Edit tour

Windows Analysis Report
Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg

Overview

General Information

Sample name:	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg
Analysis ID:	1431736
MD5:	42a70648a68852fea223bee03fc07a42
SHA1:	50235764f2153d62e5be5e65202b4f77c5f96366
SHA256:	e7d97fbf0f1620b5e344bdd335bad70f7ec11358f34985d8535791b1d976d767
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Suspicious MSG / EML detected (based on various text indicators)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6904 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 3600 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "CFC65EE8-BB3D-4D69-A327-1E40894691F5" "AE8AF95D-F4FC-4F52-9834-BFE80F7520C5" "6904" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 3552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Signing/EmailStart.aspx?a=1682d2ad-3aaf-4e04-89e5-6f16ebd523da&acct=38ccb707-084a-4cbb-99e2-bfa5ea43e517&er=46fcc958-3af2-49ba-80fe-97ac29c6e84a MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6628 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1848,i,14491747394357505162,9509817759995701411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6904, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: This email originated from outside of the Federal Aviation Administration (FAA). Do not click on links or open attachments CAUTION: unless you recognize the sender and know the content is safe. docusign Serdentriss Stokes sent you a document to review and sign. REVIEW DOCUMENTS Serdentriss Stokes serdentriss.stokes@faa.gov PRIVATE MESSAGE Good day, Do not forward this email. The information contained in this email is privileged and confidential. The information stated is not to be shared and is only sent to those in a need to know position. If you have any questions, contact me, your intake specialist. This is notification an individual has entered the EEO Complaint Process; please see the attachments. You have been identified as the MOP, Management Official Primary, who has authority to provide a possible resolution. The RMO, Responsible Management Official, who the alleged complaint is against is Arnold Angelici. After reading Notification #1 , please sign the "Acknowledgement: Receipt of Informal Complaint Memo." You will be contacted by an EEO Counselor to discuss the next steps. If you have any additional questions, please do not hesitate to reach out. Good day, The link contained in this email will provide access to a document packet via *DocuSign containing counseling documents. Retain this email/link to access these documents throughout the counseling process. *Creation of a DocuSign account is optional, it is not required to proceed through the process Please review and take appropriate action on the attached material and contact me if you have questions or concerns.

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.11:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.11:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.11:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49746 version: TLS 1.2

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.11

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1Host: a.docusign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOGYxNWQ1ZWNhODUwMy0wM2JlZTgzYjhiYjgyMy0yNjAzMWU1MS0xNDAwMDAtMThmMTVkNWVjYTk2N2QiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJtcF9wYWdlIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1714058292399 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOGYxNWQ1ZWNhYjc3My0wNmVjZmFmYzYwZGQzYS0yNjAzMWU1MS0xNDAwMDAtMThmMTVkNWVjYWM2ZjMiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJtcF9wYWdlIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICI2MjQ0YmI5ZTMxZGY2ZDhkY2Y4YzQxMzVkZWZlNjQ2MCJ9fQ%3D%3D&ip=1&_=1714058292400 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://na4.docusign.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://na4.docusign.