Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
original.eml

Overview

General Information

Sample name:original.eml
Analysis ID:1500040
MD5:426e14bc8b37577e68552ca43d14e899
SHA1:7dcd2850e04c2de58b3e50f6c19a7b5f9a0b24fb
SHA256:de4d7dda39c171757639530f591fca99f716b7867bd331d61c18b99824cf55f0
Infos:

Detection

Score:4
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

Detected non-DNS traffic on DNS port
Form action URLs do not match main URL
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry

Classification

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6772 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 5808 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "256A06C8-6C82-47F4-9A9E-69596042134D" "757AFFAA-D8BF-4805-AB07-7B19F4180D1B" "6772" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 5448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2012,i,671322920555726367,1893836283750602359,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • CredentialUIBroker.exe (PID: 3460 cmdline: "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding MD5: 91C44D67C5881747F02785101CEB5369)
  • cleanup
No yara matches
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6772, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoft.com/common/fido/get?uiflavor=WebHTTP Parser: Form action: https://login.microsoftonline.com/common/login microsoft microsoftonline
Source: https://login.microsoft.com/common/fido/get?uiflavor=WebHTTP Parser: Form action: https://login.microsoftonline.com/common/login microsoft microsoftonline
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=trueHTTP Parser: Number of links: 0
Source: https://login.microsoft.com/common/fido/get?uiflavor=WebHTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: Number of links: 1
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0HTTP Parser: Base64 decoded: 98640eaf-fc9a-46da-b5ee-79406244053ee1f7e0f7-f93f-482f-b0df-f569e7481611
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=trueHTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoft.com/common/fido/get?uiflavor=WebHTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=trueHTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: <input type="password" .../> found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0HTTP Parser: No favicon
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dF26EDFD2B12FD936%26opidt%3d1724782024%26uaid%3d2cf650ee83cd41819bfe62fda4158cef%26contextid%3d5A2F8B8205EDC8DB%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=2cf650ee83cd41819bfe62fda4158cef&suc=00000006-0000-0ff1-ce00-000000000000&lic=1HTTP Parser: No favicon
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dF26EDFD2B12FD936%26opidt%3d1724782024%26uaid%3d2cf650ee83cd41819bfe62fda4158cef%26contextid%3d5A2F8B8205EDC8DB%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=2cf650ee83cd41819bfe62fda4158cef&suc=00000006-0000-0ff1-ce00-000000000000&lic=1HTTP Parser: No favicon
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26mkt%3den-US%26client_id%3d51483342-085c-4d86-bf88-cf50c7252078%26opid%3dF26EDFD2B12FD936%26opidt%3d1724782024%26uaid%3d2cf650ee83cd41819bfe62fda4158cef%26contextid%3d5A2F8B8205EDC8DB%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=51483342-085c-4d86-bf88-cf50c7252078&uaid=2cf650ee83cd41819bfe62fda4158cef&suc=00000006-0000-0ff1-ce00-000000000000&lic=1HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=trueHTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=trueHTTP Parser: No <meta name="author".. found
Source: https://login.microsoft.com/common/fido/get?uiflavor=WebHTTP Parser: No <meta name="author".. found
Source: https://login.microsoft.com/common/fido/get?uiflavor=WebHTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000006-0000-0ff1-ce00-000000000000&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DG1wzeow5fcu1C0Ix3zqyEk9ssUmTYMF5DrfKwZRqpiS3rI3FdvCGynOb96VqXxn6HNOv1m3ktMAa5jRnoaw0rrvtt0t61ibsMUE3e0NDSZLCJM6tANIKsy8Epdrd3ZrJiugKKwiare1nJMf-gXVBTfLXFy3ROI1jtvyHYRIHbF_sVKXF0QEJ-WdiXEfhISOv&response_mode=form_post&nonce=638603787497054431.OTg2NDBlYWYtZmM5YS00NmRhLWI1ZWUtNzk0MDYyNDQwNTNlZTFmN2UwZjctZjkzZi00ODJmLWIwZGYtZjU2OWU3NDgxNjEx&redirect_uri=https%3A%2F%2Fadmin.microsoft.com%2Flanding&ui_locales=en-US&mkt=en-US&client-request-id=2cf650ee-83cd-4181-9bfe-62fda4158cef&x-client-SKU=ID_NET472&x-client-ver=7.6.2.0&sso_reload=trueHTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoft.com/common/fido/get?uiflavor=WebHTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoft.com/common/fido/get?uiflavor=WebHTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQQIARAAjZI9bBJhHMbvoKUt0UrqRzo20cGYAu9xcNAmHSgf5YC7a4Hj4BYC90EPuPfg7oWD2xoXB4eOpm7GqYNRE6N2MB2cmph0NJ0aBzUdqnHQLhohXRx9hifP8OSf_PP8vDPRABUIBcA9NxEgVu-AS1H-ifuBqhJ-SZmkf2QueH3nmz-XP9zfiT_-0_j99ObDb_v47W2EutZqMFiXdQ0GdE0yDctQUUAy9GCnDmUNNt_g-DGOf8XxPde0Av18cd9lUWSMAmQ0Fg2vREEkHCaJAFdqhtjkeqcqVJGoM5FqEQBWL2znBZoQBR6xThswyeqITW7ZbIntiKW0zoZ4W2xJSGy1HVEDgEtm9XHfFjfGN1p8iBN4kk02h2wrNTxxXePifbQdmphhao7ywzWnGqZe6xoW2nN_wbmuAmk5YUCoSCgwqSkQaVIdaQbcNI2uYiJNsdY2CNtRDDuiSn0iAegh6fRGqfaKZfF6qcqkI0lTzdliodfViqRJk2l5kNgYQa6xQpV7lSGkMiw3IHSyjZh4PdIqQKNuA9McIAQQRWgNi-FTpALYZFHMJ7IMheIsnbNGsVRXNmVSNLNav5nL2VrdVAiYZVR_s1JeL6n5SnpEFjiaaKHBKFMt0JlGumaVc5U02Epl_YKsVVLqNl3kBi_dnvE6ugGP3PPjp6AmL3VNQ9U6yvEUfjZ1a3bG51l0LWF3bwD36uys14ctYkvYxRT-ZHrMwPtfp_zB0efMW8HZeYe9wo6mg2WxmadzdiNHBJ2oUsla8TLcrKRjDU6vJDJBJNRlOysQeaO5tQZWiV0PvuvxHHnm6GSNTZXC0dB3D_5gBjuY-x-aTq5c93r7Wq1jSPWOYi1cInV4FbuY__To8PWzjy_OM2fXlh2p0VIcUOyWIumeE6fMjlVSGZ4xw21xVI1ZvVhOIGEQJfqxtec-7NSH_QU1HTTP Parser: No <meta name="copyright".. found
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49717 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:63419 version: TLS 1.2
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.18:63381 -> 1.1.1.1:53
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 20.73.194.208
Source: unknownTCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: nam.safelink.emails.azure.net
Source: global trafficDNS traffic detected: DNS query: login.microsoftonline.com
Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global trafficDNS traffic detected: DNS query: signup.live.com
Source: global trafficDNS traffic detected: DNS query: logincdn.msftauth.net
Source: global trafficDNS traffic detected: DNS query: fpt.live.com
Source: global trafficDNS traffic detected: DNS query: msft.hsprotect.net
Source: global trafficDNS traffic detected: DNS query: client.hsprotect.net
Source: global trafficDNS traffic detected: DNS query: stk.hsprotect.net
Source: global trafficDNS traffic detected: DNS query: collector-pxzc5j78di.hsprotect.net
Source: unknownNetwork traffic detected: HTTP traffic on port 63405 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63428 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63490
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63492
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63494
Source: unknownNetwork traffic detected: HTTP traffic on port 63457 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63440 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63386 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63420 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63405
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63404
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63407
Source: unknownNetwork traffic detected: HTTP traffic on port 63383 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63406
Source: unknownNetwork traffic detected: HTTP traffic on port 63443 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63409
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63408
Source: unknownNetwork traffic detected: HTTP traffic on port 63466 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63492 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63484
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63487
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63486
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63401
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63488
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63403
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63402
Source: unknownNetwork traffic detected: HTTP traffic on port 63431 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63408 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63452 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63384
Source: unknownNetwork traffic detected: HTTP traffic on port 63481 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63383
Source: unknownNetwork traffic detected: HTTP traffic on port 63389 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63425 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63415
Source: unknownNetwork traffic detected: HTTP traffic on port 63419 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63417
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63419
Source: unknownNetwork traffic detected: HTTP traffic on port 63446 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63463 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63410
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63412
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63413
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 63455 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63480 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63407 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63390
Source: unknownNetwork traffic detected: HTTP traffic on port 63449 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63461 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63422 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63427
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63426
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63429
Source: unknownNetwork traffic detected: HTTP traffic on port 63441 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63428
Source: unknownNetwork traffic detected: HTTP traffic on port 63464 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63494 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63386
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63385
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63388
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63421
Source: unknownNetwork traffic detected: HTTP traffic on port 63435 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63387
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63420
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63423
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63389
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63422
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63425
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63424
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 63433 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63427 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63458 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63483 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63387 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63402 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63384 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63438
Source: unknownNetwork traffic detected: HTTP traffic on port 63444 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63439
Source: unknownNetwork traffic detected: HTTP traffic on port 63438 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63472 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63390 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63397
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63430
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63396
Source: unknownNetwork traffic detected: HTTP traffic on port 63413 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63486 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63432
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63398
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63431
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63434
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63433
Source: unknownNetwork traffic detected: HTTP traffic on port 63398 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63435
Source: unknownNetwork traffic detected: HTTP traffic on port 63396 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63430 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63453 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63424 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63409 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63401 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63449
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63448
Source: unknownNetwork traffic detected: HTTP traffic on port 63447 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63441
Source: unknownNetwork traffic detected: HTTP traffic on port 63473 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63440
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63442
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63445
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63444
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63447
Source: unknownNetwork traffic detected: HTTP traffic on port 63410 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63446
Source: unknownNetwork traffic detected: HTTP traffic on port 63429 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63461
Source: unknownNetwork traffic detected: HTTP traffic on port 49679 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63421 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63404 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63442 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63488 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63467 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63452
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63453
Source: unknownNetwork traffic detected: HTTP traffic on port 63415 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63455
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63458
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63457
Source: unknownNetwork traffic detected: HTTP traffic on port 63432 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63472
Source: unknownNetwork traffic detected: HTTP traffic on port 63484 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63474 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63426 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63403 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63388 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63385 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63439 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63445 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63487 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63490 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63412 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63463
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63462
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63464
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63467
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63466
Source: unknownNetwork traffic detected: HTTP traffic on port 63397 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63406 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63481
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63480
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63483
Source: unknownNetwork traffic detected: HTTP traffic on port 63448 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63462 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63423 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 63417 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63474
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63473
Source: unknownNetwork traffic detected: HTTP traffic on port 63434 -> 443
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49710 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49717 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49722 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.73.194.208:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:63419 version: TLS 1.2
Source: classification engineClassification label: clean4.winEML@30/54@42/272
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240827T1405290023-6772.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: C:\Windows\System32\CredentialUIBroker.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "256A06C8-6C82-47F4-9A9E-69596042134D" "757AFFAA-D8BF-4805-AB07-7B19F4180D1B" "6772" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "256A06C8-6C82-47F4-9A9E-69596042134D" "757AFFAA-D8BF-4805-AB07-7B19F4180D1B" "6772" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2012,i,671322920555726367,1893836283750602359,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=2012,i,671322920555726367,1893836283750602359,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: unknownProcess created: C:\Windows\System32\CredentialUIBroker.exe "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: twinapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: twinui.appcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wldp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.shell.servicehostbuilder.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.creddialogcontroller.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: powrprof.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: umpdc.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.xamlhost.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.cred.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wincorlib.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: mrmcorer.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windowmanagementapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: textinputframework.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: inputhost.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: propsys.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coreuicomponents.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coreuicomponents.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: languageoverlayutil.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: bcp47mrm.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.xaml.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: bcp47langs.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dcomp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: profapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: netutils.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dxgi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dwrite.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: d3d11.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.globalization.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: d3d10warp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dxcore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: d2d1.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: textshaping.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.ui.xaml.controls.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: fontglyphanimator.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dwmapi.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.internal.ui.logon.proxystub.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: directmanipulation.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovdatamodel.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovhost.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: samcli.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovs.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: smartcardcredentialprovider.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovslegacy.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: cngcredui.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: facecredentialprovider.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: dsreg.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.devices.enumeration.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: structuredquery.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: biocredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ngckeyenum.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: cxcredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: ngccredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: certcredprovider.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: icu.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wlidcredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: mswb7.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: fidocredprov.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: aadauthhelper.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: cryptngc.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: devobj.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprov2fahelper.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: devdispitemprovider.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windows.media.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: credprovhelper.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: wtsapi32.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: winsta.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: idstore.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: samlib.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: winbio.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: windowscodecs.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: threadpoolwinrt.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: webauthn.dll
