3EED49E96F4964939CA4CA10AA6857DFE
                                                                                                                  SHA-256:C1ADBDD80C8D69ADC420E12F78A98A0B8F8A43DBEF6CEAF31E5081B9962DBAD7
                                                                                                                  SHA-512:123DD7281A9E6CD09BEC4D5CE11FC2479ED6ACE67ED4B624B0B0495C6C067FB9B47632FDD94348C42C7BDD48DBBF0D785B6CB99E73712AE139992222ECE7193A
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR... ... .....szz.....pHYs..........+..... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)" xmp:CreateDate="2018-10-29T09:14:28+01:00" xmp:ModifyDate="2018-10-29T09:22:07+01:00" xmp:MetadataDate="2018-10-29T09:22:07+01:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:d9a84fe0-c712-4c49-a7ca-171c792fff0c" xmpMM:DocumentID="xmp.did:d9a84fe0-c712-4c49-a7ca-171c792fff0c" xmpMM:Ori
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:PNG image data, 552 x 112, 8-bit colormap, interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):5637
                                                                                                                  Entropy (8bit):7.873176983890686
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:F942C43153E60BA7A140673F654FB851
                                                                                                                  SHA1:CBC5EB2F0E65102E1B71BD2092F0B23D2C073232
                                                                                                                  SHA-256:045D08295C09E4105BEBFB3878C7D1552146A5BF9CBF115771A8EA305E1932ED
                                                                                                                  SHA-512:915EA137EEE545F91D6C6A153C32B8F4AB18A72E22F9A47EBA3853D05140257DBAEFF8EDFBADCFB8E462EA9B5340806C246AAAE1966D27D153655ED92C5DDC8D
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR...(...p.....t.K.....sRGB.........gAMA......a....sPLTE...1Z)5c.3e0.].5d05c/0a-2d/4d0.?.1\*5c.4e/3c16c/4b/5c02`-5](/^%*c*5c/5c05d06e13e0.q.1b-3d..f.6c05_*5d04`+1c*3a.1c.4f/4c00e+.T.5d/5d03d05b/5c04c/3c-._.$a$.T.3a-...$H.4e04d/5b.3d.5c/3d/-b-4`+4d/4c/5d04d02b/4a.3c.$H$5c0-`(4d/5c/4d06e/5c0'b'33.4a.1b'3e02a/.f.4e.3d04d/2c02_-([(4e03c04c/5d04d/6d-.\"1c,.\.5c.-i.3d//c+5d/3c/4e04c/2d02a.4c/(](3f&3e01b)3d/2d,4b.2d//_.2b+3c/4c02b/.U.4d0...4d/5c/...3b,5d/1b/5d04d/*]*3e03d/1b.5c.5c/4c.5d.5d/6d/0a,7^,5b.4a%*U*2b/4e04a-3b03Y&.3.3d/5d04b03c.3c/4d/4d11b,)`)3d/3d.3c+2a)-Z.6b05d.5d12c15b03f*6d/4c04e03d-4d02^+5d03d05c.6_-1d/4b/3c03b.3d.*U*4b03c.3`,4b13e03d.3d/3`0"U"3d.0g)4b0*\*4c.,_&5d04d0. .>....tRNS..i.&..I`..$..v...-..$.....>......$cRp.5...Y..\U......t...|'5p...e.x.s2...l......V.y.n3............;..5.n......QbQ.Ag.A.z....P......]..~...?..".F."..........4%.m;7.........#.O.8...m....JN...J.r%.$.(..n.k.....pHYs..!...!.........>IDATx^..eIU..Q...5 F........cD.s\............Y
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):30
                                                                                                                  Entropy (8bit):1.2389205950315936
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:C4F7EA2B0CF7EF16476C21201802A958
                                                                                                                  SHA1:A37531C858D14E52B6AF2245D57D45455AC9B7DA
                                                                                                                  SHA-256:01CCC978E2D91BCBD0BC363E425B09B688934FD5C72B6E8930B96A2D5551B2D7
                                                                                                                  SHA-512:498A73989EBC72ECD3DA5E65E9832903116902B0021F10666DC762A031E36F26339E6258DC43C734CEE617B21F6129D70F73DA9474E14D1DF7B3C5A51D8C587E
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:..............................
                                                                                                                  Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):14
                                                                                                                  Entropy (8bit):2.699513850319966
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:C5A12EA2F9C2D2A79155C1BC161C350C
                                                                                                                  SHA1:75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
                                                                                                                  SHA-256:61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
                                                                                                                  SHA-512:B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:..c.a.l.i.....