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOGYxNWQ1ZWNhODUwMy0wM2JlZTgzYjhiYjgyMy0yNjAzMWU1MS0xNDAwMDAtMThmMTVkNWVjYTk2N2QiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJtcF9wYWdlIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1714058292399 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOGYxNWQ1ZWNhYjc3My0wNmVjZmFmYzYwZGQzYS0yNjAzMWU1MS0xNDAwMDAtMThmMTVkNWVjYWM2ZjMiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJtcF9wYWdlIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICI2MjQ0YmI5ZTMxZGY2ZDhkY2Y4YzQxMzVkZWZlNjQ2MCJ9fQ%3D%3D&ip=1&_=1714058292400 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Py61rDE3PdRZfnZ&MD=vHKrEBNy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJDQyBSZWNpcGllbnQgVmlldyBTaWdudXAgRm9ybSIsInByb3BlcnRpZXMiOiB7IiRvcyI6ICJXaW5kb3dzIiwiJGJyb3dzZXIiOiAiQ2hyb21lIiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJQYWdlIjogIlNpZ24gJiBSZXR1cm4gTW9kYWwiLCJIYXNoZWRFbWFpbCI6ICIxYmQyODFkYTQzYTExODc0YWQ0ZGMzMjIzMjY2Y2ZhMSIsIlBvc3QgU2lnbmluZyBEaWFsb2ciOiAiRG9uZSIsIkVudmVsb3BlIElEIjogImM4NWFkZDc3ZDE5ZWM3NWFkYWNlNDEyYjc1ZDdjNWQwZTFmNzFlMTgiLCJSZWNpcGllbnQgSUQiOiAiYjBjMzU2Y2Q2YWQ2OWUxNWVhMjczMTE2MTRiMTZmZDBjZmRmMzEwNyIsIlNpZ25lciBJRCI6ICI2ZGVmZmQzOGFmZGFiZjQyNzM2MmIzZmYwYzk1ODRkOTJkZjY3NWRmIiwiQnJvd3NlciBWZXJzaW9uIjogIkNocm9tZSAxMjQuMCIsIkZpZWxkcyBSZWNpcGllbnQiOiAiMzAiLCJGaWVsZHMgRW52ZWxvcGUiOiAiNTciLCJSZXF1aXJlZCBGaWVsZHMiOiAiMiIsIkxhbmd1YWdlIjogImVuIiwiU2lnbmluZyBBY2Nlc3MiOiAiUmVtb3RlIiwiQXV0b05hdiBSdWxlcyI6ICJGaWVsZHNSZXF1aXJlZCIsIlJlY2lwaWVudHMiOiAiNyIsIlJlY2lwaWVudCBUeXBlIjogIlNpZ25lciIsIlJlY2lwaWVudHMgV29ya2Zsb3ciOiAiMyIsIlNlbmRlciBBY2NvdW50IElEIjogImM5NjA0NDhhNDkxYzYzODRlMDQ0YTliNDQ2MjRhN2NjZDU0MzkxOWMiLCJBY2NvdW50IElEIjogIjE2ZmJkMDZmMWNmNzA1MTJmN2M0MGFkMDAzOTE4MWFhYWI0ZTc0ZjEiLCJCcmFuZGVkIjogZmFsc2UsIkJyYW5kZWQgTG9nbyI6IGZhbHNlLCJCcmFuZGVkIENvbG9yIjogZmFsc2UsIkJyYW5kZWQgRmlsZSI6IGZhbHNlLCJDb25jYXQgTW9kZSI6IGZhbHNlLCJBdHRhY2htZW50IEFkZGVkIjogZmFsc2UsIkF0dGFjaG1lbnQgQ291bnQiOiAwLCJBdHRhY2htZW50IE1ldGhvZCI6IG51bGwsIlBhZ2VzIjogIjMxIiwiRG9jcyI6ICI0IiwiQXV0aGVudGljYXRpb24iOiAiTm9uZSIsIkxvZ2dlZCBJbiI6IGZhbHNlLCJDb25zZW50IFNob3duIjogZmFsc2UsIkFjY291bnQgSG9sZGVyIjogZmFsc2UsIkZpZWxkIFNpZ25hdHVyZSI6IHRydWUsIkZpZWxkIEluaXRpYWwiOiBmYWxzZSwiRmllbGQgU3RhbXAiOiBmYWxzZSwiRmllbGQgRGF0ZSI6IHRydWUsIkZpZWxkIFRleHQiOiB0cnVlLCJGaWVsZCBOYW1lIjogZmFsc2UsIkZpZWxkIENvbXBhbnkiOiBmYWxzZSwiRmllbGQgVGl0bGUiOiBmYWxzZSwiRmllbGQgRW1haWwiOiBmYWxzZSwiRmllbGQgQ2hlY2tib3giOiBmYWxzZSwiRmllbGQgUmFkaW8iOiBmYWxzZSwiRmllbGQgRHJvcGRvd24iOiB0cnVlLCJGaWVsZCBBdHRhY2htZW50IjogZmFsc2UsIkZpZWxkIE5vdGUiOiBmYWxzZSwiRmllbGQgQXBwcm92ZSI6IGZhbHNlLCJGaWVsZCBEZWNsaW5lIjogZmFsc2UsIkZpZWxkIFZpZXciOiBmYWxzZSwiRmllbGQgRm9ybXVsYSI6IGZhbHNlLCJUZW1wbGF0ZSBVc2VkIjogZmFsc2UsIlN1cHBsZW1lbnRhbCBEb2N1bWVudCBDb3VudCI6IDAsIlN1cHBsZW1lbnRhbCBEb2N1bWVudCBSZXF1aXJlbWVudHMiOiAiIiwiQXV0b0NvbXBsZXRlIEVuYWJsZWQiOiBmYWxzZSwicHJvZHVjdCBhcmVhIjogIlNpZ25pbmciLCJEU19BIjogImRiNDAzZGIzLTZlYjctNDM4NC05OGJlLWViNjBmZTJiNmRjMiIsIkZyZWVmb3JtIjogZmFsc2UsIlNpZ25pbmdFeHRlbnNpb25zIjogZmFsc2UsIkJyb3dzZXIgV2lkdGggSW5pdGlhbCI6IDEyODAsIkJyb3dzZXIgSGVpZ2h0IEluaXRpYWwiOiA5MDcsIkJyb3dzZXIgV2lkdGgiOiAxMjgwLCJCcm93c2VyIEhlaWdodCI6IDkwNywiU2Vzc2lvbiBBYm91dCB0byBFeHBpcmUgQ291bnQiOiAwLCJUb3AgRmluaXNoIEhpZGRlbiI6IGZhbHNlLCJQb3dlckZvcm0iOiBmYWxzZSwiQS9CIFRlc3RzIjogImlmcmFtZWxlc3M6IG1vYmlsZSIsIlBvd2VyZm9ybSBTZW5kZXIiOiBmYWxzZSwiUGxhdGZvcm0iOiAiV2ViIEFwcCIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1714058297209 HTTP/1.1Host: api.mixpanel.comConnection: keep-alivesec-ch-ua: "Google Chro
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJPcHRpbWl6ZWx5IEV4cGVyaW1lbnQgU3RhcnRlZCIsInByb3BlcnRpZXMiOiB7IiRvcyI6ICJXaW5kb3dzIiwiJGJyb3dzZXIiOiAiQ2hyb21lIiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJPcHRpbWl6ZWx5RmxhZ0tleSI6ICJzaWdudXBfc2lkZWJhciIsIk9wdGltaXplbHlFeHBlcmltZW50TmFtZSI6ICJkZWZhdWx0LTI2NjY4MTAwMDgxIiwiT3B0aW1pemVseVZhcmlhdGlvbktleSI6ICJvZmYiLCJPcHRpbWl6ZWx5SXNGb3JjZWQiOiBmYWxzZSwiUG9zdCBTaWduaW5nIERpYWxvZyI6ICJEb25lIiwiRW52ZWxvcGUgSUQiOiAiYzg1YWRkNzdkMTllYzc1YWRhY2U0MTJiNzVkN2M1ZDBlMWY3MWUxOCIsIlJlY2lwaWVudCBJRCI6ICJiMGMzNTZjZDZhZDY5ZTE1ZWEyNzMxMTYxNGIxNmZkMGNmZGYzMTA3IiwiU2lnbmVyIElEIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCJCcm93c2VyIFZlcnNpb24iOiAiQ2hyb21lIDEyNC4wIiwiRmllbGRzIFJlY2lwaWVudCI6ICIzMCIsIkZpZWxkcyBFbnZlbG9wZSI6ICI1NyIsIlJlcXVpcmVkIEZpZWxkcyI6ICIyIiwiTGFuZ3VhZ2UiOiAiZW4iLCJTaWduaW5nIEFjY2VzcyI6ICJSZW1vdGUiLCJBdXRvTmF2IFJ1bGVzIjogIkZpZWxkc1JlcXVpcmVkIiwiUmVjaXBpZW50cyI6ICI3IiwiUmVjaXBpZW50IFR5cGUiOiAiU2lnbmVyIiwiUmVjaXBpZW50cyBXb3JrZmxvdyI6ICIzIiwiU2VuZGVyIEFjY291bnQgSUQiOiAiYzk2MDQ0OGE0OTFjNjM4NGUwNDRhOWI0NDYyNGE3Y2NkNTQzOTE5YyIsIkFjY291bnQgSUQiOiAiMTZmYmQwNmYxY2Y3MDUxMmY3YzQwYWQwMDM5MTgxYWFhYjRlNzRmMSIsIkJyYW5kZWQiOiBmYWxzZSwiQnJhbmRlZCBMb2dvIjogZmFsc2UsIkJyYW5kZWQgQ29