Source: C:\Windows\System32\CredentialUIBroker.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1271D5-2FF2-4EA4-9647-C67A82A2D85C}\InProcServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\CredentialUIBroker.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Windows\System32\CredentialUIBroker.exeQueries volume information: C:\Windows\SystemResources\Windows.UI.BioFeedback\Fonts\NUIMDL2.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading
1
Process Injection
1
Masquerading
OS Credential Dumping1
Process Discovery
Remote ServicesData from Local System2
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Registry Run Keys / Startup Folder
1
DLL Side-Loading
1
Modify Registry
LSASS Memory1
File and Directory Discovery
Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Registry Run Keys / Startup Folder
1
Process Injection
Security Account Manager14
System Information Discovery
SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading
NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.214.172
truefalse
    unknown
    inbound-weighted.protechts.net
    35.190.10.96
    truefalse
      unknown
      sni1gl.wpc.alphacdn.net
      152.199.21.175
      truefalse
        unknown
        sni1gl.wpc.omegacdn.net
        152.199.21.175
        truefalse
          unknown
          s-part-0017.t-0009.t-msedge.net
          13.107.246.45
          truefalse
            unknown
            www.google.com
            142.250.186.100
            truefalse
              unknown
              stk.hsprotect.net
              34.107.199.61
              truefalse
                unknown
                s-part-0032.t-0009.t-msedge.net
                13.107.246.60
                truefalse
                  unknown
                  s-part-0029.t-0009.t-msedge.net
                  13.107.246.57
                  truefalse
                    unknown
                    nam.safelink.emails.azure.net
                    unknown
                    unknownfalse
                      unknown
                      signup.live.com
                      unknown
                      unknownfalse
                        unknown
                        client.hsprotect.net
                        unknown
                        unknownfalse
                          unknown
                          identity.nel.measure.office.net
                          unknown
                          unknownfalse
                            unknown
                            msft.hsprotect.net
                            unknown
                            unknownfalse
                              unknown
                              aadcdn.msftauth.net
                              unknown
                              unknownfalse
                                unknown
                                collector-pxzc5j78di.hsprotect.net
                                unknown
                                unknownfalse
                                  unknown
                                  logincdn.msftauth.net
                                  unknown
                                  unknownfalse
                                    unknown
                                    login.microsoftonline.com
                                    unknown
                                    unknownfalse
                                      unknown
                                      fpt.live.com
                                      unknown
                                      unknownfalse
                                        unknown
                                        • No. of IPs < 25%
                                        • 25% < No. of IPs < 50%
                                        • 50% < No. of IPs < 75%
                                        • 75% < No. of IPs
                                        IPDomainCountryFlagASNASN NameMalicious
                                        13.107.6.156
                                        unknownUnited States
                                        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        51.132.193.104
                                        unknownUnited Kingdom
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        35.190.10.96
                                        inbound-weighted.protechts.netUnited States
                                        15169GOOGLEUSfalse
                                        13.107.246.45
                                        s-part-0017.t-0009.t-msedge.netUnited States
                                        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        23.38.98.104
                                        unknownUnited States
                                        16625AKAMAI-ASUSfalse
                                        13.107.246.60
                                        s-part-0032.t-0009.t-msedge.netUnited States
                                        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        142.250.185.227
                                        unknownUnited States
                                        15169GOOGLEUSfalse
                                        52.167.30.171
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        13.107.42.22
                                        unknownUnited States
                                        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        20.189.173.17
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        52.109.68.129
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        20.190.160.14
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        40.126.29.12
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        52.109.32.97
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        199.232.214.172
                                        bg.microsoft.map.fastly.netUnited States
                                        54113FASTLYUSfalse
                                        95.101.54.113
                                        unknownEuropean Union
                                        34164AKAMAI-LONGBfalse
                                        23.46.239.91
                                        unknownUnited States
                                        20940AKAMAI-ASN1EUfalse
                                        20.190.190.131
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        172.217.18.110
                                        unknownUnited States
                                        15169GOOGLEUSfalse
                                        34.107.199.61
                                        stk.hsprotect.netUnited States
                                        15169GOOGLEUSfalse
                                        52.113.194.132
                                        unknownUnited States
                                        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        64.233.177.95
                                        unknownUnited States
                                        15169GOOGLEUSfalse
                                        20.42.73.30
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        74.125.136.94
                                        unknownUnited States
                                        15169GOOGLEUSfalse
                                        34.104.35.123
                                        unknownUnited States
                                        15169GOOGLEUSfalse
                                        1.1.1.1
                                        unknownAustralia
                                        13335CLOUDFLARENETUSfalse
                                        40.126.62.132
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        13.107.246.57
                                        s-part-0029.t-0009.t-msedge.netUnited States
                                        8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        142.250.186.106
                                        unknownUnited States
                                        15169GOOGLEUSfalse
                                        20.190.159.4
                                        unknownUnited States
                                        8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                        239.255.255.250
                                        unknownReserved
                                        unknownunknownfalse
                                        2.19.126.151
                                        unknownEuropean Union
                                        16625AKAMAI-ASUSfalse
                                        152.199.21.175
                                        sni1gl.wpc.alphacdn.netUnited States
                                        15133EDGECASTUSfalse
                                        142.250.186.142
                                        unknownUnited States
                                        15169GOOGLEUSfalse
                                        64.233.184.84
                                        unknownUnited States
                                        15169GOOGLEUSfalse
                                        142.250.186.100
                                        www.google.comUnited States
                                        15169GOOGLEUSfalse
                                        23.38.98.69
                                        unknownUnited States
                                        16625AKAMAI-ASUSfalse
                                        IP
                                        192.168.2.18
                                        Joe Sandbox version:40.0.0 Tourmaline
                                        Analysis ID:1500040
                                        Start date and time:2024-08-27 20:04:53 +02:00
                                        Joe Sandbox product:CloudBasic
                                        Overall analysis duration:
                                        Hypervisor based Inspection enabled:false
                                        Report type:full
                                        Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                        Number of analysed new started processes analysed:23
                                        Number of new started drivers analysed:0
                                        Number of existing processes analysed:0
                                        Number of existing drivers analysed:0
                                        Number of injected processes analysed:0
                                        Technologies:
                                        • EGA enabled
                                        Analysis Mode:stream
                                        Analysis stop reason:Timeout
                                        Sample name:original.eml
                                        Detection:CLEAN
                                        Classification:clean4.winEML@30/54@42/272
                                        Cookbook Comments:
                                        • Found application associated with file extension: .eml
                                        • Exclude process from analysis (whitelisted): dllhost.exe
                                        • Excluded IPs from analysis (whitelisted): 52.109.32.97
                                        • Excluded domains from analysis (whitelisted): fs.microsoft.com, config.officeapps.live.com, prod.configsvc1.live.com.akadns.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, europe.configsvc1.live.com.akadns.net
                                        • Not all processes where analyzed, report is missing behavior information
                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                        • VT rate limit hit for: original.eml
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):338
                                        Entropy (8bit):3.456416629864069
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:02A3AA5B64C37C9E9234541C87AC26DD
                                        SHA1:C74A8967CAF7FB0AB7090288007A303F790802E8
                                        SHA-256:23885EEE72929F4B7B4E7CBC4CA50B58A983538E806C1075161E562477B23000
                                        SHA-512:7DFE69D08A34312E7638614DC6457DF3AEE7FF4683C99508B2927DD3007E4DB44C1A2E348F33374632FA1E37B6E817385787F1DCAD54A404ED8FF6272CFAF0A1
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:p...... ........R.......(...............................................9p,.VZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):231348
                                        Entropy (8bit):4.391869371624182
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:87AB932C1DD244F2CCF1CF2A54520B0A
                                        SHA1:D7C585F6673B1CE45BF7D9319DFE164382594138
                                        SHA-256:7B43C62F0F30948CACCFFCF04C58856AA86CA3B3FCCC18B8BEA0FBCE8E3BA641
                                        SHA-512:3884C9B0228AFB9677C6BF849F74DD7D326CE33AFB38137D830BD9F8137FBAC476C4A15518D790EF9E484796CC546FBD0B429B0640643C474B525E8E67E50576
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:TH02...... ...T.........SM01X...,....kF.............IPM.Activity...........h...............h............H..h.O.....<.7....h............H..h\nor ...ppDa...h.(..0...(.O....h.............h........_`.k...hX...@...I..w...h....H...8..k...0....T...............d.........2h...............k..............!h.............. hK,......@.O...#h....8.........$h........8....."h........P.....'h..............1h..<.........0h....4....k../h....h......kH..hX...p....O...-h .......l.O...+h..........O.....A.}.:.8.;.9. ..............F7..............FIPM.Activity.st.Form.e..Standard.tanJournal Entry.pdIPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.000Microsoft.ofThis form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:ASCII text, with very long lines (65536), with no line terminators
                                        Category:dropped
                                        Size (bytes):322260
                                        Entropy (8bit):4.000299760592446
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:CC90D669144261B198DEAD45AA266572
                                        SHA1:EF164048A8BC8BD3A015CF63E78BDAC720071305
                                        SHA-256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
                                        SHA-512:16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:ASCII text, with no line terminators
                                        Category:modified
                                        Size (bytes):10
                                        Entropy (8bit):2.721928094887362
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:9D54357B4095F18D0C4C95F82CE6441A
                                        SHA1:988443F5E703752298E653FB6ED875E4F7012848
                                        SHA-256:38FCA2FB122421F42B351231F468209E908916016534DBD94A2F0A2CABB45C2B
                                        SHA-512:83CBA0BDD86A96E974838E238711649EEEBD80CFA0CFDB7E29A3EA1EC9946E4196A6C076033A8E20B270617AEA8CF80386BAF3910D7BC3E3993E32D666EFF08F
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:1724781934
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):176365
                                        Entropy (8bit):5.287471372865473
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:BA4A9793515E4C897C69A4865E18604F
                                        SHA1:A0C92A04E9889BF7E79564E43B5281F016E72F6D
                                        SHA-256:0851D528F9CA9FB685B0BC294F58E7E6F7ABFC06C0CF5B1C01415EB4AFCE1D5B
                                        SHA-512:FB3303617533CD61A1AC56CE425E771C0ED069FAB97A8D881C565B22FB459AA5357E0625CEBE99A35B989E41F14173AB6DFBE2DBBAF37FFCD749850DAC058DFB
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-08-27T18:05:31">.. Build: 16.0.18014.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:SQLite Rollback Journal
                                        Category:dropped
                                        Size (bytes):4616
                                        Entropy (8bit):0.13760166725504608
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:ABDE3E4099F4AB5ABFE77A0554CB8218
                                        SHA1:E241331A0833588C28EE8940C0B78C785255DEDE
                                        SHA-256:58840C02F79C0C332E7CDFB464C06FC01EC9DED66346F652997CA718C8A762B2
                                        SHA-512:E1CD4B833E91566C07A93051781AB78B88DFC4C4721FEBF3F096A02103ADE6E8700ABF3B819F08717E3DEB24A0A2D34FBF246652AE02F6687E2579C6B1A1776B
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:.... .c.....&..j....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:GIF image data, version 89a, 15 x 15
                                        Category:dropped
                                        Size (bytes):663
                                        Entropy (8bit):5.949125862393289
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:ED3C1C40B68BA4F40DB15529D5443DEC
                                        SHA1:831AF99BB64A04617E0A42EA898756F9E0E0BCCA
                                        SHA-256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
                                        SHA-512:C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,*.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()*+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1434), with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):12669
                                        Entropy (8bit):5.587139204689599
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:EE5F2FFAF17833F3DCF2BD2FF6A85A32
                                        SHA1:C3669961D03A12933F2B61B86F53C77C4EA181A3
                                        SHA-256:45C8D337CFB6856C3EDFD68F101A705E89DE6333BB32484F3846B5DF8BD513EC
                                        SHA-512:89F51E291BFDA3082ED0EFF8D4E7E4C70C3A3B2C35996DE326B63261D6C98366A3BABDF3BF7164751574B613AD09D2B35DE2685FCB51C89D2383EB096F15644D
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:y>..</table>..</td>..</tr>..</tbody>..</table>..<table role="presentation" dir="ltr" align="center" class="container footer-template" style="border-spacing: 0;border-collapse: collapse;padding-top: 0;padding-right: 0;padding-bottom: 0;padding-left: 0;vertical-align: top;mso-table-lspace: -1pt;mso-table-rspace: -1pt;background: #ffffff;width: 640px;Margin: 0 auto;text-align: inherit">..<tbody>..<tr style="padding-top: 0;padding-right: 0;padding-bottom: 0;padding-left: 0;vertical-align: top;text-align: left">..<td style="word-wrap: break-word;-webkit-hyphens: auto;-moz-hyphens: auto;hyphens: auto;border-collapse: collapse;vertical-align: top;color: #11100f;font-family: Segoe UI, SegoeUI, Roboto, &quot;Helvetica Neue&quot;, Arial, sans-serif;font-weight: 400;padding-top: 0;padding-right: 0;padding-bottom: 0;padding-left: 0;Margin: 0;text-align: left;font-size: 14px;line-height: 20px">..<table role="presentation" class="wrapper outer-wrapper footer-wrapper" align="center" style="border-spa
                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):30
                                        Entropy (8bit):1.2389205950315936
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:04BCEF629AE543F21D8815374BAA7A1F
                                        SHA1:08B3E63FF41C8786798D0A2FEEE2A6DE6C9B390C
                                        SHA-256:119DAD811506A15C7E0217BF93BA199145CA53171BEBDBA519309B5A4AE640B8
                                        SHA-512:AE312C657585C2C1818F385F6DB3E72D39225065264E1C3DA16BC7F7A0464FBE26D35DCB23BCB0B12DB482F1D90CEE677F908B6EC43D3E954BA64FAF29E2DA87
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:..............................