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 17:29:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2673
                                                                                                                  Entropy (8bit):3.9882232591976954
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:569587F039D15F0CD7B68EC5DB9D295B
                                                                                                                  SHA1:A898FA5AC76E02D5CA8D0CEC22D672E1AF02080A
                                                                                                                  SHA-256:919C01771DF71708E553423E18E87FE777701478B8104E4F220648362C852CA0
                                                                                                                  SHA-512:6C09374E0D5B18EF620D085EDB898788A447B6D3AB3DF0E077DCB1A720C030D762B878ED1C33D10E120BCFBA212C3AEE45AEECE1552CBFF4BF11D15391627D52
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:L..................F.@.. ...$+.,......V.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............f]n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 17:29:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2675
                                                                                                                  Entropy (8bit):4.000935899364231
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:7E19F6CD92C9BD8528CD270A09C7C8B5
                                                                                                                  SHA1:DA046C370C4460B0A8E4C6AF6621AF76721E80F2
                                                                                                                  SHA-256:D839EAC72BCF72F8D21FB8F0237DBDDC2CE9B66718F8BA3ADECEA97196F4A73F
                                                                                                                  SHA-512:C9238983F85DF7C51F8AE55EF6FAF9C09A3E920986DE4885E8BF4541AA5A56C879D2F1FB6790C4713CADC0915A228E83650AA8394B38BE70279EE915EFC20468
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:L..................F.@.. ...$+.,....rpK.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............f]n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2689
                                                                                                                  Entropy (8bit):4.012374609686287
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:507945FCDC9D43ED693139F8CC3929D9
                                                                                                                  SHA1:3BD43F184F4FA16BADF1BF3649008144FD80A360
                                                                                                                  SHA-256:6CE3B3C8C3A61A4373F925EA3865785CC057AA641DD99CA373FC95385B4BFDB7
                                                                                                                  SHA-512:2FE34A7892149DB2123A1017D580FD2683339A2661CF8BD282B52A850BA9FF5C80330104DA9A49F42117933B576743AB7A625EDCA82AB33532EEF51B889610B8
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............f]n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 17:29:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2677
                                                                                                                  Entropy (8bit):4.001925896547288
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:E472BFC8C139E465C1CE2184E1D5AA9C
                                                                                                                  SHA1:5B198AE6D74CA2DA1728D2E0D1A6BED0A6740E36
                                                                                                                  SHA-256:D8B75FE2FC9AF960776CE08484CBEF315083E78CBC991D578E60A61D4DA720F5
                                                                                                                  SHA-512:B354D5D0F245D3D327822C1CB8468BA483F2084B16D91746E34234179CE8993B5611EF7EA94E04C698CF5D1DD3C9C524742ACA85188647780D3B5DAD5C5CEB52
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:L..................F.@.. ...$+.,.....UE.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............f]n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 17:29:00 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2677
                                                                                                                  Entropy (8bit):3.9939767882775703
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:265B23880E3E06AAE458504998BB51EC
                                                                                                                  SHA1:513EF6F3645310F6D4455E226D8642F51F3D709A
                                                                                                                  SHA-256:0A8444F88DD17DFF815D9B735DB410CBD0A74A44DCBA4F1731D1EB3B0E46FE4F
                                                                                                                  SHA-512:7742D01561B222834E3A16BA5EF48F7F9C2B6BB0CD13DFE0CF2E8326C191CF6950A3995FEFD8DF889F10FF305A6FD4A878DFBD885131F281D6F787DB85114E23
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:L..................F.@.. ...$+.,.....<Q.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............f]n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 17:28:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):2679
                                                                                                                  Entropy (8bit):4.002607977296367
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:663318653A5851C18CD8211B31F8E6FD
                                                                                                                  SHA1:1A73067104481781ADDAA7C0946DBE3B30BA8B9A
                                                                                                                  SHA-256:5C24471ED061C44D4A01269970FFB15DFF008E7EE648F349A47375D1B68482B7
                                                                                                                  SHA-512:675B34B1A33CD48BE5E7786AB76DF9B185435DF71B893047295BBF561CFDF3EE3A228A5520247B9EBD23315DD15D38BBB4E7A5D9D87A6A0C7556C0D85A74DBFC
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:L..................F.@.. ...$+.,....v|<.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............f]n.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:HTML document, ASCII text, with no line terminators
                                                                                                                  Category:downloaded
                                                                                                                  Size (bytes):13
                                                                                                                  Entropy (8bit):2.7773627950641693
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                                                                                                  SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                                                                                                  SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                                                                                                  SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  URL:https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=8724108;type=global;cat=allpu;ord=1;num=3702150043887;npa=0;auiddc=1341231698.1735669750;u2=https%3A%2F%2Fwww.jacquielawson.com%2F%3Futm_medium%3Dpickup%26amp%3Butm_source%3Demail%26amp%3Butm_campaign%3Dreceivercontent;u3=not-used;u4=Greeting%20Cards%20%26%20Animated%20Ecards%20%7C%20Jacquie%20Lawson%20Cards;gdid=dYmQxMT;ps=1;pcor=1289404306;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;user_data_mode=a;gtm=45fe4cc1v9190283136za200zb868428773;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102198178;epver=2;em=tv.1;~oref=https%3A%2F%2Fwww.jacquielawson.com%2F%3Futm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent?