sb3IiOiBmYWxzZSwiQnJhbmRlZCBGaWxlIjogZmFsc2UsIkNvbmNhdCBNb2RlIjogZmFsc2UsIkF0dGFjaG1lbnQgQWRkZWQiOiBmYWxzZSwiQXR0YWNobWVudCBDb3VudCI6IDAsIkF0dGFjaG1lbnQgTWV0aG9kIjogbnVsbCwiUGFnZXMiOiAiMzEiLCJEb2NzIjogIjQiLCJBdXRoZW50aWNhdGlvbiI6ICJOb25lIiwiTG9nZ2VkIEluIjogZmFsc2UsIkNvbnNlbnQgU2hvd24iOiBmYWxzZSwiQWNjb3VudCBIb2xkZXIiOiBmYWxzZSwiRmllbGQgU2lnbmF0dXJlIjogdHJ1ZSwiRmllbGQgSW5pdGlhbCI6IGZhbHNlLCJGaWVsZCBTdGFtcCI6IGZhbHNlLCJGaWVsZCBEYXRlIjogdHJ1ZSwiRmllbGQgVGV4dCI6IHRydWUsIkZpZWxkIE5hbWUiOiBmYWxzZSwiRmllbGQgQ29tcGFueSI6IGZhbHNlLCJGaWVsZCBUaXRsZSI6IGZhbHNlLCJGaWVsZCBFbWFpbCI6IGZhbHNlLCJGaWVsZCBDaGVja2JveCI6IGZhbHNlLCJGaWVsZCBSYWRpbyI6IGZhbHNlLCJGaWVsZCBEcm9wZG93biI6IHRydWUsIkZpZWxkIEF0dGFjaG1lbnQiOiBmYWxzZSwiRmllbGQgTm90ZSI6IGZhbHNlLCJGaWVsZCBBcHByb3ZlIjogZmFsc2UsIkZpZWxkIERlY2xpbmUiOiBmYWxzZSwiRmllbGQgVmlldyI6IGZhbHNlLCJGaWVsZCBGb3JtdWxhIjogZmFsc2UsIlRlbXBsYXRlIFVzZWQiOiBmYWxzZSwiU3VwcGxlbWVudGFsIERvY3VtZW50IENvdW50IjogMCwiU3VwcGxlbWVudGFsIERvY3VtZW50IFJlcXVpcmVtZW50cyI6ICIiLCJBdXRvQ29tcGxldGUgRW5hYmxlZCI6IGZhbHNlLCJwcm9kdWN0IGFyZWEiOiAiU2lnbmluZyIsIkRTX0EiOiAiZGI0MDNkYjMtNmViNy00Mzg0LTk4YmUtZWI2MGZlMmI2ZGMyIiwiRnJlZWZvcm0iOiBmYWxzZSwiU2lnbmluZ0V4dGVuc2lvbnMiOiBmYWxzZSwiQnJvd3NlciBXaWR0aCBJbml0aWFsIjogMTI4MCwiQnJvd3NlciBIZWlnaHQgSW5pdGlhbCI6IDkwNywiQnJvd3NlciBXaWR0aCI6IDEyODAsIkJyb3dzZXIgSGVpZ2h0IjogOTA3LCJTZXNzaW9uIEFib3V0IHRvIEV4cGlyZSBDb3VudCI6IDAsIlRvcCBGaW5pc2ggSGlkZGVuIjogZmFsc2UsIlBvd2VyRm9ybSI6IGZhbHNlLCJBL0IgVGVzdHMiOiAiaWZyYW1lbGVzczogbW9iaWxlIiwiUG93ZXJmb3JtIFNlbmRlciI6IGZhbHNlLCJQbGF0Zm9ybSI6ICJXZWIgQXBwIiwiW09wdGltaXplbHldIGRlZmF1bHQtMjY2NjgxMDAwODEiOiAib2ZmIiwidG9rZW4iOiAiMzA
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJDQyBSZWNpcGllbnQgVmlldyBTaWdudXAgRm9ybSIsInByb3BlcnRpZXMiOiB7IiRvcyI6ICJXaW5kb3dzIiwiJGJyb3dzZXIiOiAiQ2hyb21lIiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJQYWdlIjogIlNpZ24gJiBSZXR1cm4gTW9kYWwiLCJIYXNoZWRFbWFpbCI6ICIxYmQyODFkYTQzYTExODc0YWQ0ZGMzMjIzMjY2Y2ZhMSIsIlBvc3QgU2lnbmluZyBEaWFsb2ciOiAiRG9uZSIsIkVudmVsb3BlIElEIjogImM4NWFkZDc3ZDE5ZWM3NWFkYWNlNDEyYjc1ZDdjNWQwZTFmNzFlMTgiLCJSZWNpcGllbnQgSUQiOiAiYjBjMzU2Y2Q2YWQ2OWUxNWVhMjczMTE2MTRiMTZmZDBjZmRmMzEwNyIsIlNpZ25lciBJRCI6ICI2ZGVmZmQzOGFmZGFiZjQyNzM2MmIzZmYwYzk1ODRkOTJkZjY3NWRmIiwiQnJvd3NlciBWZXJzaW9uIjogIkNocm9tZSAxMjQuMCIsIkZpZWxkcyBSZWNpcGllbnQiOiAiMzAiLCJGaWVsZHMgRW52ZWxvcGUiOiAiNTciLCJSZXF1aXJlZCBGaWVsZHMiOiAiMiIsIkxhbmd1YWdlIjogImVuIiwiU2lnbmluZyBBY2Nlc3MiOiAiUmVtb3RlIiwiQXV0b05hdiBSdWxlcyI6ICJGaWVsZHNSZXF1aXJlZCIsIlJlY2lwaWVudHMiOiAiNyIsIlJlY2lwaWVudCBUeXBlIjogIlNpZ25lciIsIlJlY2lwaWVudHMgV29ya2Zsb3ciOiAiMyIsIlNlbmRlciBBY2NvdW50IElEIjogImM5NjA0NDhhNDkxYzYzODRlMDQ0YTliNDQ2MjRhN2NjZDU0MzkxOWMiLCJBY2NvdW50IElEIjogIjE2ZmJkMDZmMWNmNzA1MTJmN2M0MGFkMDAzOTE4MWFhYWI0ZTc0ZjEiLCJCcmFuZGVkIjogZmFsc2UsIkJyYW5kZWQgTG9nbyI6IGZhbHNlLCJCcmFuZGVkIENvbG9yIjogZmFsc2UsIkJyYW5kZWQgRmlsZSI6IGZhbHNlLCJDb25jYXQgTW9kZSI6IGZhbHNlLCJBdHRhY2htZW50IEFkZGVkIjogZmFsc2UsIkF0dGFjaG1lbnQgQ291bnQiOiAwLCJBdHRhY2htZW50IE1ldGhvZCI6IG51bGwsIlBhZ2VzIjogIjMxIiwiRG9jcyI6ICI0IiwiQXV0aGVudGljYXRpb24iOiAiTm9uZSIsIkxvZ2dlZCBJbiI6IGZhbHNlLCJDb25zZW50IFNob3duIjogZmFsc2UsIkFjY291bnQgSG9sZGVyIjogZmFsc2UsIkZpZWxkIFNpZ25hdHVyZSI6IHRydWUsIkZpZWxkIEluaXRpYWwiOiBmYWxzZSwiRmllbGQgU3RhbXAiOiBmYWxzZSwiRmllbGQgRGF0ZSI6IHRydWUsIkZpZWxkIFRleHQiOiB0cnVlLCJGaWVsZCBOYW1lIjogZmFsc2UsIkZpZWxkIENvbXBhbnkiOiBmYWxzZSwiRmllbGQgVGl0bGUiOiBmYWxzZSwiRmllbGQgRW1haWwiOiBmYWxzZSwiRmllbGQgQ2hlY2tib3giOiBmYWxzZSwiRmllbGQgUmFkaW8iOiBmYWxzZSwiRmllbGQgRHJvcGRvd24iOiB0cnVlLCJGaWVsZCBBdHRhY2htZW50IjogZmFsc2UsIkZpZWxkIE5vdGUiOiBmYWxzZSwiRmllbGQgQXBwcm92ZSI6IGZhbHNlLCJGaWVsZCBEZWNsaW5lIjogZmFsc2UsIkZpZWxkIFZpZXciOiBmYWxzZSwiRmllbGQgRm9ybXVsYSI6IGZhbHNlLCJUZW1wbGF0ZSBVc2VkIjogZmFsc2UsIlN1cHBsZW1lbnRhbCBEb2N1bWVudCBDb3VudCI6IDAsIlN1cHBsZW1lbnRhbCBEb2N1bWVudCBSZXF1aXJlbWVudHMiOiAiIiwiQXV0b0NvbXBsZXRlIEVuYWJsZWQiOiBmYWxzZSwicHJvZHVjdCBhcmVhIjogIlNpZ25pbmciLCJEU19BIjogImRiNDAzZGIzLTZlYjctNDM4NC05OGJlLWViNjBmZTJiNmRjMiIsIkZyZWVmb3JtIjogZmFsc2UsIlNpZ25pbmdFeHRlbnNpb25zIjogZmFsc2UsIkJyb3dzZXIgV2lkdGggSW5pdGlhbCI6IDEyODAsIkJyb3dzZXIgSGVpZ2h0IEluaXRpYWwiOiA5MDcsIkJyb3dzZXIgV2lkdGgiOiAxMjgwLCJCcm93c2VyIEhlaWdodCI6IDkwNywiU2Vzc2lvbiBBYm91dCB0byBFeHBpcmUgQ291bnQiOiAwLCJUb3AgRmluaXNoIEhpZGRlbiI6IGZhbHNlLCJQb3dlckZvcm0iOiBmYWxzZSwiQS9CIFRlc3RzIjogImlmcmFtZWxlc3M6IG1vYmlsZSIsIlBvd2VyZm9ybSBTZW5kZXIiOiBmYWxzZSwiUGxhdGZvcm0iOiAiV2ViIEFwcCIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1714058297209 HTTP/1.1Host: api.mixpanel.comConnection: keep-aliveUser-Agent: Mozilla/5.0