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                        Category:dropped
                                        Size (bytes):2675
                                        Entropy (8bit):3.985374039264894
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:25FBB61A9B4E7A3DBF0FD3AB9C386AA0
                                        SHA1:6C1B2CA425B59ADF494628C6B7F7D669D85A4AA1
                                        SHA-256:2AD629023F62EFF62B9E785FA043139A5CE60FEE708FF2FA571C7E324723FEA2
                                        SHA-512:104C4C113C578A79F0512745B6DD7492C79366FCF762370B15CBA69C6E6956D1BF7BD2BA0593FF72446DA3339AA0DE58F1E1C32896F36A6B2FA909713E0AF5AA
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:L..................F.@.. ...$+.,...............y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........)#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                        Category:dropped
                                        Size (bytes):2677
                                        Entropy (8bit):4.0010435439419965
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:B13D9E1B26AF76EC4EC7AB2664135E40
                                        SHA1:46C2ED5BBE99096ED63D025ABC2C5ECCBE50F6A3
                                        SHA-256:8EBE8E73F6A124CCA478CDB055EE281DD4BEE767765DAD71C9A509AFCE3D8E02
                                        SHA-512:C1C126E77674D06B046B2B3883C33F0E632B1C55472AE9CD252A116CE68ED148C7CDD54FEACBEC36346B738795EB87B0C96AA0C97D2BD8D4534BE993E2CE6A2C
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:L..................F.@.. ...$+.,...............y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........)#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                        Category:dropped
                                        Size (bytes):2691
                                        Entropy (8bit):4.007025147049651
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:21F8AEFA0834CF82FF0A8A40BBDB2AAB
                                        SHA1:2EE34E4F51EEB217BFDBF7E4AB12378F1AE52803
                                        SHA-256:5AE428C35FBD9A2824187B4F0F909172E82E2B8E127590131736315AEAB42FF5
                                        SHA-512:9880239BCF1D79B3764E014E8BB93E0CEA68EBD5473FA17A345600655A6BF90E92B6F7916DC9E7120C8BCCD1A6FA17CCC873770BC79A2273D0024B577B9F23F8
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:L..................F.@.. ...$+.,....?.4 ?.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.R.....#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........)#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                        Category:dropped
                                        Size (bytes):2679
                                        Entropy (8bit):3.997175486960408
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:5FE60F0C724F4C8C2C0CB6BAC9DB8FBA
                                        SHA1:75EE3CBE93104D671A1A0131E28F96EC62AA5A88
                                        SHA-256:80C22C84DA561362B2728E702C896A0DCCB72D507BABA0CA5183B54CB3B0F161
                                        SHA-512:08B12C522E924189CEB36A6C3D54B2237B9BBC4AA2824BC73AFA1F5C55A3FBD2775D5EAF97FB9A9CECF76961965A60EF02E699C556A531B685EB767AB74347EC
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:L..................F.@.. ...$+.,....-=..........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........)#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                        Category:dropped
                                        Size (bytes):2679
                                        Entropy (8bit):3.9853235898867347
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:EF9036BA66E6628D4FB3BA2CC9229F03
                                        SHA1:F8A64FC4A46220DE1556E9212323423ECD52D6EE
                                        SHA-256:B09AB878C3DB4CE3E036CC8B56612F5DE85676014A3D950BD046EAB2DB144FB6
                                        SHA-512:3D4936D2903E302CE97B90EED81D4D6E169F647EDB055134E6CA9B7A46DAD5BC465721238F5D6A913864CCF2572872D5DF0DDCB77A645DA7AC8B06DEDEB8E08F
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:L..................F.@.. ...$+.,....{\..........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........)#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:05:48 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                        Category:dropped
                                        Size (bytes):2681
                                        Entropy (8bit):3.999220119905327
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:16925EC05A63477525222CABF4131A91
                                        SHA1:0D4121F98A475383D84CCE924C1850CE70B3B078
                                        SHA-256:AEB5CD9E0121E021B5CD1806B1D07F04A7B2FB25C6BBEEA0EB18B06248FE568E
                                        SHA-512:F41310D2C8CE6EAA31C0DE1AEC02780E2CEBEA1A32710F40209B917CB7440E76B179CD456C09EE7BE3AD05BF97C5D14D2BC1C36A162E54836F578B420D9976EE
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:L..................F.@.. ...$+.,....J...........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.R..PROGRA~1..t......O.I.Y......B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.R..Chrome..>......CW.V.Y......M......................pd.C.h.r.o.m.e.....`.1.....FW.R..APPLIC~1..H......CW.V.Y.............................pd.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y.......#......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........)#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
                                        Category:dropped
                                        Size (bytes):49804
                                        Entropy (8bit):7.994672288751266
                                        Encrypted:true
                                        SSDEEP:
                                        MD5:6DE768A4DF1E0D0061CDB52EF06346C4
                                        SHA1:3829A667B97668008023DDA98F4C0772174C8EF6
                                        SHA-256:58732EEE2ED9091F4F5776DC8A8A14116CBE5A2BA1CCDA0256896BAB08A52128
                                        SHA-512:CC6966D2C2B43E762750102E734DA6B88D7BFB92DDB5D482EE25029337D95E997466E83001586F2B63DAEE890B5F3188E8EC0F1B084D5EB67CFEA55EDDFAD47D
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:...........m[.8.0........OL....;w..nf.0.ff.X.'V......4.r~........=........,..JU.......T~.l..?..E.....X..|t~P9...TN..G..?^.~.............Xx.0..Q..Fa4.#7.q...F.;......4...Q.W&~.@....O.*T.y.37J.+Ggf...P....Pz.N...>..a.D..<.m./A,*...Q.....WN.Q...8.Db$.G.H<...'....J,..8..{nG.2@HYkL../......=.pL....A?.&Ng.i,......2lo...$.<.3...?~pW..=...L..&x.QR.u3..#6q2....U.Y1..".M. .<W."7@......w..."H,@......0..P....p:...[...E].A..%..V.K\.......F.ir.}.Lc{s..O.g..(|.........9o..A.t.K....Wv.l6..T.......t.........+..........-w {l..g...V..\=W.j.oaT}t.J`E..$W......;.k.\.t.w~}".....jf..W..."..a..0y........@.T.1.G0.......*.Y_....../..........@.....*]+.*..*.q\.cR.....t.3S-5g....'U.j.d......y.n,:).|.?.FW...d...|.......*.`.3....kMKf...#..,DM.TY+..g.........e+.>...{y..N/..g-#FV.V.p.......Xs.(..{..}..-.O..H=."...........8M.g..!H..0.~.Tdf.;...$D%N .)..!..V...'r\.... ...&....J|."Nd%D:uw:.<W.+...H&.Z...L=..U.v....J.t.0%+...U..3M....y...L..G...p='.....pB"-..|.....j .a".i=O.R Q2..."...
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
                                        Category:downloaded
                                        Size (bytes):1435
                                        Entropy (8bit):7.8613342322590265
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:9F368BC4580FED907775F31C6B26D6CF
                                        SHA1:E393A40B3E337F43057EEE3DE189F197AB056451
                                        SHA-256:7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
                                        SHA-512:0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
                                        Preview:...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.|..~.|{~...b{8...zv.....8|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g*.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dg*N.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f*;.....Zhrr.,.U....6.Y....+Zd.*R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
                                        Category:downloaded
                                        Size (bytes):3452
                                        Entropy (8bit):5.117912766689607
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:CB06E9A552B197D5C0EA600B431A3407
                                        SHA1:04E167433F2F1038C78F387F8A166BB6542C2008
                                        SHA-256:1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
                                        SHA-512:1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://login.live.com/Me.htm?v=3
                                        Preview:<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s*(\w+)\s*=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p||s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with very long lines (512)
                                        Category:downloaded
                                        Size (bytes):11970
                                        Entropy (8bit):5.416120131770621
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:39A0EB35CD7799A181D34F4AE1DDB496
                                        SHA1:E933CA8534BCB6AD79D240316CE23C8B870050D0
                                        SHA-256:C8CEF105FCAF7CBF3F8682C861045505C24D41CF6686C20C1C03E14031A3DB69
                                        SHA-512:0AE990F9B57B55C3A8025BBE13C98ECD8A40C38380F9E0EFEF2BE7B418642EB040E4C537E684D2FEF7E04113450CFD4DEFF3414310773177220209991BBF1643
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js
                                        Preview:/*! ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise. .. * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain..Provided for Informational Purposes Only..Public Domain. .NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK..----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------ */."object"!=typeof JSON&&(JSON={}),
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with very long lines (46090)
                                        Category:downloaded
                                        Size (bytes):65532
                                        Entropy (8bit):5.550469425005586
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:30F42402E96BC01EF19299138F309233
                                        SHA1:BAFBBE0D0C9B525DE53ED454362B7F1C8969CE9C
                                        SHA-256:7C2B045ACD7BBFDA50ED751293F74962C921559F9BD40A0E9166FBDCAAA46A10
                                        SHA-512:0DD40186AEAA5C0E64B5194DF37CA5F040500E83F3D8C041D1CEDE9BBA28401A55B59C75F8B9E572A9C814C37E77697B9F3A9A2ED335DA95BBA04AADBBB1FF47
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_JQnUxWSvwsd9FrpspQmznw2.js
                                        Preview:/*!. * ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function t(t){for(var n,r,i=t[0],a=t[1],s=0,u=[];s<i.length;s++)
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:downloaded
                                        Size (bytes):6
                                        Entropy (8bit):2.584962500721156
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:AAAB7A355103063D9EEB4824A3A6B374
                                        SHA1:E51555F02C32321F3E48F07A0FA5AF46DF835BFC
                                        SHA-256:79BA862622D6FA84AC7E4F98EB95043A255FC2C81711E9400A8AA4D4B1608471
                                        SHA-512:D1A0C9C4F628459F5CA904405B2A66A69425A50E8DCE1BAA43161D784EB219BD3E1FD9447BCBACC314652EDA08CF0B02C863C87F3AC1534AE0F62A414C191F1B
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://fpt.live.com/Images/Clear.PNG?ctx=jscb1.0&session_id=2cf650ee83cd41819bfe62fda4158cef&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&esi=YnVhPU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTcuMC4wLjAgU2FmYXJpLzUzNy4zNiZvcz1XaW4zMiZscHJvYz00Jm9sPXRydWUmcnR0PTIwMCZjaHJtPXRydWUmcHJvc3ViPTIwMDMwMTA3JmV2YWw9MzMmYXBwdj01LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2JmxzPXRydWUmZG09OCZtdHA9MCZuYz03NCZwcj0xJnNyPTEyODB4MTAyNCZzY2Q9MjQmYXNyPTEyODB4OTg0JnR6PS0zMDAmZHN0PTYwJnR6bz0tMjQwJmJsPWVuLVVTJm10aD0yN2Y1MWQzMTQ5ZTZiZjIwOWI2NmJkMzg3YjBhZjNjNCZtdG49MiZwbj01JnBoPWYzYWMyMmFjNTljNmRjYjg3NDEwOWQwOTNjNTI1NWU4JnA9cGx1Z2luX2ZsYXNoJTNEZmFsc2UlMjZwbHVnaW5fd2luZG93c19tZWRpYV9wbGF5ZXIlM0RmYWxzZSUyNnBsdWdpbl9hZG9iZV9hY3JvYmF0JTNEZmFsc2UlMjZwbHVnaW5fc2lsdmVybGlnaHQlM0RmYWxzZSUyNnBsdWdpbl9xdWlja3RpbWUlM0RmYWxzZSUyNnBsdWdpbl9zaG9ja3dhdmUlM0RmYWxzZSUyNnBsdWdpbl9yZWFscGxheWVyJTNEZmFsc2UlMjZwbHVnaW5fdmxjX3BsYXllciUzRGZhbHNlJTI2cGx1Z2luX2RldmFsdnIlM0RmYWxzZSUyNnBsdWdpbl9zdmdfdmlld2VyJTNEZmFsc2UlMjZwbHVnaW5famF2YSUzRGZhbHNlJmZoPTJhMjk4NDlhZjA3ZGQxNjFkZGM3MzA0MGJlMjVmM2YwJmZuPTExMiZsaD1odHRwcyUzQSUyRiUyRmZwdC5saXZlLmNvbSUyRiUzRnNlc3Npb25faWQlM0QyY2Y2NTBlZTgzY2Q0MTgxOWJmZTYyZmRhNDE1OGNlZiUyNkN1c3RvbWVySWQlM0QzM2UwMTkyMS00ZDY0LTRmOGMtYTA1NS01YmRhZmZkNWUzM2QlMjZQYWdlSWQlM0RTVSZkcj1odHRwcyUzQSUyRiUyRnNpZ251cC5saXZlLmNvbSUyRiZ3PThEQ0M2QzMxMUUzMDAyQyZpZD02NTlkMzVkMS0zNjNkLTU1OGUtZGM3OS0xZmY2MGJhYmY5NTAmYT0mYz1iMGVhZGI5MzQxNjZiNjk2MDdiODI1OTIyMzM2MTc2ZA==&eci=eyJ1dmRyIjoiR29vZ2xlIEluYy4gKEdvb2dsZSkiLCJ1cmRyIjoiQU5HTEUgKEdvb2dsZSwgVnVsa2FuIDEuMy4wIChTd2lmdFNoYWRlciBEZXZpY2UgKFN1Ynplcm8pICgweDAwMDBDMERFKSksIFN3aWZ0U2hhZGVyIGRyaXZlcikiLCJ2ZHIiOiJXZWJLaXQiLCJyZHIiOiJXZWJLaXQgV2ViR0wiLCJpZHVoIjoiMTViNmNhNDcyNjliZTQyODc1Njg1MDY5MzdlOTkxN2MifQ==&PageId=SU&u1=&u3=10.0.0&u4=x86&u5=64&u2=(Google%20Chrome%2C117.0.5938.149)%2C(Not%3BA%3DBrand%2C8.0.0.0)%2C(Chromium%2C117.0.5938.149)
                                        Preview:dfp:OK
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):31
                                        Entropy (8bit):3.873235826376328
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:5FC018D9E6C56911BBC8DC5DDCD0C768
                                        SHA1:70979F57A85D527ED8ABCBF02CFF44640C58BDE6
                                        SHA-256:2E6D78A4AE644F3B60AFD3C33E66539FF6C5F6A8ED6ABC40A3AF06AC020EC020
                                        SHA-512:1E3B86274B3590E28366F2D2DE86A1844058E213BD225AAA05D992CA70523F65D2BD543F9F762A805A2C4D5961AA34F5A19EBE70E135939C9CD3C63F6B5F5524
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:{"error":"Method Not Allowed"}.