                                                                                                                  Preview:<html></html>
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MPEG transport stream data
                                                                                                                  Category:downloaded
                                                                                                                  Size (bytes):171832
                                                                                                                  Entropy (8bit):7.573427653784192
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:7F6EB0292D7A4DCB438529D7A0F4567B
                                                                                                                  SHA1:173933ACAADBE86A0685271EE09F3095FB5AE135
                                                                                                                  SHA-256:7F609D06A87AF97E0757CA68E74848BAD2BD1B43FB9091F20F18A0FCD76CE684
                                                                                                                  SHA-512:4891C75E40F67E58BA084135C31EAFF5475428012CCDE23B65F0B9D3F1C744C8E0060677D7216D7B07D896EDE721454360F73043E18BC6970BFB95BC126AF05E
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  URL:https://house-fastly-signed-us-east-1-prod.brightcovecdn.com/media/v1/hls/v4/clear/1640544087001/1924f122-ba0e-4e1e-9b03-2af704848650/66c394db-afc6-4426-810a-dc4ce9732044/3x/segment3.ts?fastly_token=Njc3NDkwNGFfZjU5NGE5N2I4NWMwYWU5MDExNDY3NTg2ZWVlZTc0ZGM2YzNjODlmNDk3N2VhMWY4OWRjMjA1ZDIzY2RmODRmZl8vL2hvdXNlLWZhc3RseS1zaWduZWQtdXMtZWFzdC0xLXByb2QuYnJpZ2h0Y292ZWNkbi5jb20vbWVkaWEvdjEvaGxzL3Y0L2NsZWFyLzE2NDA1NDQwODcwMDEvMTkyNGYxMjItYmEwZS00ZTFlLTliMDMtMmFmNzA0ODQ4NjUwLzY2YzM5NGRiLWFmYzYtNDQyNi04MTBhLWRjNGNlOTczMjA0NC8%3D
                                                                                                                  Preview:G@.................^}.......................................................................................................................................................................GA........................................................................................................................................................................................GA.0....B.~..........!.c....L.?..!.....f..h.!.(.....'I:_......_` .a..[..z..>p.'@4..T V.....9{....i.?.s>d..G.NrEN........G....(.Yr .?.+../...'.Ws..$....}/. ...!..+.R....YK.J.G........G....S...uVt.\%i5..._.<y^..g.3^...2.e...$.........rK0..7.,Y&.r.. ...X.U.3........Z8c0>#_Gg...|........v.,..EP..@...F......}.....D..B.._.3....u.......(.;....&.S...l..m...4.<..TtZ.G..2............................."5[542'@..4......#<.m.h...#........6..qKB....>2.7LJ.zw.<..',...C.~.xi.K.jO..9*s.;.W}....7RJ.o..f.@.8.O.o.&.n.s&.Se..^`9..Gr..:5. ..4..?..g..........S.GA.3....F.~..........!.c....L.A..!.....c..n...D....x.+.W..
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:ASCII text, with very long lines (1133)
                                                                                                                  Category:downloaded
                                                                                                                  Size (bytes):7746
                                                                                                                  Entropy (8bit):4.8911030104419435
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:D7307F6C380314719C78A089BA5D3F4F
                                                                                                                  SHA1:F909E51A5A2738C4C5C22BE487248C50B0D76C6D
                                                                                                                  SHA-256:40B7509BDFB74244A6D65911DC5A0C0A6F3DBF928D55FDB511F7A7344569DF12
                                                                                                                  SHA-512:41FAA6196E1C2826E2887AA9C915277F551913BF77D200EA8E64BE69BE091B36D2BB860D89B48A7EC980C096F0CC011C11BC02E842107BBECA83EF25E0BA1E33
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  URL:https://tags.tiqcdn.com/utag/aginteractive/main/prod/utag.105.js?utv=ut4.45.201809141950