Source: global traffic	HTTP traffic detected: GET /track/?data=eyJldmVudCI6ICJPcHRpbWl6ZWx5IEV4cGVyaW1lbnQgU3RhcnRlZCIsInByb3BlcnRpZXMiOiB7IiRvcyI6ICJXaW5kb3dzIiwiJGJyb3dzZXIiOiAiQ2hyb21lIiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJPcHRpbWl6ZWx5RmxhZ0tleSI6ICJzaWdudXBfc2lkZWJhciIsIk9wdGltaXplbHlFeHBlcmltZW50TmFtZSI6ICJkZWZhdWx0LTI2NjY4MTAwMDgxIiwiT3B0aW1pemVseVZhcmlhdGlvbktleSI6ICJvZmYiLCJPcHRpbWl6ZWx5SXNGb3JjZWQiOiBmYWxzZSwiUG9zdCBTaWduaW5nIERpYWxvZyI6ICJEb25lIiwiRW52ZWxvcGUgSUQiOiAiYzg1YWRkNzdkMTllYzc1YWRhY2U0MTJiNzVkN2M1ZDBlMWY3MWUxOCIsIlJlY2lwaWVudCBJRCI6ICJiMGMzNTZjZDZhZDY5ZTE1ZWEyNzMxMTYxNGIxNmZkMGNmZGYzMTA3IiwiU2lnbmVyIElEIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCJCcm93c2VyIFZlcnNpb24iOiAiQ2hyb21lIDEyNC4wIiwiRmllbGRzIFJlY2lwaWVudCI6ICIzMCIsIkZpZWxkcyBFbnZlbG9wZSI6ICI1NyIsIlJlcXVpcmVkIEZpZWxkcyI6ICIyIiwiTGFuZ3VhZ2UiOiAiZW4iLCJTaWduaW5nIEFjY2VzcyI6ICJSZW1vdGUiLCJBdXRvTmF2IFJ1bGVzIjogIkZpZWxkc1JlcXVpcmVkIiwiUmVjaXBpZW50cyI6ICI3IiwiUmVjaXBpZW50IFR5cGUiOiAiU2lnbmVyIiwiUmVjaXBpZW50cyBXb3JrZmxvdyI6ICIzIiwiU2VuZGVyIEFjY291bnQgSUQiOiAiYzk2MDQ0OGE0OTFjNjM4NGUwNDRhOWI0NDYyNGE3Y2NkNTQzOTE5YyIsIkFjY291bnQgSUQiOiAiMTZmYmQwNmYxY2Y3MDUxMmY3YzQwYWQwMDM5MTgxYWFhYjRlNzRmMSIsIkJyYW5kZWQiOiBmYWxzZSwiQnJhbmRlZCBMb2dvIjogZmFsc2UsIkJyYW5kZWQgQ29sb3IiOiBmYWxzZSwiQnJhbmRlZCBGaWxlIjogZmFsc2UsIkNvbmNhdCBNb2RlIjogZmFsc2UsIkF0dGFjaG1lbnQgQWRkZWQiOiBmYWxzZSwiQXR0YWNobWVudCBDb3VudCI6IDAsIkF0dGFjaG1lbnQgTWV0aG9kIjogbnVsbCwiUGFnZXMiOiAiMzEiLCJEb2NzIjogIjQiLCJBdXRoZW50aWNhdGlvbiI6ICJOb25lIiwiTG9nZ2VkIEluIjogZmFsc2UsIkNvbnNlbnQgU2hvd24iOiBmYWxzZSwiQWNjb3VudCBIb2xkZXIiOiBmYWxzZSwiRmllbGQgU2lnbmF0dXJlIjogdHJ1ZSwiRmllbGQgSW5pdGlhbCI6IGZhbHNlLCJGaWVsZCBTdGFtcCI6IGZhbHNlLCJGaWVsZCBEYXRlIjogdHJ1ZSwiRmllbGQgVGV4dCI6IHRydWUsIkZpZWxkIE5hbWUiOiBmYWxzZSwiRmllbGQgQ29tcGFueSI6IGZhbHNlLCJGaWVsZCBUaXRsZSI6IGZhbHNlLCJGaWVsZCBFbWFpbCI6IGZhbHNlLCJGaWVsZCBDaGVja2JveCI6IGZhbHNlLCJGaWVsZCBSYWRpbyI6IGZhbHNlLCJGaWVsZCBEcm9wZG93biI6IHRydWUsIkZpZWxkIEF0dGFjaG1lbnQiOiBmYWxzZSwiRmllbGQgTm90ZSI6IGZhbHNlLCJGaWVsZCBBcHByb3ZlIjogZmFsc2UsIkZpZWxkIERlY2xpbmUiOiBmYWxzZSwiRmllbGQgVmlldyI6IGZhbHNlLCJGaWVsZCBGb3JtdWxhIjogZmFsc2UsIlRlbXBsYXRlIFVzZWQiOiBmYWxzZSwiU3VwcGxlbWVudGFsIERvY3VtZW50IENvdW50IjogMCwiU3VwcGxlbWVudGFsIERvY3VtZW50IFJlcXVpcmVtZW50cyI6ICIiLCJBdXRvQ29tcGxldGUgRW5hYmxlZCI6IGZhbHNlLCJwcm9kdWN0IGFyZWEiOiAiU2lnbmluZyIsIkRTX0EiOiAiZGI0MDNkYjMtNmViNy00Mzg0LTk4YmUtZWI2MGZlMmI2ZGMyIiwiRnJlZWZvcm0iOiBmYWxzZSwiU2lnbmluZ0V4dGVuc2lvbnMiOiBmYWxzZSwiQnJvd3NlciBXaWR0aCBJbml0aWFsIjogMTI4MCwiQnJvd3NlciBIZWlnaHQgSW5pdGlhbCI6IDkwNywiQnJvd3NlciBXaWR0aCI6IDEyODAsIkJyb3dzZXIgSGVpZ2h0IjogOTA3LCJTZXNzaW9uIEFib3V0IHRvIEV4cGlyZSBDb3VudCI6IDAsIlRvcCBGaW5pc2ggSGlkZGVuIjogZmFsc2UsIlBvd2VyRm9ybSI6IGZhbHNlLCJBL0IgVGVzdHMiOiAiaWZyYW1lbGVzczogbW9iaWxlIiwiUG93ZXJmb3JtIFNlbmRlciI6IGZhbHNlLCJQbGF0Zm9ybSI6ICJXZWIgQXBwIiwiW09wdGltaXplbHldIGRlZmF1bHQtMjY2NjgxMDAwODEiOiAib2ZmIiwidG9rZW4iOiAiMzA

Source: global traffic	DNS traffic detected: DNS query: na4.docusign.net
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: a.docusign.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.optimizely.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: chromecache_123.9.dr	String found in binary or memory: http://dbj.org/dbj/?p=286
Source: chromecache_123.9.dr	String found in binary or memory: http://dean.edwards.name/weblog/2005/10/add-event/
Source: chromecache_123.9.dr	String found in binary or memory: http://documentcloud.github.com/underscore/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: chromecache_123.9.dr	String found in binary or memory: http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/
Source: chromecache_123.9.dr	String found in binary or memory: http://mixpanel.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg	String found in binary or memory: http://schema.org
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: chromecache_123.9.dr	String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-12.4
Source: ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://NA4.docusign.net/member/Images/email/docInvite-white.png
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.office.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://api.scheduler.
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://apps.apple.com/us/app/faa-civil-rights/id1594221821