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449540
                                        Category:downloaded
                                        Size (bytes):122157
                                        Entropy (8bit):7.997792045055063
                                        Encrypted:true
                                        SSDEEP:
                                        MD5:B9A054903589649EF9B8AC6373ABE4BF
                                        SHA1:B3E0D0512F7B1C59F89BD86338FCD73D57385672
                                        SHA-256:4EAFFBA1EDB780DEC8B10D44D25951D96BEE9E0F98E46F87849EDA4ECEEEAAB6
                                        SHA-512:E251F3B0B01E715957DC7356A14E919C8F9253135F1BD6733855F85244384D0BE100B73E174766BB333D4A4EFBE30CE1079C29F02FEEA084984325B991708736
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_2P9n4TNNrWcgKwW6Mt6tGA2.js
                                        Preview:...........{W.H.8....F3.......V..@...LU.,.pd)m..W.y..~._Dd...e.jv...;[X..........?o._..+..._ex....N+7...+W...........`...7.~R.......0....(.....(vR.T..o.;Ae.G.J..*.8...iR..$.B#.D.*T.{.+'N_+gW.:..6..P.f...!..Q......G...<.X\y~.....Q...J.\.?A#...M..'f....q........!E..5.[L..:..{P.........8...L...u..Ye..b.*iTy....x.pR..M.j.......M.a&,~...A%..B.J....2..$x.Lb'D...`.I......cTt.Z.3...L..$.f3...R..~...*.?.(l..L*.avv...a.x.C.......>.Gu7.~..$p......>.m8...3...9....|.=..GS..e[W*.........%....Z.'.........x...*.-..JX..+..O. _....o.;=.?....w../Q=`.$}8Hvvj...&w.`......F.....d...Jf......W..mo;.....[...*~@+5.....v ....2.S...n.;;..jT.....p.\..[O..qZ.UkK1@{...{.hY.. CC.h..U.6...,..a...Na!&.T..${.[..X[..2..ry .1,D}LeY=...Q.>.{.......G~.US.......Z.7...)..h.[..(......1p..=Wn .$..y.:+......i......-UF.,XL...vF..j...N...9..D7k..PL.L...h-.p..%V?.>e...C...3....P...*....w?.....*..............R.].....xY..~.........s...xZr.z.L..).j...p.)#..!Qr.#t..
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:downloaded
                                        Size (bytes):244
                                        Entropy (8bit):3.9686592321783793
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:246511A4A7AA8D39154B70D9AC8A7952
                                        SHA1:FEF1AFB7572B51DEB3BFAA1636E23E4151A5E609
                                        SHA-256:AFE1B69BF6E80DEB79BFADDCDCD2785B01660771F1414C6A00CB6C468BDDCDE8
                                        SHA-512:A63E51C505FA4011607602B7E1772E7E3A30E2C08C6B1C00DDBDEDE820E8672EA07291AA50A7F942E6317F8EB5A3BE1A95E01FC672A640DD51944143644089DC
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://stk.hsprotect.net/ns?c=2ddd4bf0-649f-11ef-8239-dd2feaf131a4
                                        Preview:e1426fef1bf7f53c010ef3b3fa227fea53fbe41db654e18fe0f1c0fd5dad522c057b18e7cfdbc04958e61549f784885092ecb91034c6f1a700aa79fe867e0b9a62eaa6abc78c4ab2acea510c7f0dadb4a65c51f163d56dae8876894e973b6bde76d301c2e2e669b024df8337ebb4555f85ee1788dd3e124768da
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with very long lines (2054)
                                        Category:downloaded
                                        Size (bytes):9285
                                        Entropy (8bit):5.397876465825329
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:439A53994F1A9C860C7787ED5100CA0C
                                        SHA1:15BA120F64BBF6A59A457841B10DF0D6D1B4574C
                                        SHA-256:441BFA485FB0EB8AD2BE7001209868B57C41769CAE9512A774419F5882C093E6
                                        SHA-512:FB6002797BD9E28A352BCBE4643BC7E998C562218D9189AE879E1DC605BC79C3234435029B46667724E5C85A475A72C8DDDED17E3EEFD7791EC1FB21822D3804
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
                                        Preview:!function(){function e(){return(x.location.protocol||"").concat("//",x.location.hostname||x.location.host)}function r(e){if(e){try{var r=/function (.{1,})\(/,n=r.exec(e.constructor.toString());return n&&n.length>1?n[1]:""}catch(e){}}return""}function n(e,r,n){if(e&&r){n||(e=e.toLowerCase());for(var t=0;t<r.length;t++){var o=r[t];if(o&&(n||(o=o.toLowerCase()),e.indexOf(o)>=0)){return r[t]}}}return null}function t(e,r,n){return!!(0===n&&r&&r.indexOf("Script error.")>=0)}function o(e,r){.if(!e.expectedVersion||e.expectedVersion!==E().jquery){if(r&&r.indexOf("jQuery.easing[jQuery.easing.def] is not a function")>=0){return!0}if(r&&r.indexOf("The bound jQuery version is not the expected version -- loaded")>=0){return!0}}return!1}function i(e){if(e){try{if("string"!==E.type(e)&&JSON&&JSON.stringify){var n=r(e),t=JSON.stringify(e);return t&&"{}"!==t||(e.error&&(e=e.error,n=r(e)),(t=JSON.stringify(e))&&"{}"!==t||(t=e.toString())),n+":"+t}}catch(e){}}return""+(e||"")}function a(e,r){return{."sig
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with very long lines (65450), with CRLF line terminators
                                        Category:downloaded
                                        Size (bytes):119648
                                        Entropy (8bit):5.356165204896218
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:75CF78D0E38C65A538AD253CA9E48DBE
                                        SHA1:BF0452E4A42A9AF3B69D5D8C3A3A0433F14921B6
                                        SHA-256:DF2AA8537C1992C94846A0FFFFAA9031D430D9D0210B9E396EC059AFF62627E0
                                        SHA-512:81383E4FDAE1F34F8E652F69058D57A2A4BD0A77C2C41C3174BEE0CEBA83A8326229C2A74EAF415BFBD34382B1C442A97C41034F43CD77A391BA9B4DAAE65463
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
                                        Preview:/*! jQuery v3.5.1 | (c) JS Foundation and other contributors | jquery.org/license */..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with very long lines (65402)
                                        Category:dropped
                                        Size (bytes):154169
                                        Entropy (8bit):5.669607215573337
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:6618AA4F8793C36FB36E016C848EEB22
                                        SHA1:A59E0E4E7E0441CAC8A201A30C11B1CC6C607DBF
                                        SHA-256:309FAE5061E2C65D01975F7361948E41624E118D1C8FB87931D0BC374FCAB495
                                        SHA-512:E53A3ECCD640D36F5DD23BBBDBBC0D185408B7E9373D6E7F318DA37841B6A1D902D9CF88024120342A2C27294C45CDB3B72FE88158827C71242C4E8E5D4DC418
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:// @license Copyright (C) 2014-2024 PerimeterX, Inc (www.perimeterx.com). Content of this file can not be copied and/or distributed..try{window._pxAppId="PXzC5j78di",function(){"use strict";function t(e){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},t(e)}function e(t,e){(null==e||e>t.length)&&(e=t.length);for(var n=0,r=new Array(e);n<e;n++)r[n]=t[n];return r}function n(t,n){if(t){if("string"==typeof t)return e(t,n);var r=Object.prototype.toString.call(t).slice(8,-1);return"Object"===r&&t.constructor&&(r=t.constructor.name),"Map"===r||"Set"===r?Array.from(t):"Arguments"===r||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(r)?e(t,n):void 0}}function r(t){return function(t){if(Array.isArray(t))return e(t)}(t)||function(t){if("undefined"!=typeof Symbol&&null!=t[Symbol.iterator]||null!=t["@@iterator"])return Array.from(t)}(t)||
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:downloaded
                                        Size (bytes):28
                                        Entropy (8bit):4.307354922057605
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:9F9FA94F28FE0DE82BC8FD039A7BDB24
                                        SHA1:6FE91F82974BD5B101782941064BCB2AFDEB17D8
                                        SHA-256:9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
                                        SHA-512:34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
                                        Preview:ChIKBw3RW1FSGgAKBw1Xevf9GgA=
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:HTML document, ASCII text, with very long lines (2633), with CRLF line terminators
                                        Category:downloaded
                                        Size (bytes):2754
                                        Entropy (8bit):5.655686970424721
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:CF06C5C86E41BEA5A6A2823EDE5FD310
                                        SHA1:769E283C99CC1D30C3DF6D64729C58E3A0134868
                                        SHA-256:6F16A233833E3F2108542CFB75263ED18387453F9B423C7743598883913462AB
                                        SHA-512:9D15F4579B3D152581E6406BA8D8DA18E152657A1A069D447A0B8AB85132581DE05A0962F744B05777916AFEBC8455D0A51A5ABD6AB21382E516FC7C6B2F5E62
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&session_id=2cf650ee83cd41819bfe62fda4158cef&id=659d35d1-363d-558e-dc79-1ff60babf950&w=8DCC6C311E3002C&tkt=taBcrIH61PuCVH7eNCyH0MJojnuUODHcZ6x9WoxhgCk2zmnVqU4VBLvSNxcZXSL7sh7rs%252bN5ihOuREloq5rR%252fYc4dRa24uNhlfBWc4imP5CfUm%252bO1ty%252bXfYC%252fKYZ8IZmvQgDxFXRkZiPH4piwwfu2HV%252fTKa%252fDa6u6%252fwdAZV67k7EKeIjkbA4unoI4J5IcGmminNyFGyldGIDQ7GRZTLgRKIgcgBZdkTNFGA69CZzntEeGLma9ebjVRsj8b6R01ywP%252by4Q%252bv7%252fCGBSKdZmVTXEaE9PG9I86U8jFVNHDPNGS9%252bI%252fSKZ6SUolCp01sEByMC&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d
                                        Preview:<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>..</head>..<script>function BaseStamp() { this.GetStorageQsInfo = function () { if (window.localStorage) { var n = window.localStorage.getItem(lsKey); var lsupd = "False"; if (lsupd === "true" && n) { var xhr = new XMLHttpRequest(), method = "GET", url = target + "updatels.html?ofid=" + n + "&session_id=" + sid + "&CustomerId=" + cid; xhr.open(method, url, true); xhr.onreadystatechange = function () { if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) { var update = xhr.responseText; if (update && update.toLowerCase() === "true") { window.localStorage.setItem(lsKey, id); } } }; xhr.send(); } if (n && n != null && n != "" || (window.localStorage.setItem(lsKey, id), n = id), id != n) return "session_id=" + sid + "&CustomerId=" + cid + "&fid=" + id + "&ofid=" + n + "&w=" + ticks + "&auth=" + encodeURIComponent(authKey) } return "" }; this.newXMLHttp = function () { var n = null; return
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 35631
                                        Category:dropped
                                        Size (bytes):9479
                                        Entropy (8bit):7.970142544062677
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:E54176EC19F380B4CF7CCEA00BEEDE15
                                        SHA1:B4AA6953332523557C3FED5177EE2DA620D05CC2
                                        SHA-256:0EDB2343465267301B283980A6388F72612339BAE4254E7FD702473E4D0C8B8F
                                        SHA-512:279158D0947E65553C429665E015C7210749A0CBD007FEC77725D23BAE3168A85F6E8BD9EA67DA478CEB4314936CA3319DC4E4A4A1B6A1B7FBA01F8D07A3466D
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:...........}is.F.......M^C4..............)V..!!"...J.H...F..F...[u].H.z....|._{.Q.K....rr...r.N9......1<.S.xt...p.qpR...<.0.s.>..q.$...J..$]&).y.,.o......B...L.?8.3e.e9t..<.R.0\.c..........0Zt...&.k.~.+q.G.+$fb.9<..WV1.ru..s..I....r.K.$[Ays.U!)W2.+a.....c..[.Q31M1c&......C.(.....A\..i....q..j0.....'.u.....3....<X...@`+...hf<.D..s%.."..!........Z9KI.$/........s...E..Z..K.D`.*<....b.(..R...,.....244....}M..U.y..&/_.E..*..d.%..9..tz....89...GVt.P.j.....@y.,H..s....A...G@...#tC....O..T....^E1.i............./....Uv>....]..um..b.X........M.1R...Fj...H%.a.T...H...0.tG..>..:..g...H...j.....+ld@........v)aU.d|.. ......i..%9Q/.....n.<...W..E.)g K...K.^A.e$..$.g........=SO..g~.5..4.....r.^..G<...L..O|..z<=.tt.n,..B..o.%..w0-.....W%..OC^P0......X(K.G...Ds..9B.!K.K(.......p...uy.j.~..(.....'W.z..!.r.\.X}W..8.\}/...#..k..."A'.'..$:.WK.. ....>.sN/...$&..+.....<?..i....?b......v99O..%.Y....|......k.F..J....8.I.s`.....*.....\....*...?&..U.d.......