                                                                                                                  Preview://~~tv:7129.20170623.//~~tc: Updating the E-Commerce extension data flow so it goes into the u.data.params object...//tealium universal tag - utag.sender.7129 ut4.0.202412050857, Copyright 2024 Tealium.com Inc. All Rights Reserved..try {. (function (id, loader) {. var u = {};. utag.o[loader].sender[id] = u;.. // Please do not modify. if (utag.ut === undefined) { utag.ut = {}; }. // Start Tealium loader 4.35. if (utag.ut.loader === undefined) { u.loader = function (o) { var b, c, l, a = document; if (o.type === "iframe") { b = a.createElement("iframe"); o.attrs = o.attrs || { "height" : "1", "width" : "1", "style" : "display:none" }; for( l in utag.loader.GV(o.attrs) ){ b.setAttribute( l, o.attrs[l] ); } b.setAttribute("src", o.src); }else if (o.type=="img"){ utag.DB("Attach img: "+o.src); b=new Image();b.src=o.src; return; }else{ b = a.createElement("script");b.language="javascript";b.type="text/javascript";b.async=1;b.charset="utf-8"; for( l in utag.loader.GV(o.attr
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:PNG image data, 180 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):4791
                                                                                                                  Entropy (8bit):7.933721665547797
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:D77F0F4D6F13DC280A83C7289458E1F4
                                                                                                                  SHA1:CF7940652578B4CBF3A410BEF4CA869B62DE1209
                                                                                                                  SHA-256:9B4C53799ACE0D2C35367626EFE40C151C893EF532D95590F4C7E9478C669E4C
                                                                                                                  SHA-512:9EF66A41F2A97378269E84E6B50070FA64DE55A45E7C67522D491DF7701BF8C5D9D5B3E61BBD6CE14036CD267B2E080FD972F042EC80E3C0DD32A7F547E25052
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:.PNG........IHDR.......@.......]=....sRGB........qIDATx..}..U..?...*J..r...$.4 o.. .h..(z..X....x.L.|.L.....S.CK.[.f.+h.......d.L"$.........g....}.4..g.Y.f..o...m....y.&\..:)..>...9`...9..L...w6..{].s...+.].W.^_.q.-"]_...S.........f.(x.....C.........uYB.9.y........%.:..O..:D..Q..h.....;..].n+..-"..sy/.s.8...I.,Z*...tz.B..G.{T.-..V.....B..r.z..=g......+..q]..pE..>.|T.9..&..b......~I...G.3...*4*C.r1.x........A..0.W...oT.u5@..V.QJ..J..g.A..I.rn;|E.......-..G%w.....=.f`.p>0..$.-.E...1...A.=C.].....n@....5P...'..(2b.k.QD...H..........@.:C.]..'....&@........k.......3@W........U...!C%Xa..@...1.m5mN...`.......-......J....A...} .:..P.<`.*.c:pb..O......=\3....q*....2.I.._...~m...._.B.`..].Q........G...[...u.D.....8...1........Fs|;p)../.i......V.~.s....7..55.?..........P.6..Xg.%.,9....^....#..!.W.\.....N...1...5.....\......nA.c&a.W...M.......X............c.....D..........4...0.\k...8....CL..._ ..u.d...=....b-.V..o'Lt..".q.9... ...\./.......9.OC.`.9
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MPEG transport stream data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):168824
                                                                                                                  Entropy (8bit):7.682306490071502
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:6E6CF2F11EFD1AE046CCD6F69A9ED64D
                                                                                                                  SHA1:58A69748A7D3C2A5FBACF360561F792CB33D5435
                                                                                                                  SHA-256:6C1CA842590EA47391876B936E7371BD89CAF8E7266EEE16F5CCFFD413A2ABDB
                                                                                                                  SHA-512:35A677283678AF2DCC4E6977FD58216E7B9AA075EE666D596CA433F1267891C0820DA7C7305CA0D9B0EEE21068D3A465FCBB0ACBFAA1975FA8CBE33BA7D48661
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:G@.................^}.......................................................................................................................................................................GA........................................................................................................................................................................................GA.0......~..........!......L.A..!.....a..hJ ....I3...:........$.Q.(..G9.U.7&Jy...QN....M.}.C....}...aS...>....[)DwQO..m.#.1.&...5.ss9=.lU...F.x.9.L.El..b.lS4...v3..". .H..w.:Xk....hG.....?.Z....O._.J/iw.......z._.Hw-...!.5^.jz...........g.....f.........>v....DH.R\.#.F(...F.'..W...y.....#1k..T4...D.......r........e.o>..W.g.......Y.!.h...9/..eN...z..u.........G..2......M.w.B.tQ......}.....X.bh.........Y.....H..^.E.!...w|Cc...c.. .U........?...mVU...z. 'xKVtfa.{.d.k./..W...S_G.@6..(f..Ax5Li.Z......av....}.W.V..q...c../..s....JPJ...pGA.3.....@~......7...!..%...L.E..!.....c.Xh6.......P.+W.^..