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://augloop.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://cdn.entity.
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://clients.config.office.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://cortana.ai
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://cr.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://d.docs.live.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: chromecache_123.9.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://directory.services.
Source: ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ecs.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: chromecache_123.9.dr	String found in binary or memory: https://gist.github.com/1930440
Source: chromecache_123.9.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js/blob/master/json_parse.js
Source: chromecache_133.9.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_133.9.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.25.2/LICENSE
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://graph.windows.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://invites.office.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://login.windows.local
Source: OUTLOOK_16_0_16827_20130-20240425T1717590831-6904.etl.0.dr	String found in binary or memory: https://login.windows.localMiR
Source: OUTLOOK_16_0_16827_20130-20240425T1717590831-6904.etl.0.dr	String found in binary or memory: https://login.windows.local_AlR
Source: OUTLOOK_16_0_16827_20130-20240425T1717590831-6904.etl.0.dr	String found in binary or memory: https://login.windows.localnull
Source: OUTLOOK_16_0_16827_20130-20240425T1717590831-6904.etl.0.dr	String found in binary or memory: https://login.windows.localnullBoo
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://management.azure.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://management.azure.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://na4.docusign.net/Signing/EmailStart.aspx?a=1682d2ad-3aaf-4e04-89e5-6f16ebd523da&acct=38ccb70
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://outlook.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.quickseries.rca.faa.civil.rights
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi10_1ZGSbG5cN604XS0VtYcCwEzRm3nkqqIY
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.39
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://settings.outlook.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://substrate.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://tasks.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificat
Source: Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	String found in binary or memory: https://www.docusign.com/support
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: 5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.11:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.11:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.11:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49746 version: TLS 1.2

Source: classification engine

Classification label: sus23.phis.winMSG@17/128@20/6

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240425T1717590831-6904.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "CFC65EE8-BB3D-4D69-A327-1E40894691F5" "AE8AF95D-F4FC-4F52-9834-BFE80F7520C5" "6904" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Signing/EmailStart.aspx?a=1682d2ad-3aaf-4e04-89e5-6f16ebd523da&acct=38ccb707-084a-4cbb-99e2-bfa5ea43e517&er=46fcc958-3af2-49ba-80fe-97ac29c6e84a
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1848,i,14491747394357505162,9509817759995701411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "CFC65EE8-BB3D-4D69-A327-1E40894691F5" "AE8AF95D-F4FC-4F52-9834-BFE80F7520C5" "6904" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://na4.docusign.net/Signing/EmailStart.aspx?a=1682d2ad-3aaf-4e04-89e5-6f16ebd523da&acct=38ccb707-084a-4cbb-99e2-bfa5ea43e517&er=46fcc958-3af2-49ba-80fe-97ac29c6e84a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1848,i,14491747394357505162,9509817759995701411,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: Google Drive.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://cdn.entity.	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://otelrules.svc.static.microsoft	0%	URL Reputation	safe