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449314
                                        Category:dropped
                                        Size (bytes):122062
                                        Entropy (8bit):7.997628006210895
                                        Encrypted:true
                                        SSDEEP:
                                        MD5:5DD0373D317B10B8E25313C584237AB2
                                        SHA1:1DE07EE370EB05F8EBDB327173C319F136596EB3
                                        SHA-256:CFC90EC951487850187C9D0ECACB5BF875C0EB3D17B21F3BE21B5EDA5F10F5B4
                                        SHA-512:7CC915DE78545E50BBB0CDBDF0DBDE4FE8C5CACD35D070354F0752F58E70AD808120F4A4718F6AB14E1F3A96FED7928215FC111532ADB903CA3189199DA8F96F
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:...........m[.H....~...1v#\.....1P.6`.S.K1<..6jd.+........R.LU...=.\.laeF.EFFFDFF~.e....R....*...MepZ..|v}\.....\.n..'?^.6.....'.......9..*QX....Q<.b'eIe....T.q4....2..?..&..OR(4bA.\.Bu.W.r...rvU.C..j.'~...h.....J....*N.Qm.|....C.....}.\.n.%.8...e..4..!..^qbVIXZ.Gq...Q...R.P3.....O....i../.....9...Da.ZW:.U..-...F..h.z....'...4.v0=......^.f..'.b.T"..+....^a/3.H...$vBD.l.&..MY..<FEG...:......K.h6c..-U..'...R.3..F..Rm.fg.h..f.g=..,.>|....|Tw.../.O.'....08.......&..9.U.......h...l.J..Y..W.........A.......:py|...C.;Ve...]..!|Eq........q........]... .....N..dg....mr..F.j.0.i...X..I..!.d.....}......s..mo...<y....R..m.`.R .J\..*c=.*..6..c..F5x.......=........Z......K....e,.24D...\.o.Z..y.V.w....br@.mL.....e.".Z,.....B..T..S=....#...<my*z..z...[5.{q.*...E}C.[.b..&..-...1..Z...w..s..RO....m....k.I....+...Re....T\.8`g.0.F...TL}<..:Nt........`?....`Zb.S.S..}=$.;.Y.Z...n."..)}..+.{0...._..a-..L...I)U....+y..H..5.\.G..9.].z{.>',=...%G.7......@Z..2.(..%'<B...
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with very long lines (65439)
                                        Category:downloaded
                                        Size (bytes):90678
                                        Entropy (8bit):5.330858911989384
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:0BABAF1D46ACDFADC9FE4AFA5C0354C3
                                        SHA1:3407BD2EE6AFB10ACD3DAB966CF05C42FE4B1DCC
                                        SHA-256:23EF819E5C8868FFFB2C9C99201DA945887DE5ED5B260A81646BE624F681EBF2
                                        SHA-512:9FA77EC9B2E5D357DBFA1777362D883B1AB1970F3554110858B5A6625D1B65353864F0F3F3E17ECE65E1E55DAF1982D66D3927BEAC33755A014B37C1CED39F0B
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_8c01a5c09df43fd8d323.js
                                        Preview:/*! For license information please see oneds-analytics-js_8c01a5c09df43fd8d323.js.LICENSE.txt */."use strict";(self.webpackChunk_msidentity_sisu_msa=self.webpackChunk_msidentity_sisu_msa||[]).push([[471],{12278:function(n,e,t){t.r(e),t.d(e,{AppInsightsCore:function(){return qo},ApplicationInsights:function(){return ja},BE_PROFILE:function(){return Vo},BaseTelemetryPlugin:function(){return di},Cloud:function(){return Vi},CoreUtils:function(){return Hr},Device:function(){return Xi},DiagnosticLogger:function(){return et},EventLatency:function(){return Ga},EventPersistence:function(){return Qa},EventsDiscardedReason:function(){return Ho},InternalAppInsightsCore:function(){return Ko},Loc:function(){return $i},LoggingSeverity:function(){return Wa},MinChannelPriorty:function(){return $a},NRT_PROFILE:function(){return Wo},NotificationManager:function(){return Uo},PostChannel:function(){return qa},PropertiesPlugin:function(){return Po},RT_PROFILE:function(){return jo},Session:function(){return
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1555
                                        Category:downloaded
                                        Size (bytes):606
                                        Entropy (8bit):7.684173827328528
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:E9D4DB013D5154BF5DEA07A86EFDC826
                                        SHA1:3EC26EF21230B139585C8A4DEE0EDACF21E645D9
                                        SHA-256:1647D03E091826087EA981A97D69434D47CFE518EA4D41B09C198954F25E5D0C
                                        SHA-512:4B0D3FF26B2F6433DFA1CD2E285073BC54C4040A4CEFF0C6AF3F32EA90729AF22C0EBF53277D7201C5D793D65AD64F2AD19A1BF3F31A0ED3695380128A5D76A5
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msauth.net/shared/1.0/content/images/documentation_dae218aac2d25462ae286ceba8d80ce2.svg
                                        Preview:..........}TMo.A..+..u..x.+@JO\z..UB..i......3^.......[.g.,..........w...s.8..pv...u...U..y.<.V..}..._wc.|.o..?W..Lg#........p<n..r.-?.q.=...Y.!ANQ54....b..Ae0...\... .....Q.0.......2..~U.5.h..1o....<.G...C...jhZ.r..i.a*....19..$...[.!..+.2IW.....v.l....Y'.m'}%..I..{.\.0.d.D...X......cI].....7.k._..{|..\$...&..G..q.H...../.q......j....q..z.&.....X..sNp.N"1..h.`;j....q............C.....^...........j(. ..x.V....D.'.I...j@..(V.V.....!........!E.<..X-....R....U<.l.Qn.2..K.VP2UEtl#.,8..H..3..sp...(0.7....K...j..6.......M....p.E..d..((../..@.....&G...^.........z..............
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (23198), with CRLF line terminators
                                        Category:downloaded
                                        Size (bytes):23662
                                        Entropy (8bit):5.766464688428061
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:34028396B91D887DF3488FE2AF4C2AA4
                                        SHA1:D8DBAEAA07F40D3DD35F4DF2C4D93870C7CE5131
                                        SHA-256:E9338A016AE87EE507C1047F65302A5E78915BFE48797C1479A2A9EB6A997686
                                        SHA-512:0A58D41A45D580B146D2EC0AFC12EB62D5B6508B23DAD81E3508C852E7A885AC7FC4B0CDEF8B84FEE22A90C500F241FFE9FCE7D295A0F173ACE8DD9E1708AF7C
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://fpt.live.com/?session_id=2cf650ee83cd41819bfe62fda4158cef&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU
                                        Preview:<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>.. <script>var localTarget='https://fpt.live.com/',target='https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&',txnId='2cf650ee83cd41819bfe62fda4158cef',ticks='8DCC6C311E3002C',rid='659d35d1-363d-558e-dc79-1ff60babf950',authKey='taBcrIH61PuCVH7eNCyH0MJojnuUODHcZ6x9WoxhgCk2zmnVqU4VBLvSNxcZXSL7sh7rs%252bN5ihOuREloq5rR%252fYc4dRa24uNhlfBWc4imP5CfUm%252bO1ty%252bXfYC%252fKYZ8IZmvQgDxFXRkZiPH4piwwfu2HV%252fTKa%252fDa6u6%252fwdAZV67k7EKeIjkbA4unoI4J5IcGmminNyFGyldGIDQ7GRZTLgRKIgcgBZdkTNFGA69CZzntEeGLma9ebjVRsj8b6R01ywP%252by4Q%252bv7%252fCGBSKdZmVTXEaE9PG9I86U8jFVNHDPNGS9%252bI%252fSKZ6SUolCp01sEByMC',cid='33e01921-4d64-4f8c-a055-5bdaffd5e33d',assessment='',waitresponse=true,bbwait=false,commonquery='&PageId=SU',lsInfo=true,splitFonts=false,noFonts=false,UCH=true,PTO=100,rticks=1724782030078,ipv6Url='',txnKey='session_id',ridKey='id',lskey='MUID';(function(){function w(){var i=0,n;return t&&t.le
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
                                        Category:dropped
                                        Size (bytes):35167
                                        Entropy (8bit):7.9940882099284245
                                        Encrypted:true
                                        SSDEEP:
                                        MD5:157CD264060EC0AA768C58FA5E3BCD45
                                        SHA1:C11F015567C602806D9B2FAA5FB5C36ED15D2BF2
                                        SHA-256:5AA014AA67DDC6E040E1F60BBE3B7E810809759B561E391A9B8F84A93827E07B
                                        SHA-512:556C196743A9CF18D0F5EE8557ACBD4867DA253BBBFEFB9539E6C6CCF983351A9FDC3CE5209018771B72A2616AFB643DA914298FA5EC57EE1D5D871C27A68C21
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........:..x.>.y..u....N...\s...).......<?._.........%.jC..~..=.....O._j.h.,...O@..9.RN@.0.t>..K.....`......!^.......".~.........g.$:.O...b>..m.M.........y_p.. .....V..No...$T.;.b....[ ..z.....t...N.g5...._c.....I....l_.l_.."..._oz..^lM....hc..^l..-.0M..'[.....,...A....7X....O^...y..&.i.f.....lE nGQ=...........y$?.cB.+h..2...n).9.....kb.Cdg....^'...."..Q:^.z.j~.......
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 11507
                                        Category:dropped
                                        Size (bytes):3799
                                        Entropy (8bit):7.9513931487058125
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:3635AC9363D93B23B26ADD5AAE166EAB
                                        SHA1:099DE8A077021D5E0A6B8A0A2B24F666501E51D2
                                        SHA-256:7EA068B37353BD17886B576362CF36F7F8EBC5DD25BE47401926D0216F14801D
                                        SHA-512:5C9B2427C6D276E815B432A3B294C7377A6855F949D43399C48A2015DB5925E739491905A1DD23D3B8D1B0DA1C0F4205A540E2F590164035345680A1994D7D59
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:.............w........{.N.v]...II..W.Y.^..1..%..d..%...^........)X........k..I......]v..!..._....A..;....A...3.1.....1...........b1....n@.R...2.Iq.<.....6.X ...O.\.&....?.l|.C..h..CEB......[..0f$.}&..{Cr.=)b.WD2..1..../.....L...j..a.6BfXcM&..kp`~.}@...7.....% 4..a0..L.!.e...d"....<<....(.tp~..X..OY%1c&..b.....he..;a...........sr`8w ...PQP..[{..G.0.%...JD...........!7....nbb.......ssk.L..JE...9.j..,O.6}...7..[.....>?k...TW6.Hz....#..9.....K........Fl..88......c.;.>x...E.w..4.9.s.._..V..C...7_.....v?.=..`4..|..`,G.?....I..l...W&.q.I}....~.5....'._X......f....d>....3.......C......qJ.J...a.. b...... d...Q(.b....'..K....5*.fiG...rA.f.c..n/`.H...........L&1;..\. ..|.G.;9sG.vRH.. ....C...svG.0..!NX8`..,..'...D....{LG3f....^.....q.B.s..+I.....|.....D..;..!=...P.c.....%.-g.{.w9.D)$~.O.D..rD..Z....[n..#.q|...-.<>.G.$....BT.O.4EuO.../Y...uH&q..Pp....>.}z..../@.e..#.aG...9.....rU.C.9..N...1.>................4v._.0E.).\.8.....T.......?`F.$p?d^w....l..0...