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:MPEG transport stream data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):177848
                                                                                                                  Entropy (8bit):7.499853265727522
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:60E04E7EA591BC908C727F2371D8B506
                                                                                                                  SHA1:1C194880625F0E1B4262B856DA2FE565E180028D
                                                                                                                  SHA-256:8206BF1E0DBECFE2E82AEDD975539E0EDC66361BBF4CC597BB43850D1DA33F8F
                                                                                                                  SHA-512:94902AA9D6EBFBDB646AF75C5214EEE9DCC5E1986505F13EC81BC8287F314C4AF7F7AC270F554A982DF8916637A177D8F22B45BD5E48992F823A39411593031C
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  Preview:G@.................^}.......................................................................................................................................................................GA........................................................................................................................................................................................GA.0....o@~..........!......L.B..!....O.@.f+]&.B...`..o...R...<......&...J...b?V.O.)[.i]..,..)......X.5N.0.. :..*.-85.Z..z2...V..n=...J....1..wT......'..{8{.&.....m9Y..^".:f&...G......}.4.........9...4..%"..Y.?K......^z.....`..2f&.H...17K..t....p..u.........|.T.@.H...=.,$te$.....V.. ......s...WT/ah....a.@.&p8.N...s.o%t.O4.<..x..|LrB..$.}:...G..=2..R...*mG...!Z:.fE.g[.2$n[)..>.P0...KP....[BG.....j.V..Z`$q.2'P@*.=.~...2I{...Vl..].Q.'..=.....q.#...v.M......=..+aS....i..n.ry.m4..I..{....\.8..+.......a..}.r.JM..........~...P$...5..G..3........................................................
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                  Category:downloaded
                                                                                                                  Size (bytes):201175
                                                                                                                  Entropy (8bit):5.404672881078066
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:2CC11E085E968B149AA3743056780FFC
                                                                                                                  SHA1:BF948CF0840CE84FD553258FC22C58741BD1F92A
                                                                                                                  SHA-256:E35EBB7E01DDA1BDB1FBB86BE8BB4163C3B3A0B1353A0B90D573D1EBB913EDDD
                                                                                                                  SHA-512:1D5DB6DFB789E513348012C0C3E3B92AF153E7478609C2C71F3B0646396E3B5C73A18BBBA5FF110E856C4E2E4A2594D752EE94D775A1EFE129245BFC80CA2CC7
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  URL:https://cdn.dynamicyield.com/scripts/2.45.0/dy-coll-min.js
                                                                                                                  Preview:(function(){var __webpack_modules__={738:function(){DY.StorageUtils=DYO.StorageUtils,DY.CoreUtils=DYO.CoreUtils,DY.Enums=DYO.Enums,DY.ExpUtils=DYO.ExpUtils,DY.Long=DYO.Long,DY.MozillaImplementations=DYO.MozillaImplementations,DY.Predict=DYO.Predict,DY.pubSub=DYO.pubSub,DY.SessionUtils=DYO.SessionUtils,DY.StringUtils=DYO.StringUtils,DY.URLUtils=DYO.URLUtils,DY.Q=DYO.Q,DY.userAgent=DYO.userAgent,DY.hash=DYO.hash,DY.DOM=DYO.DOM,DY.UserUtils=DYO.UserUtils,DY.StorageUtilsInternal=DYO.StorageUtilsInternal,DY.Conditions=DYO.Conditions,DY.sharedConditions=DYO.sharedConditions,DY.cpFunctions=DYO.cpFunctions},664:function(){DY.AdDetection=function(){var e=!1,t=!1,n="",r="dygoogad",i="dyother",o="dycontent",a="dy-content",s="dy-article",l=".dy_unit,.dy-unit,.dyunit",c="dyMonitor",u=500,d=250,f=5e3,p=!1,h=[];function m(){return"."+c}function g(){e=!1,top.focus()}function v(){t=!1}function y(){e=!0}function D(e){n=e.currentTarget,t=!0}function Y(r){e&&t&&DY.DataCollection.visitClick(n,!1)}function
                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  File Type:GIF image data, version 89a, 1 x 1
                                                                                                                  Category:downloaded
                                                                                                                  Size (bytes):42
                                                                                                                  Entropy (8bit):2.9881439641616536
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:
                                                                                                                  MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                  SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                  SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                  SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                  Malicious:false
                                                                                                                  Reputation:unknown
                                                                                                                  URL:https://adservice.google.com/ddm/fls/z/dc_pre=COC969_R0ooDFRGxgwcd0BoB6w;src=8724108;type=global;cat=allpu;ord=1;num=8276022810093;npa=0;auiddc=*;u2=https%3A%2F%2Fwww.jacquielawson.com%2Fecard%2Fpickup%2Frf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26amp%3Butm_medium%3Dpickup%26amp%3Butm_source%3Demail%26amp%3Butm_campaign%3Dreceivercontent;u3=https%3A%2F%2Fclicktime.cloud.postoffice.net%2F;u4=Cottage%20Cutout%20-%20animated%20ecard%20by%20Jacquie%20Lawson;gdid=dYmQxMT;ps=1;pcor=1173969687;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;pscdl=noapi;frm=0;user_data_mode=a;gtm=45fe4cc1v9190283136za200zb868428773;gcd=13l3l3l3l1l1;dma=0;tag_exp=101925629~102067555~102067808~102081485~102198178;epver=2;em=tv.*;~oref=https%3A%2F%2Fwww.jacquielawson.com%2Fecard%2Fpickup%2Frf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent
                                                                                                                  Preview:GIF89a.............!.......,...........D.;