http://dbj.org/dbj/?p=286	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://my.microsoftpersonalcontent.com	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://skyapi.live.net/Activity/	0%	URL Reputation	safe
https://api.cortana.ai	0%	URL Reputation	safe
https://staging.cortana.ai	0%	URL Reputation	safe
https://wus2.pagecontentsync.	0%	URL Reputation	safe
https://cortana.ai/api	0%	URL Reputation	safe
https://powerlift.acompli.net	0%	URL Reputation	safe
https://cortana.ai	0%	URL Reputation	safe
https://ofcrecsvcapi-int.azurewebsites.net/	0%	URL Reputation	safe
https://d.docs.live.net	0%	Avira URL Cloud	safe
https://login.windows.localnull	0%	Avira URL Cloud	safe
https://login.windows.localMiR	0%	Avira URL Cloud	safe
https://d.docs.live.net	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
www.google.com	64.233.177.105	true	false	high
api.mixpanel.com	35.190.25.25	true	false	high
arya-1323461286.us-west-2.elb.amazonaws.com	54.186.38.246	true	false	high
cdn.optimizely.com	unknown	unknown	false	high
na4.docusign.net	unknown	unknown	false	high
a.docusign.com	unknown	unknown	false	high
docucdn-a.akamaihd.net	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://shell.suite.office.com:1443	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://autodiscover-s.outlook.com/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://useraudit.o365auditrealtimeingestion.manage.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://outlook.office365.com/connectors	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://github.com/zloirock/core-js	chromecache_133.9.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://cdn.entity.	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://login.windows.localnull	OUTLOOK_16_0_16827_20130-20240425T1717590831-6904.etl.0.dr	false	Avira URL Cloud: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://api.aadrm.com/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://github.com/zloirock/core-js/blob/v3.25.2/LICENSE	chromecache_133.9.dr	false		high
https://www.yammer.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://api.microsoftstream.com/api/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://cr.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://messagebroker.mobile.m365.svc.cloud.microsoft	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
http://dbj.org/dbj/?p=286	chromecache_123.9.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/registrar/prod	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://officeci.azurewebsites.net/api/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://my.microsoftpersonalcontent.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://store.office.cn/addinstemplate	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://messaging.engagement.office.com/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://www.odwebp.svc.ms	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://web.microsoftstream.com/video/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://consent.config.office.com/consentcheckin/v1.0/consents	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://d.docs.live.net	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://safelinks.protection.outlook.com/api/GetPolicy	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://ncus.contentsync.	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
http://weather.service.msn.com/data.aspx	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/	chromecache_123.9.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://pushchannel.1drv.ms	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://wus2.contentsync.	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://clients.config.office.net/user/v1.0/ios	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://api.addins.omex.office.net/api/addins/search	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://clients.config.office.net/user/v1.0/android/policies	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://entitlement.diagnostics.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://outlook.office.com/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
http://schema.org	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg	false		high
https://login.microsoftonline.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://graph.windows.net/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://devnull.onenote.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	false		high