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1072
                                        Category:dropped
                                        Size (bytes):501
                                        Entropy (8bit):7.533810358417031
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:BA297DB577E890A1F50C7F314593760A
                                        SHA1:D93F9FF0EFB410F657410C1F4CFA55B7BC13ABD5
                                        SHA-256:2B4308FBE02E743CE59DFED30712AA354299BC9357C2B81084BC325613283CD6
                                        SHA-512:7364B143ADD330317974EE1A92AA5D238FCD2013E30DD2CC568EA50A7DF856A6392BDFD07B59C79C34220C660338D6D40B48379C23E9CFFCD16626AFDF022601
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:..........}S=o.0....?..\...".P-..5C..Vm..m$....;G...(4...{...t.|.i.....s.v.~.....q.vz.........p...8v......w....e....O.OO....VJ.}......s.......:..)..p.R":dO%D.....0x.*;....*-..San......'....7.UQ....;....O..u.....f.....=..(.3..J.nX.A.*..|B.%.6..."p.E8.Y.u.RJ.P..WM.dkA.W..*P.a..........w.u<.6...<....R.&2..B*..S.bnX..H0....}.B.n..b.8.=..Z.cq./..+...:Z..1a..R7,>.`..p.....J.c.=g..<..(..*K.C.k...^7...>Gp.#$..x....w]x....:Z......./R.6.U.N6.v.,...Q.Zz.....:.5..'.B?..xuW........._V..'0...
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
                                        Category:dropped
                                        Size (bytes):621
                                        Entropy (8bit):7.673946009263606
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:4761405717E938D7E7400BB15715DB1E
                                        SHA1:76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
                                        SHA-256:F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
                                        SHA-512:E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x*...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E.."....*...x.@..?u......../....8...
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
                                        Category:downloaded
                                        Size (bytes):116351
                                        Entropy (8bit):7.9975788994031465
                                        Encrypted:true
                                        SSDEEP:
                                        MD5:FEDAFBAC6D003C0D0DCA6F46FC3305C2
                                        SHA1:19A766D07F77FB5A37435FB94001E6170382DF36
                                        SHA-256:15D89CD4219307695E0C0E02D0A852BCE5F1549DC1C48D0116ED05EEA0747461
                                        SHA-512:E7175F8E39F1AB98B8419FAC92619F1776F93225CEFDDE1A5E4629073677ADD25B2EA77AE113E64EB03A4CF7E58347872D81892DD31BDD0403D2C2DEBA421F19
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6c7dc46bb93924417b57.js
                                        Preview:...........}[[.H........-...."#<$!=.$...{z..O.e..<.pi....Z....,.I.>..L...K....W.....l.._.....r.r...w.S............`...b.E..7....v#>..~%.+.?..Y..1.*S..z.2..i%...,...A.U&^..G.|..UL...VN.0~...Z...Cm....`.......7....Rm...#^I.!.+wco0.|..a........n..(...&X..y%.qe...X..Q9.....-FT.:..............8K`..M.O..Z'....>T...$...x<....6...|.U.].&....f..[..dR..xX.....~?....r..>N.j....9.r?f0y.>.~.x..t.F.*<...Opm..;/....*..Q.._...n.:...f....q<...../.'.A0........o0.....O>m|.....\....zPy.L].Wm......S5.'0.........O.~....._...a7...;..7...S.l>..[.Y.....>;.C....j[0W>,.y9J.....g..x........._.~....g.b.......\...T).8^.<.ag.M`A..o4u...?.v....8....'......:q.6Y..]6...T}P..'!...,..d..F4....8|..]odVcK~.5B........*.i.u.,..%.c.7<..N..T../.f...o...N2.......:h.ew..x.bo.$...6.(..=z..........frk.F.7IB^R.z..~..u...A..>&<4......M.#(.Xt.......k...i.f...,C.q..bY..K#...^.!p..E..j....m.....}IX...7.k\q.z..G..X......y.d..\R.]V.......b.0.o....7..piC.../.px..j..r2.....R.j5m..s..Dw^
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:GIF image data, version 89a, 352 x 3
                                        Category:downloaded
                                        Size (bytes):2672
                                        Entropy (8bit):6.640973516071413
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:166DE53471265253AB3A456DEFE6DA23
                                        SHA1:17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
                                        SHA-256:A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
                                        SHA-512:80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
                                        Preview:GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L*..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;.*..\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:JSON data
                                        Category:dropped
                                        Size (bytes):72
                                        Entropy (8bit):4.241202481433726
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:9E576E34B18E986347909C29AE6A82C6
                                        SHA1:532C767978DC2B55854B3CA2D2DF5B4DB221C934
                                        SHA-256:88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
                                        SHA-512:5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:{"Message":"The requested resource does not support http method 'GET'."}
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 981
                                        Category:downloaded
                                        Size (bytes):542
                                        Entropy (8bit):7.5641293776931215
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:7569D6C5B45AB123E5B8150BB2B3BF22
                                        SHA1:3BE25A250F736FF3B3D809466659E3422C0A3B1B
                                        SHA-256:AA5FEBD7CE526B29249A3D558B4D0CE0021BB4338EE729AD6377A6BE2DABCA3E
                                        SHA-512:CF6721B1B8647705FEF5D18B6A3B0CF7474C3E8667F14C1A013782DD3B21EBB08F6E32052A34B8554FCAA9FC83AF4748EE29ED078AE98154DD047B979A350BD2
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msauth.net/shared/1.0/content/images/credentialoptions/cred_option_github_fa3dbea07d478da8facde73b44f90b02.svg
                                        Preview:..........uS..0.....J0x|w.....@.(q.*......;.ZU.....3W.j._...0.5....P........Z..yI..$......K...r.....f.....[.....u....x....:..r.._.....5...d..pM.f.2.|s9?..p.iP.sRi.-(.V.V...2..t.i.....`.$.X H...!(...W..[.. .<aJ*@..#.i....h.Z....!'2;Rm..0.`..W.FF..O.......'&....B.oi..:....T...'..j$p..Oo'bc.,......8z$...E...N..X......F..E.b+Hnb*B.k...<.3?O..'...<a....R..G.....8%...%q.,M.S...TT...|....F.D.(.RS.F)PF..t...C.w.].a...th.m1...f....|f.*.9%....C86...*..C.....,.4...}..0....s3..i..l.C......li.!..W......9\..&.x.......u....
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):244
                                        Entropy (8bit):3.928364668717964
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:FE333F0E45B438D9FF6739F3CB61B799
                                        SHA1:57BFE14D0C53DDFEAA37D1E9EEFA9082E7477751
                                        SHA-256:8411B0A349C294D6895BCC8D32BC5451214CBCF8EC1351B0486B98A6C6CD94AB
                                        SHA-512:66DD43C276B197A794D90B142F0158982E94259C1574265974CF870CE6E454914AD3CE3899F63E6EEFBC8121CBB2C16CBAB539B32A1F647DDD6442F3838E726E
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:fe0cf376b1591ea9ebb435f2230a867996ebdbfa0b1994905da2b0558728fa9471552e6a57e808498bc240595a959521b25a18121f3526e3990068880f7a914ed5857f9f762501e621f4576cdd980092f87097dd6c8d3a5304275c3d3f021e5b5f378547883818014a093a52cdaeef24baab9a70f2828b0147b1
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with very long lines (12836)
                                        Category:dropped
                                        Size (bytes):433280
                                        Entropy (8bit):5.340144332774555
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:FADE4A42818F49A4FD1D40397A989635
                                        SHA1:7155D485E29EB263CD0ED66B8D1E18DFCF87C177
                                        SHA-256:88D224ED1D81E5356D5B97E2B9C7999FB83151AD5D3E63E165B5673F5F5FC903
                                        SHA-512:224E4F5C2591C7AACBAA689015F202AB8AF565B713AA94AC0B0588F5291F02AD1F36154622058890B4449B2EBC38FF0D84B1D032E1D1FE76C0FB60627A523D34
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:!function(){var e,t,n,r,i,o,a,s,u={647410:function(e,t,n){const r=n(702557),i=n(45984);window.$messageFormat={...r,...i}},911683:function(e){const t=[];e.exports={loadPolyfills:function(){return Promise.all(t)}}},758758:function(e,t){var n;n=function(e){"use strict";var t=document.createElement,n=0;document.createElement=function(e,r){var i=t.call(document,e,r);return"template"!==e&&(i.elementTiming=n++),i};var r=document.createElementNS;document.createElementNS=function(e,t,n){var i=r.call(document,e,t,n);return i.elementTiming=1,i};var i=function(e,t){return{name:e,value:void 0===t?-1:t,delta:0,entries:[],id:"v2-".concat(Date.now(),"-").concat(Math.floor(8999999999999*Math.random())+1e12)}},o=function(e,t){try{if(PerformanceObserver.supportedEntryTypes.includes(e)){if("first-input"===e&&!("PerformanceEventTiming"in self))return;var n=new PerformanceObserver((function(e){return e.getEntries().map(t)}));return n.observe({type:e,buffered:!0}),n}}catch(e){}},a=function(e,t){var n=functio
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:downloaded
                                        Size (bytes):20
                                        Entropy (8bit):3.646439344671015
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:F79FFC1767406D43B996B050CEC09ED2
                                        SHA1:EA4F919251BCDE6EE3CB2E45C0356E1FA3B86661
                                        SHA-256:1E62D5B3EFE0ECE892FF79BD65457FF2DC48A840444AFD53DEEDF2F2869BD685
                                        SHA-512:1B4C7C09D52BB2D26F505C148FD92B987AD680E675E7496EB8E92279F750587EBCE45DECD718CBBDFB91A4CEAADCA14AD918C4F8AA7971D199593C82C31BB92F
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAnAwrJpDUzjsBIFDdbBmF8=?alt=proto
                                        Preview:Cg0KCw3WwZhfGgQIZBgC
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:HTML document, ASCII text, with very long lines (918)
                                        Category:downloaded
                                        Size (bytes):1233
                                        Entropy (8bit):5.4604704891374
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:5DC258F6742F6D22A4CD80F50926ED70
                                        SHA1:2925F965C31990E0F883E2E885A3D57056168DCC
                                        SHA-256:3B8D3C93FD78C24F4C175C8515E4A5DF79AEE536AF4CED58BA078EA591569EAC
                                        SHA-512:BB63B3078587A823CCBB2314EFF3CCC16B20A01AC717CE37289DA8B5118E5053F867CE62256CC1C9466A7E2CBF60C854F4DEA68A060D67CC51BAAB17179E140C
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://msft.hsprotect.net/index.html
                                        Preview:<!DOCTYPE html>.<html lang='en'>.<head>. <meta charset='UTF-8'>. <meta name='viewport' content='width=device-width, initial-scale=1.0'>. <title>Human Sensor Script Iframe</title>.</head>.<body>.<script>. var a=["_pxvid","_px3","_pxde"];function b(a){var b=new RegExp("(^| )"+a+"=([^;]+)"),c=document.cookie.match(b);return c?c[2]:null}function c(a,b,c){window.parent.postMessage({type:"cookie",name:a,value:b,expires:c||new Date(Date.now()+31536e6).toUTCString()},"*")}function d(a){var b=/^([^=]+)=([^;]*)/,c=/expires=([^;]+)/,d=a.match(b),e=d?d[1]:null,f=d?d[2]:null,g=a.match(c),h=g?g[1]:null;return{cookieName:e,cookieValue:f,expires:h}}function e(b){var e=d(b);-1!==a.indexOf(e.cookieName)&&c(e.cookieName,e.cookieValue,e.expires)}function f(){try{var a=Object.getOwnPropertyDescriptor(Document.prototype,"cookie")||Object.getOwnPropertyDescriptor(Object.getPrototypeOf(document),"cookie"),b=a.get.bind(document),c=a.set.bind(document);Object.defineProperty(document,"cookie",{get:fu