                                                                                                                  File type:CDFV2 Microsoft Outlook Message
                                                                                                                  Entropy (8bit):5.622581927265771
                                                                                                                  TrID:
                                                                                                                  • Outlook Message (71009/1) 58.92%
                                                                                                                  • Outlook Form Template (41509/1) 34.44%
                                                                                                                  • Generic OLE2 / Multistream Compound File (8008/1) 6.64%
                                                                                                                  File name:FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg
                                                                                                                  File size:201'728 bytes
                                                                                                                  MD5:3788fd03f90a29667a904d0c8804c3e9
                                                                                                                  SHA1:3f68e64fde079fb557d0587e653389173d00a0e9
                                                                                                                  SHA256:46a6214104c2a01147a11817842530afd133b6ac23cee974b3badc8d434a2621
                                                                                                                  SHA512:3b9d8a5ba37b19049a4b7fb8d514500fc8757e53a954523e65ce6c69319e745b043ef85178cc1094907d87bfe1916d34df2e89d6f94087391b2d8364198c9840
                                                                                                                  SSDEEP:3072:ly/ngHhOOiJMM355JyU/fvANVuo+8Zun9/akWaS7wlpWSErN:w/ngHhYq9Ny8ZcpWSE
                                                                                                                  TLSH:5214B72436E9461AF3779F364FE3909B9526FC82AD14D78F3191730E0571A81A862B3F
                                                                                                                  File Content Preview:........................>......................................................................................................................................................................................................................................
                                                                                                                  Subject:FW: Carr & Jeanne Biggerstaff has sent you an ecard
                                                                                                                  From:Matt Baker <MBaker@FirstFedWeb.com>
                                                                                                                  To:Luis Maciel <LMaciel@firstfedweb.com>
                                                                                                                  Cc:
                                                                                                                  BCC:
                                                                                                                  Date:Tue, 31 Dec 2024 19:08:46 +0100
                                                                                                                  Communications:
                                                                                                                  • Luis, I believe Carr and Jeanne send these out every year and my Phishing Spider-sense ends up tingling every time. Not sure if anyone else has kicked this to you already, but wanted a second set of eyes on this to confirm it was legitimate. And if you think these are fine to open in the future without issue, let me know and Ill try not to bug you with these anymore. Thanks, Matt Baker EVP, Chief Financial Officer <http://www.firstfedweb.com/> Direct (503) 435-3217 Email mbaker@firstfedweb.com <mailto:mbaker@firstfedweb.com> 118 NE Third Street, McMinnville, OR 97128 <https://www.facebook.com/firstfederal/> <https://www.instagram.com/first_federal/> <https://www.linkedin.com/company/first-federal-savings-&-loan-of-mcminnville/?viewAsMember=true> <https://www.youtube.com/channel/UCgGrkBPKOtKE-dMx-23qnwA>
                                                                                                                  • From: cards@jacquielawson.com <cards@jacquielawson.com> Sent: Saturday, December 21, 2024 12:06 AM To: Matt Baker <MBaker@FirstFedWeb.com> Subject: Carr & Jeanne Biggerstaff has sent you an ecard [EXTERNAL EMAIL: Take caution with links and attachments. ] <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com%3Fsource%3Djl511&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=dd7394de02b0dc79804dd639032b721361889611> 21 December 2024 Dear Matt & Aria Baker, Carr & Jeanne Biggerstaff (carr@biggerstaffvba.com <mailto:carr@biggerstaffvba.com> ) has sent you a Jacquie Lawson ecard. You can view your card here. <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=91898966d6fe36791625c29dfd3935a7b6f970e2> You can also send a reply to Carr & Jeanne Biggerstaff using a special Jacquie Lawson email stationery! just click where it says "Send a reply" at the bottom of the card. If you are not familiar with our ecards, and are uncomfortable clicking a link in an email, we quite understand. Instead, you can pick up your card and read your message from Carr & Jeanne Biggerstaff by going to https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=df2cd5d9171c3e7ef8133b1d2cdc18e20ae22c9b <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com%3Futm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=760e9ef62ca68fd16395c6a5f168f46590e94f7e> clicking the "Pick up card" option at the bottom of any page of our website, and entering your personal pick up code, which is: f4244576 With best wishes, Jacquie Lawson and team <http://image.jacquielawson.com/product/siteassets/general/3526157/image.png> <https://api.jacquielawson.com/simple/ecard/12231289734700/open?client_id=f341299845c1af237958dc9cf459bf94> Experience the classiest ecards on the web! jacquielawson.com <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com%3Fsource%3Djl511%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceiverfooter&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=3e7444136f6e6864e5ff2855ffccb47d9314ee50> Please do not reply to this email. If you have any problems viewing your card, please visit our FAQs. <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/faq/ecards%3Futm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceiverfooter&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=960f908f5abae535bee4ba31d100e559b3813d37> If your email program has not displayed a link above, then please copy the following into the address bar of your Internet browser to view your card. https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=e011327b093f07d1a29a5b6320561a8438991081 <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/ecard/pickup/rf4244576e5c8457cb28e9f8e3f04a7a0%3Fsource%3Djl999%26utm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceivercontent&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=91898966d6fe36791625c29dfd3935a7b6f970e2> If you don't wish to receive ecards from jacquielawson.com, please unsubscribe here. <https://clicktime.cloud.postoffice.net/clicktime.php?U=https://www.jacquielawson.com/blocklist%3Futm_medium%3Dpickup%26utm_source%3Demail%26utm_campaign%3Dreceiverfooter&E=mbaker%40firstfedweb.com&X=XID541CLuiF85517Xd2&T=FF1001&HV=U,E,X,T&H=f6507534f3b1e51c33bcf7b683ff24c56eef9dc1> Our ref: JLC470099988-CS / f4244576 This email was sent to: mbaker@firstfedweb.com <mailto:mbaker@firstfedweb.com> This email was sent by or on behalf of: Microcourt Limited, trading as jacquielawson.com, Mill Street East, Dewsbury, West Yorkshire, WF12 9AW, United Kingdom. 2001-2024 Microcourt Limited. All rights reserved.
                                                                                                                  Attachments:
                                                                                                                  • image001.png
                                                                                                                  • image002.png
                                                                                                                  • image003.png
                                                                                                                  • image004.png
                                                                                                                  • image005.png
                                                                                                                  • image006.png
                                                                                                                  • image007.png
                                                                                                                  • image008.jpg
                                                                                                                  • image009.png
                                                                                                                  Key Value
                                                                                                                  Receivedfrom SA1PR22MB5396.namprd22.prod.outlook.com
                                                                                                                  1808:46 +0000
                                                                                                                  Authentication-Resultsdkim=none (message not signed)
                                                                                                                  by BY1PR22MB5659.namprd22.prod.outlook.com (260310b6:a03:4b4::19) with
                                                                                                                  2024 1808:46 +0000
                                                                                                                  ([fe80:da33:cd27:23e7:48fa%7]) with mapi id 15.20.8314.011; Tue, 31 Dec 2024
                                                                                                                  Content-Typeapplication/ms-tnef; name="winmail.dat"
                                                                                                                  Content-Transfer-Encodingbinary
                                                                                                                  FromMatt Baker <MBaker@FirstFedWeb.com>
                                                                                                                  ToLuis Maciel <LMaciel@firstfedweb.com>
                                                                                                                  SubjectFW: Carr & Jeanne Biggerstaff has sent you an ecard
                                                                                                                  Thread-TopicCarr & Jeanne Biggerstaff has sent you an ecard
                                                                                                                  Thread-IndexAQHbW6wSpldVQ4WvpUCryvidBNpgr7MAoPUA
                                                                                                                  DateTue, 31 Dec 2024 18:08:46 +0000
                                                                                                                  Message-ID<SA1PR22MB5396B5110DE5392F6B824CD5CA0A2@SA1PR22MB5396.namprd22.prod.outlook.com>
                                                                                                                  References<1734768358.683393244609795.22483@futures-dc3-c701.jacquielawson.com>
                                                                                                                  In-Reply-To<1734768358.683393244609795.22483@futures-dc3-c701.jacquielawson.com>
                                                                                                                  Accept-Languageen-US
                                                                                                                  Content-Languageen-US
                                                                                                                  X-MS-Has-Attachyes
                                                                                                                  X-MS-Exchange-Organization-SCL1
                                                                                                                  X-MS-TNEF-Correlator<SA1PR22MB5396B5110DE5392F6B824CD5CA0A2@SA1PR22MB5396.namprd22.prod.outlook.com>