https://messaging.office.com/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://skyapi.live.net/Activity/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest#withCredentials	chromecache_123.9.dr	false		high
https://api.cortana.ai	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://messaging.action.office.com/setcampaignaction	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://visio.uservoice.com/forums/368202-visio-on-devices	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://staging.cortana.ai	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/embed?	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://augloop.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://api.diagnosticssdf.office.com/v2/file	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://officepyservice.office.net/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://api.diagnostics.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://store.office.de/addinstemplate	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://login.windows.localMiR	OUTLOOK_16_0_16827_20130-20240425T1717590831-6904.etl.0.dr	false	Avira URL Cloud: safe	unknown
https://wus2.pagecontentsync.	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/datasets	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://cortana.ai/api	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/email-logo.png	~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	false		high
https://api.diagnosticssdf.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://login.microsoftonline.com/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://api.addins.omex.office.net/appinfo/query	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://clients.config.office.net/user/v1.0/tenantassociationkey	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://powerlift.acompli.net	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://cortana.ai	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/imports	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://cloudfiles.onenote.com/upload.aspx	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://entitlement.diagnosticssdf.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://ofcrecsvcapi-int.azurewebsites.net/	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false	URL Reputation: safe	unknown
https://ic3.teams.office.com	5F77E8E0-36E5-4446-9930-F4E4D8F34873.0.dr	false		high
https://na4.docusign.net/Signing/EmailStart.aspx?a=1682d2ad-3aaf-4e04-89e5-6f16ebd523da&acct=38ccb70	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg, ~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
35.186.241.51	unknown	United States	15169	GOOGLEUS	false
35.190.25.25	api.mixpanel.com	United States	15169	GOOGLEUS	false
64.233.177.105	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
54.186.38.246	arya-1323461286.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431736
Start date and time:	2024-04-25 17:17:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg
Detection:	SUS
Classification:	sus23.phis.winMSG@17/128@20/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msg

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse
	https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238	Get hash	malicious	Unknown	Browse
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse
	https://r20.rs6.net/tn.jsp?f=001mdupJ4qBb-Nd2_ylzx8HBttlQ9opTAsCLDNaIzR_kjOMUNmpNcZJwTrf1-JKcQms1CJ9Uho976bwGC08_tX5C5noMjVDoDyLOXoK3aopxxStOM8t6wvTBKWgVo18etJYQ_eeHjJ4R2lwkep1pKOUg8VLdGfphtuo&c=&ch=/Er8BdK9PMSuOgr2lskWkeZAKVKx339#?ZnJhbmtfZHJhcGVyQGFvLnVzY291cnRzLmdvdg==	Get hash	malicious	HTMLPhisher	Browse
	data.tmp.zip	Get hash	malicious	Unknown	Browse
	https://bushelman-my.sharepoint.com/:b:/p/lance/ESXtc6Laa05KpaC4W3rpMEMBfLSUU1GZhgfhBL8opRqFHg?e=Wrw3le	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://uploaddeimagens.com.br/images/001/894/856/original/Logo_Email_Advisia.png?1550069603	Get hash	malicious	Unknown	Browse
	http://lyddemper.com	Get hash	malicious	Unknown	Browse
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse
	https://app.robly.com/sites/1550c67c312457e2bb58457f78fda912/f774d7ddfffc8f1d429cd55a95adr852d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