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:ASCII text, with very long lines (65462)
                                        Category:downloaded
                                        Size (bytes):901881
                                        Entropy (8bit):5.410167245313691
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:8639D65267E6FA9394C585D6314BF563
                                        SHA1:9EA0DB27BFBA586E8FF6CFF25520F89EB7FDFA96
                                        SHA-256:B9CC042A61246B855AB80717F5A24E9435E94C2208D7C16AACF6A3E77B2F899A
                                        SHA-512:A0CB2DF4CAA275F43614932F65853AB1E12223CBD76F9CF31D37EC3ECFF6E66AB32894436EAA63E315AF8F961106CC211E17ADC2EB909DBCA4CBCFF6B8772707
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://logincdn.msftauth.net/shared/5/js/signup-fabric_en_hjnWUmfm-pOUxYXWMUv1Yw2.js
                                        Preview:/*! For license information please see signup-fabric_en.js.LICENSE.txt */.!function(){var e,t,n,r,o,i={95135:function(e,t,n){"use strict";var r=n(32951),o={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},i={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},a={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},l={};function c(e){return r.isMemo(e)?a:l[e.$$typeof]||o}l[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},l[r.Memo]=a;var s=Object.defineProperty,u=Object.getOwnPropertyNames,p=Object.getOwnPropertySymbols,f=Object.getOwnPropertyDescriptor,d=Object.getPrototypeOf,g=Object.prototype;e.exports=function e(t,n,r){if("string"!=typeof n){if(g){var o=d(n);o&&o!==g&&e(t,o,r)}var a=u(n);p&&(a=a.concat(p(n)));for(var l=c(t),m=c(n),h=0;h<a.length;++h){var b=a[h];if(!(i[
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:downloaded
                                        Size (bytes):1864
                                        Entropy (8bit):5.222032823730197
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:BC3D32A696895F78C19DF6C717586A5D
                                        SHA1:9191CB156A30A3ED79C44C0A16C95159E8FF689D
                                        SHA-256:0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
                                        SHA-512:8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://logincdn.msftauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg
                                        Preview:<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
                                        Category:dropped
                                        Size (bytes):673
                                        Entropy (8bit):7.6596900876595075
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:0E176276362B94279A4492511BFCBD98
                                        SHA1:389FE6B51F62254BB98939896B8C89EBEFFE2A02
                                        SHA-256:9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
                                        SHA-512:8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q...*..~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1.....*.#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:GIF image data, version 89a, 352 x 3
                                        Category:downloaded
                                        Size (bytes):3620
                                        Entropy (8bit):6.867828878374734
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:B540A8E518037192E32C4FE58BF2DBAB
                                        SHA1:3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
                                        SHA-256:8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
                                        SHA-512:E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
                                        Preview:GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L*..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.)...*..!.......,....`.....9.....i..l.go.....H..*".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H..*.-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401
                                        Category:downloaded
                                        Size (bytes):20414
                                        Entropy (8bit):7.979508934961097
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:48981D3CF57E7C58CA7E3E851EF9354E
                                        SHA1:73593DE7633B10F9FFD0EF0E46280FA40FF433FF
                                        SHA-256:8A5E756923CC5C3F013862427B7622F58A52501C5A6017FFF2FDB2AFD94A10C2
                                        SHA-512:4E2B6EA222CE77E6EC12E059362DDDEA13758CDC77259FF5CF449BED5A1677E112CF49CD7ED7B1378F96FFD7C5E21BE66D2CA7EB2A9CD8026732F867FB5AE8B1
                                        Malicious:false
                                        Reputation:unknown
                                        URL:https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css
                                        Preview:...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.*V5)/wE..Y...gy.0.*(.*-o.e.|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....*]..6(. ..D..*...Y.......:.ve.?..!..|t...].+.......a.......|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u.*.z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~...*..n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{*.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:SVG Scalable Vector Graphics image
                                        Category:dropped
                                        Size (bytes):3651
                                        Entropy (8bit):4.094801914706141
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:EE5C8D9FB6248C938FD0DC19370E90BD
                                        SHA1:D01A22720918B781338B5BBF9202B241A5F99EE4
                                        SHA-256:04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
                                        SHA-512:C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 56391
                                        Category:dropped
                                        Size (bytes):16112
                                        Entropy (8bit):7.985400770185779
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:466F92DF115AB60E409B52CE9AE7D7F6
                                        SHA1:C66FD8D11F68C34620AF2B168FEA53F5DE4E7E8D
                                        SHA-256:9EB3C48D42144538117B643972D5ADEBE31997CFE7F046C73FFD9742D1AF6DE0
                                        SHA-512:8C612F7F841450282ED43518793D3C361B2ED3BB4565E124E53D68AB2530C48BEF9A8E027713956591332789EAC25448F20E7499D3386E6DE4779641383532BC
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:...........}Ms#G.....uh.O=.>...4..p.O$...P.IF4.".K....1..5.......7.|.....S6..w8?......9.j.B1DwUeUeeeefef..f.Oc/._..G.............{..._..%.q..q........j<.w..O.7..."pgbV.C..k.T`..X....'v....<p....I.'..k<j@Ai..NP.6<.w.(...ey.....i8...._V.h.~.{Y....`......6..(.=...wC......es....;.~.....+../.b.E..G.:....(....'.K...&..p2...zu..w.&.?w..b2...F...7...p.M. .n.;..k?.:......i../.M..1Ah...'N]..Ll@..p... ....:N.."*p.. Xx..cL...O..7.z.O.^......s.O..h..V...|1..@.....XL....o..X/by..C..,......0.~$........._.......Z.._...~U).....j...C..`.."..t.z.-..m.]..3y...S@...'.KSzS...4.b......`.....K.[.&....._z..eF.)......'L"..E4...R.._$t.V......=.k..dv.O...b_...8u#...P,a......T..ks........f...?....X..E.."f@a.fn!$......U..B$B...\d........t*......w......\?`q..........0..(...C..!..=.xk....(.w.O..".!b.4...t$g..r...7..|.....m.;(..Y.....V...Y........._a.7./..........y0u...B.TH...].k...^..sOf.2.2'....Ra$.......N........n..#.."...3.."D..)...[...H......vwT...Jh.^.(.....s...e..?....
                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                        File Type:MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
                                        Category:dropped
                                        Size (bytes):17174
                                        Entropy (8bit):2.9129715116732746
                                        Encrypted:false
                                        SSDEEP:
                                        MD5:12E3DAC858061D088023B2BD48E2FA96
                                        SHA1:E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
                                        SHA-256:90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
                                        SHA-512:C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
                                        Malicious:false
                                        Reputation:unknown
                                        Preview:..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""
                                        File type:SMTP mail, ASCII text, with very long lines (459), with CRLF line terminators
                                        Entropy (8bit):5.846232890893116
                                        TrID:
                                        • E-Mail message (Var. 1) (20512/2) 100.00%
                                        File name:original.eml
                                        File size:353'268 bytes
                                        MD5:426e14bc8b37577e68552ca43d14e899
                                        SHA1:7dcd2850e04c2de58b3e50f6c19a7b5f9a0b24fb
                                        SHA256:de4d7dda39c171757639530f591fca99f716b7867bd331d61c18b99824cf55f0
                                        SHA512:bae09a6b0d713a50c6cfebbc56df8a2b4835142b4c0518d30965b037f690db9bd2eac6be89212b40101bc7160bdd85d913cb38463bf7e3e4645312980c6b5fae
                                        SSDEEP:3072:XajouVcdzfvWI8rvaIQfuEsYqKNt2qdoEyJ2kX+KRJZm6Y3/v1cP+TqcVdfW29Fa:XayzIaJiWulTP+Tq+dVTzzd9xpFjE
                                        TLSH:AF743C9395C33AB8D4D4DA089C6F6AB733281F8521F114AF462D17914EA1FFA7AF02C5
                                        File Content Preview:Return-Path: <randy.norton@us.tel.com>..Received: from APC01-PSA-obe.outbound.protection.outlook.com (mail-psaapc01on2043.outbound.protection.outlook.com [40.107.255.43]).. by inbound-smtp.us-east-1.amazonaws.com with SMTP id 0a92losofirctc1c4qc4fqo0iprtl
                                        Subject:[Phish Alert]Your Microsoft order on August 27, 2024
                                        From:randy.norton@us.tel.com
                                        To:telgreport.phishing@tel.com, db882d80-4f03-4511-be8c-78fdfd0ad442@phisher.knowbe4.com
                                        Cc:
                                        BCC:
                                        Date:Tue, 27 Aug 2024 15:03:30 +0000
                                        Communications:
                                        • You don't often get email from microsoft-noreply@microsoft.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> Review your order details. [Microsoft] Thanks for your Microsoft order Thanks for your order on August 27, 2024. You can manage your subscriptions in the Microsoft 365 admin center. Go to Microsoft 365 admin center ><https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3F%23%2Fsubscriptions&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1ob21l> Billing information Order Id Support Helpline : 1-(888) 299-0417 Billing profile: 14291 Rios Canyon Rd El Cajon, ca, 92021-2719 0dd6b43e-5425-4c67-d7dd-50c0f08af0ca Cloud Your order items Quantity Unit price Price Global Microsoft 365 Business Premium 1 $792.00 USD $792.00 USD Subtotal $792.00 USD Subtotal does not include any applicable taxes or fees except where specifically displayed on the invoice. Please see your invoice for the final amount. Additional resources * Learn how to understand your invoice<https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcommerce%2Fbilling-and-payments%2Funderstand-your-invoice2%3Fview%3Do365-worldwide&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD11bmRlcnN0YW5kLXlvdXItaW52b2ljZTI%3D> * Learn how to pay by wire transfer in the Microsoft 365 admin center<https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcommerce%2Fbilling-and-payments%2Fpay-for-your-subscription%3FredirectSourcePath%3D%25252farticle%25252fff4d9218-09b3-4fb5-a622-43866e133feb%26view%3Do365-worldwide%23pay-by-invoice-check-or-eft&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1wYXktZm9yLXlvdXItc3Vic2NyaXB0aW9u> * Learn how to assign admin roles<https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fadmin%2Fadd-users%2Fassign-admin-roles%3Fview%3Do365-worldwide&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1hc3NpZ24tYWRtaW4tcm9sZXM%3D> and set up your organizations accounts payable contact as a billing admin * Learn how to cancel your subscription<https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcommerce%2Fsubscriptions%2Fcancel-your-subscription%3Fview%3Do365-worldwide&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1jYW5jZWwteW91ci1zdWJzY3JpcHRpb24%3D> Did you find this email helpful? Yes<https://nam.safelink.emails.azure.net/trackingfeedback/?p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmZj1Qb3NpdGl2ZSZiPWVuLXVzJmE9OC8yNy8yMDI0IDEyOjIxOjQyIFBNJnU9YWVv> No<https://nam.safelink.emails.azure.net/trackingfeedback/?p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmZj1OZWdhdGl2ZSZiPWVuLXVzJmE9OC8yNy8yMDI0IDEyOjIxOjQyIFBNJnU9YWVv> Privacy Statement<https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Fgo.microsoft.com%2Ffwlink%2F%3FLinkId%3D521839&p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1wcml2YWN5LXN0YXRlbWVudA%3D%3D> Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 [Microsoft] [https://nam.safelink.emails.azure.net/trackingpixel/?p=bT05ZjZkOWVjNy0xMzk0LTRjNDQtYWI3NS03MmQ2ZGMyMjJhYmUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8%3D]
                                        Attachments:
                                        • phish_alert_iocp_v1.10.14.eml
                                        Key Value
                                        Return-Path<randy.norton@us.tel.com>
                                        Receivedfrom SG2PR03MB6729.apcprd03.prod.outlook.com ([fe80::9e8d:37ff:e00d:b64b]) by SG2PR03MB6729.apcprd03.prod.outlook.com ([fe80::9e8d:37ff:e00d:b64b%4]) with mapi id 15.20.7875.018; Tue, 27 Aug 2024 15:03:30 +0000
                                        Received-SPFpass (spfCheck: domain of us.tel.com designates 40.107.255.43 as permitted sender) client-ip=40.107.255.43; envelope-from=randy.norton@us.tel.com; helo=APC01-PSA-obe.outbound.protection.outlook.com;
                                        Authentication-Resultsamazonses.com; spf=pass (spfCheck: domain of us.tel.com designates 40.107.255.43 as permitted sender) client-ip=40.107.255.43; envelope-from=randy.norton@us.tel.com; helo=APC01-PSA-obe.outbound.protection.outlook.com; dkim=pass header.i=@us.tel.com; dmarc=pass header.from=us.tel.com;
                                        X-SES-RECEIPTAEFBQUFBQUFBQUFFaENpdXlHSTVxb01DeEpSaGlRTkcxSDZqY0VQL0IxZ3plM0xyVXNjY1kxVEE4all4T3NucFkvUDF1ZUdPT3dxVC82Z3JKRlZIVUpMVkdGcW1Bdm9LMENDTUY4K3lLdDliaGgvS1VlcWJMQWtDTm9rYTNkczFkQUIySWlEdzZWWFRYend4U0hLUW8vTGxUa2JsK0F1MXNkUGJOcEY4dGtOVnJPS1BJbG1aeXdrbkxpSVdpa2tNS0FhUDB1NDQ3NTBZQjJhZ0tYTmFkWmkvMSsyb1R5a0sxRklUcElyRnE0c1dQZlBHRERzc3d0c1pvTG1zMitPSjNQZHdQbzhOV3dQZURac1AybWJ1QmpZbnRNNlpOVGVscmVZWkMyUEV0OWNxRitqRTVkY004MmdQblJMQ084UTVpbXJaOHJHanVOVzg9
                                        X-SES-DKIM-SIGNATUREa=rsa-sha256; q=dns/txt; b=Jq53s05Gxo1XhUZ927WqVCHp6gyRF8FHVW4kWtdkCx4wfTCfnr3dNlvUEAf78LWhQW7RsmqCAMlv1+fWbYJ8ooFOGdtt0BBHQkPilN6mKbhSDwCRXc8VrjQa+xLGwu9U8VjaNMP9EtsUrG6PpBWt1bAeMs56WkYOcDmuTGfQdKY=; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1724771021; v=1; bh=GQHV7q+gFZtuT584RNoLXvegHb4tO+Lvwo792qTBAfY=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT;
                                        ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MXckwCnFTqi6wQNaCm8C35gcpzenI15Dwoq7EuXSc/LvBBdWR1cHpoqzy8j8GKFK08ybe+cHfFHW3MiLO1QlDeQUz+DqSoobKF7XbSn++MDbAODTYfMFUPVHom6KKM9v2uihjsSLw1aySeH1ZhtrJFFrr+dXEXsMqouH9XeGkIJwZvohu1NxfW7we3MzLQqWooPhm5haPfqu/RHQxS7Gyd2rv4X3gt1Vq6Jgzq535p3O0d4DX9UIK1c8i5tMtcfKc2naGW+8LSiwv+7hPhwGqZeS3KHCMcUS6ZfEzdFi3GC1W3UIFo4UACmOFvaQ2yWgOMCLB07jvkFW0efNccCvPQ==
                                        ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=sbmZ/zkVZLX8s6wb/Do3dv8c4n2nA7fc02ksnykDVQE=; b=gWA5+qrYpaXxDMDoDc3P0O3DC6gOnWvPPHbKRG6lzW1TPXRBVMMvNCnD4gmHN3qNrXC049a9ShGYshWIS/G3wlIvGiM1mgOkKQLAdOuPA1nRNJ4Oh8FLFlyK8DWbO1aJTyvSafyEAy4Qvs1kkSU4Xi0+XPjO3XGaUykPbqRAsI2RBhR3YQO2Mh9XApjfdTrsUoerzIq3OTptKP1UtfqVzdnRL4stRJ+ApLuMaUjju1WtnlcY/cVJsWJeSovEGozupx+q0jturYBU5nX7Z2MMgcN1iyATRcFfnmBh0TOotkwOhP/YxFc5BFHWgvnS1UAGyqg8Dd652thPLXpjK9QKbA==
                                        ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=us.tel.com; dmarc=pass action=none header.from=us.tel.com; dkim=pass header.d=us.tel.com; arc=none
                                        DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=us.tel.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sbmZ/zkVZLX8s6wb/Do3dv8c4n2nA7fc02ksnykDVQE=; b=REIP1MFgRY0pGLUVhVN+hyjCXlC4N2z49PZ7b9XG0OIn8Bu7CTSyp0ea5xvqqSsobAJ6XQ0zdcCafNGFBpgQBOGSA0LUlDenboMaAZQJZyKqePpnvWZItBmcLo0J5EU8avn1Vh20aRu2rVcEQGy8EZbRjjcxq7hAECRiEncr4+k=
                                        Fromrandy.norton@us.tel.com
                                        Totelgreport.phishing@tel.com, db882d80-4f03-4511-be8c-78fdfd0ad442@phisher.knowbe4.com
                                        Subject[Phish Alert]Your Microsoft order on August 27, 2024
                                        Thread-Topic[Phish Alert]Your Microsoft order on August 27, 2024
                                        Thread-IndexAQHa+IZICWtzJoemxUai6cgteztCjbI7M2CA
                                        DateTue, 27 Aug 2024 15:03:30 +0000
                                        Message-ID <SG2PR03MB672906FCA28EB0C39BE8BF5FA8942@SG2PR03MB6729.apcprd03.prod.outlook.com>
                                        References<9f6d9ec7-1394-4c44-ab75-72d6dc222abe@az.westus3.microsoft.com>
                                        In-Reply-To<9f6d9ec7-1394-4c44-ab75-72d6dc222abe@az.westus3.microsoft.com>
                                        Accept-Languageen-US
                                        Content-Languageen-US
                                        X-MS-Has-Attachyes
                                        X-MS-TNEF-Correlator
                                        authentication-resultsdkim=none (message not signed) header.d=none;dmarc=none action=none header.from=us.tel.com;
                                        x-ms-publictraffictypeEmail
                                        x-ms-traffictypediagnosticSG2PR03MB6729:EE_|SEZPR03MB7443:EE_
                                        x-ms-office365-filtering-correlation-id7afc76ea-a9c1-4763-5dad-08dcc6a969d1
                                        x-ms-exchange-senderadcheck1
                                        x-ms-exchange-antispam-relay0
                                        x-microsoft-antispam BCL:0;ARA:13230040|69100299015|366016|376014|1800799024|38070700018;
                                        x-microsoft-antispam-message-info ch221g5SxKXwD6HM9sCieDCZ8Bug0TNouBIyycQcDrtTmoWaKIdRfarkHqx82wvlJ6tlzQ//sMVzTyGSgxcHdPEOz4Vh429vgxafSa91qiv/K18kIr8311BY6lyBtvjvy9sDEG0i0GLYVXma6iV0ct8xA9U2rPc7Qm+0pUYSF2H7O3JdJeEglAEa9n3St3qBFSCRKQCTTVrmCy9FrhfB+PqrYuoyHux+owPe+E6AMS8rfZOFOdnyynAVGxxM/flSjW8TCQoUPl+2KJpIYebrk+NyKaLaow+uv7V/nQr6VsoN9OcpxfhugHSRtOwjecVLomLyCamEyK41PJPoGtRlVBaC984kKpnkB9iS/V3Jv0C8z5aXWSWtanzuZNCKu0ShKkvOMylSugHL0SGPKoujABYshXGc901UWW6RHrkU0zEv8TD1tqr2s8NBwHIknpg1/ixvbPbhbG1AoKYiXSlOnlE+wR8dj7NFWtrUfXKD9a5EqXXkCS64AQktqE2scFFcSn9teajjiQsuPvT82dj0cPzIiRea6vpVa656eTvTqVfqcof9nNPp9+pQVzYSQNH292eeTI9jVBUysT9A0goaCPyz9VYqBVcSDpO9P3WMEPPztXaX2LqbQK7FSmNL36W/6C/5c6eNiX/3G/EgrujUJpSS7TWShxjy5gRg0Pcj0s9/FsbEeWp2IYwTtNdUt2dssvJk7e5jwq/nXLwn6N/54R/KGPTDyoCSb3E3sSc46UCJoGAdYPU5GulueuvPVqlS1iLOstQjm87MDxooQo6SNg4G+natR1UipbdiCzJQVdmAmjj+3xToZ2GIfn6SRN4fPjozMvo5yRw+Yh2M6RBZWNV9YGTd34+67AowaA1ISnkw5OBGGmpNB4gAlONYYZ7PJ7aQeBPBOxTeIg6YSllq2dBvvG7VYTMTK9t+stwDNHKeS3V3jHSYwj7madINNBm9aNi75YhhJu+9ncQPQ8JFG+5ygP1/4Pzy7WKz4V/0aSRJf3PLN5DfDJMDUkQjIQzmCVKe31I1bibNC1twqAkAx7+GpwbfO5CN9RaBorJmtELR+LtYVcSaj4LUIj8hozJWmgtu0wJv7rM+fAqmpA+EHy6UCvR3mLIfiHsz/EpYAtg/NiBfseG8dtnQ/QCNa0ssLHyhcs2yi4mks9GXNdqk3ViRHaSuTiNKXITX29nuLs4FTpFg7IQpHtEN2avRYSAO90kQSCaWtE0Gg1+21tDc1VsKuhkSpHyyJy9WUqMwe0f4Ne3en7XMA2EGscd/dtDrHVT7v2njS96w3G5JNYg4vlK3kP2TC8MrXw+8FDC68Sg=
                                        x-forefront-antispam-report CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SG2PR03MB6729.apcprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(69100299015)(366016)(376014)(1800799024)(38070700018);DIR:OUT;SFP:1101;
                                        x-ms-exchange-antispam-messagedata-chunkcount1
                                        x-ms-exchange-antispam-messagedata-0 mRFE1U2rMaw7ssxBGmPihK5cprfA3QdjusgEK2Tux4mVs9wen7k9EJvYEwfVuAJYEXFtW+hhjJModolpRLUeu6qSd3Ku0/pPu9DwopXOxh8VFJJKyUtVVuxavQRl0O3H0DunNtT8BqK3Pm/Hxr1UfWfe5G0SMXyFyLcRd9LUOfpzfLcuVh5HbatA1gyfGNb8LQ3F2GrL3GMK/m5m+N0c58WlixqgZSMt6dpPCm2CoCa6M79EnTyXSnhPbYUpL5iv1YZ26qtW3gBEugJ4LMSFZl5I49mRdDyW3E06/VRSzILMwaskaxKhX4dnlrUzz5Kd7qCIlLcqZ+ITYp/XcPLqFEz92WDW9TQB13eHL5oOjuO6qVuMCrovS6t8AxAU09J/DcLvthG7DRGLQDge8unRJMIYTa0BMekZ9fPRiWIV8vCpFMuSIXEjj7fyAZHO4hOLmBcAQ92OxD8ZuIv5U6DnJq3TZbFT+SvPr4E4uUd4XKI/TA8LR+xRJbRBl2XOOqcFm3Iyd5Sf9ccYe6/P9fwcy982hCd1BmYlRTsxYSg0ACiXM58OA6mGHLISwvhnx7rTK2wvQyaBr/b5vUztTzEt2vJ81uqHeRCvhbLlbSaORcfMc+SC0AG2srFhh22qKb1Hhj518P1dhe3THsIzmNz4pIRufAw9mfDjtClENLazUoDGQnvquAI+RsFfbjFeJp4QQVeY9/nA+xXVsATzlXG1Cp8C/MhxoaRwb6XpY2oX6d/NOvPyhu2jscVDPlkxR32V7NW/cA4UVGFkE2e1cTpvzzGp5Od2KSyhhsmfOe3WFDMNg62jhCnH6dNlnaq7uvGp633U0v6+k/YfYouRcVaZY1+9amuUqbSw0Mznou/m6hoy5hDUUZBU9HDQDdttNhcPAsw0EGulm84V61Wq5o5d2vCdAAygPfQqj3elcQScOq8OwH7fMsfiEM4ZhCVb1aEmEAhYlr6mCDJbaYco6RZqqd7JtPspGq4Tu31uB6V2K3ZQ3D6trN41oBaCbqfAoYMTMtAXLxeXpiOuToVetrUxyyyL/GIEakeWqO/dTS/I1Xdd3JTqa6BP8lqv0NaSfHvdu+VVs3DSbegj7VzsOagMg02SUSmWcj2tnstPHmM+7NQzuEsongAhKollgnPuB0TPPzV1SxsNyk9jpi/m4u00r4gdQ+pfuMWgCbOQM768mRkjuLfqdEI1BJu9h1GFkq5XP8hzojsFHDDa9Mae7M1hDgXLIeYqOF6jzN+/vvjTwfjwib2OQAgA0F7bskeC/x1V4jSyNM+wo3IXe6ekn2flwV+2bIVQTEkgE+T0+zGB138/PCCqZL03IZ9I2Qz90vZKgYjIXfeEUyf/6WvDd5jWnx/yYbfhitYo/fo2dS9UfTrynkLFOlgen6Z0p31Pp11q0Oks8YBtEiM/0+cQLcF8s+WiwPL3sUbkli2h5s/bhIoUBuFFkny+xhQE+qPickrClFHXo8wlUsQM34ogyc8H9XsludTM13NJLiFQCqegZa5UF4MYM2XWuaVGo4Sf8qO2741vBsj4VXhjAkGYTmSDXBVIl7ANaU163vCWg4KvEb5B60dnVflaNrujTgOtVq2Q
                                        Content-Typemultipart/mixed; boundary="_004_SG2PR03MB672906FCA28EB0C39BE8BF5FA8942SG2PR03MB6729apcp_"
                                        MIME-Version1.0
                                        X-OriginatorOrgus.tel.com
                                        X-MS-Exchange-CrossTenant-AuthAsInternal
                                        X-MS-Exchange-CrossTenant-AuthSourceSG2PR03MB6729.apcprd03.prod.outlook.com
                                        X-MS-Exchange-CrossTenant-Network-Message-Id7afc76ea-a9c1-4763-5dad-08dcc6a969d1
                                        X-MS-Exchange-CrossTenant-originalarrivaltime27 Aug 2024 15:03:30.6725 (UTC)
                                        X-MS-Exchange-CrossTenant-fromentityheaderHosted
                                        X-MS-Exchange-CrossTenant-id8c433003-a081-4dfb-a631-100526250b1a
                                        X-MS-Exchange-CrossTenant-mailboxtypeHOSTED
                                        X-MS-Exchange-CrossTenant-userprincipalnamep4KOyI8ZaQfCXc8gi7uVoTjzQrghevQZdqqQu9OSrbcSoEuRNdt2m5/qMZjPJXx+YhtkjkjCpCcp1zRFnlpUPw==
                                        X-MS-Exchange-Transport-CrossTenantHeadersStampedSEZPR03MB7443

                                        Icon Hash:46070c0a8e0c67d6