                                                                                                                  MIME-Version1.0
                                                                                                                  X-MS-Exchange-Organization-MessageDirectionalityOriginating
                                                                                                                  X-MS-Exchange-Organization-AuthSourceSA1PR22MB5396.namprd22.prod.outlook.com
                                                                                                                  X-MS-Exchange-Organization-AuthAsInternal
                                                                                                                  X-MS-Exchange-Organization-AuthMechanism04
                                                                                                                  X-MS-Exchange-Organization-Network-Message-Id216e7d00-a281-4cad-8fa7-08dd29c62b30
                                                                                                                  X-MS-PublicTrafficTypeEmail
                                                                                                                  X-MS-TrafficTypeDiagnosticSA1PR22MB5396:EE_|BY1PR22MB5659:EE_|PH7PR22MB5176:EE_
                                                                                                                  Return-PathMBaker@FirstFedWeb.com
                                                                                                                  X-MS-Exchange-Organization-ExpirationStartTime31 Dec 2024 18:08:46.5483
                                                                                                                  X-MS-Exchange-Organization-ExpirationStartTimeReasonOriginalSubmit
                                                                                                                  X-MS-Exchange-Organization-ExpirationInterval1:00:00:00.0000000
                                                                                                                  X-MS-Exchange-Organization-ExpirationIntervalReasonOriginalSubmit
                                                                                                                  X-MS-Office365-Filtering-Correlation-Id216e7d00-a281-4cad-8fa7-08dd29c62b30
                                                                                                                  X-MS-Exchange-Organization-BypassClutter$true
                                                                                                                  X-Microsoft-AntispamBCL:0;ARA:13230040|69100299015|4022899009|366016|8096899003|41050700001;
                                                                                                                  X-Forefront-Antispam-ReportCIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR22MB5396.namprd22.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(69100299015)(4022899009)(366016)(8096899003)(41050700001);DIR:INT;
                                                                                                                  X-MS-Exchange-CrossTenant-OriginalArrivalTime31 Dec 2024 18:08:46.1297
                                                                                                                  X-MS-Exchange-CrossTenant-FromEntityHeaderHosted
                                                                                                                  X-MS-Exchange-CrossTenant-Id3778f0b2-789a-4d43-b25e-d4fe25a4c3c0
                                                                                                                  X-MS-Exchange-CrossTenant-AuthSourceSA1PR22MB5396.namprd22.prod.outlook.com
                                                                                                                  X-MS-Exchange-CrossTenant-AuthAsInternal
                                                                                                                  X-MS-Exchange-CrossTenant-Network-Message-Id216e7d00-a281-4cad-8fa7-08dd29c62b30
                                                                                                                  X-MS-Exchange-CrossTenant-MailboxTypeHOSTED
                                                                                                                  X-MS-Exchange-CrossTenant-UserPrincipalNameVuzf3tcxWIJrQqVMUxe5KCZ+Ejo229IvVAJjMbXR3/AokfEelC2ZadllGNNsZHn5DHQJr9qEPwKithZ533J5Sg==
                                                                                                                  X-MS-Exchange-Transport-CrossTenantHeadersStampedBY1PR22MB5659
                                                                                                                  X-MS-Exchange-Transport-EndToEndLatency00:00:03.2651852
                                                                                                                  X-MS-Exchange-Processed-By-BccFoldering15.20.8293.000
                                                                                                                  X-Microsoft-Antispam-Mailbox-Deliveryucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
                                                                                                                  X-Microsoft-Antispam-Message-InfotIQYizpRgFQSPb90IKVWe3kuKDg40M3Q9uLkTMTnmQr9Irnht3P3ooQcqNU/z/hyXhAVR17vE97muE2kaHGZRzmrj/N4xwns5ll8mNhncyyMrNqhz9ZOk4v5CbNNvSSxF7l638xPn92kEcy0OEQOZd02W/QLkKeD8W2Jkhl/3vQyWogrbekP0cZU22IX3+xfXre/Qlnrx+0ZyDq0f3FVQWg9oeDrle1oyb0cl8P9w1MF0W1DxMAchRAnKl6NCMByRUDlsQ1jI7y8xzrpbvn2GHOgZStgI+cdvuhYSj/lyDaBGtZoM8mamNyCm2gtMO0m3uFgDW5vAeCnWx4rA2Mv7+pmurB7Kj928tYS8NYaOQPoE5HAv9H7q9vpgC92ORg74ION+WSDFNWdpj3CN/HhEJB8FmGmpB4BQUvU4lzIkk8RkwW0nXamZcrQWt01K8Yl7snkS7rfIzctXzKyRJKxlUzAWD7KNNIKu6jB/GITufUiNscNJdsAl5PDQBF/tgNYVjQvtkHA/HgItDSVRzOEY52ecTbesBORDEEowxov6y3AaUKysWYOBQ1eOG+PgceyVDKgRR261MhiM4OuzmDOGc5ok5jie9aZSGRomXPeGVOtHVNHlpVuM1vQGarBCxhFIS0YtLaKF6Ao48tMB4d49HGiMyRlOclbvjXW/3ESdPqkAGpvwSg1BdtWr6lK6xfuTahym8Sizh1Qnjm7XeZ7AbgdOaAZtQn6jABoWmTMo35IMT/3GlGipMEpU8SBgp51wT1cMHkZQXA3mu1LjOpfgWDSqxZ9HMQO2rPWPxYuKzw=
                                                                                                                  dateTue, 31 Dec 2024 19:08:46 +0100

                                                                                                                  Icon Hash:c4e1928eacb280a2