54.186.38.246	https://eu.docusign.net/Signing/EmailStart.aspx?a=c2316afe-212a-443e-8085-9617c789ff9e&acct=3b74c8d0-0c86-4fe6-a37e-391f3ae29b50&er=eaaa56e8-48ca-4278-8838-760c6115596a	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	C5fMgX1ZyY.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	hz2ffABF7w.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	U4EnIo30QR.elf	Get hash	malicious	Mirai, Okiru	Browse	34.249.145.219
	D0dhEeGfv4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.247.62.1
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	99.84.108.59
	tw7rloKDkG.elf	Get hash	malicious	Mirai	Browse	18.253.84.58
	dwn1cGHIbV.elf	Get hash	malicious	Mirai	Browse	65.3.230.66
	0ar3q66pGv.elf	Get hash	malicious	Mirai	Browse	18.182.10.193
	https://r20.rs6.net/tn.jsp?f=001mdupJ4qBb-Nd2_ylzx8HBttlQ9opTAsCLDNaIzR_kjOMUNmpNcZJwTrf1-JKcQms1CJ9Uho976bwGC08_tX5C5noMjVDoDyLOXoK3aopxxStOM8t6wvTBKWgVo18etJYQ_eeHjJ4R2lwkep1pKOUg8VLdGfphtuo&c=&ch=/Er8BdK9PMSuOgr2lskWkeZAKVKx339#?ZnJhbmtfZHJhcGVyQGFvLnVzY291cnRzLmdvdg==	Get hash	malicious	HTMLPhisher	Browse	108.156.152.114
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	52.217.196.113

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	https://rro5wktwxr4n.rollout-specialist-assistance-network.cfd/support_case_ID/#8347435238	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	https://r20.rs6.net/tn.jsp?f=001mdupJ4qBb-Nd2_ylzx8HBttlQ9opTAsCLDNaIzR_kjOMUNmpNcZJwTrf1-JKcQms1CJ9Uho976bwGC08_tX5C5noMjVDoDyLOXoK3aopxxStOM8t6wvTBKWgVo18etJYQ_eeHjJ4R2lwkep1pKOUg8VLdGfphtuo&c=&ch=/Er8BdK9PMSuOgr2lskWkeZAKVKx339#?ZnJhbmtfZHJhcGVyQGFvLnVzY291cnRzLmdvdg==	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	data.tmp.zip	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	https://app.robly.com/sites/1550c67c312457e2bb58457f78fda912/f774d7ddfffc8f1d429cd55a95adr852d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	http://seattlend.com	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.28.11 184.31.62.93
	Air Transport Services Group Open Benefits Enrollment.eml	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.28.11 184.31.62.93

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.377686575516618
Encrypted:	false
SSDEEP:	3072:60gsdTg2miGu2WqoQqrt0Fv/eLCqXLllP7:6uDmi2jwCsLllD
MD5:	B421C32448EEDF19B30CC3E4D97B3C05
SHA1:	AF662B99B42B1948035FB2E3BD0CF939B727E2BE
SHA-256:	C992290A67B2BA235B90F6BEC6682238A82A130521DFCA2600BEBA392114AAC1
SHA-512:	17C7DC61E07D09F84683824C17070483349C97BA713723C57AAC18F1EFC1701186F20C96CE82D069C43B3BC65030EC9A6AD646788423D4E352DC867EBBFAC23D
Malicious:	false
Reputation:	low
Preview:	TH02...... .0.#.......SM01X...,...P...#...........IPM.Activity...........h...............h............H..h..O.......J....h........h...H..h\cal ...pDat...h.u..0.....O....h...............h........_`.j...h...@...I.lw...h....H...8..j...0....T...............d.........2h...............kt.e.....:. ...!h.............. h..>V....0.O...#h....8.........$hh.......8....."hH.~.......}...'h..a...........1h....<.........0h....4....j../h....h......jH..h ...p.....O...-h .......\.O...+h..........O................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 14:18:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9905652919554693
Encrypted:	false
SSDEEP:	48:81dqTWoHGHxidAKZdA1FehwiZUklqehvy+3:8SbcYy
MD5:	63602DB42D65CD938507D154AED1B76E
SHA1:	DF728B556462A05347CFD0CD6584B3CD11F31A52
SHA-256:	AAF1A3DAF1BDAD844B213894F5892F2E5963E099A41940E8D0B40F2CA5936E80
SHA-512:	80557CD55ED48EB4FA8058285724ADE3AF0D2192C33B5DD06799D6FDE16C643FA50CFEC0847DF138EC4718D6AF4D2BFEB872D2248B708EE4E2A647A13DC957AF
Malicious:	false
Preview:	L..................F.@.. ...$+.,........#...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X6z....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XDz....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XDz....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XDz..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XFz...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........TK.h.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	4.151312234374894
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg
File size:	143'360 bytes
MD5:	42a70648a68852fea223bee03fc07a42
SHA1:	50235764f2153d62e5be5e65202b4f77c5f96366
SHA256:	e7d97fbf0f1620b5e344bdd335bad70f7ec11358f34985d8535791b1d976d767
SHA512:	0340a58e2cc865c791214795856f60768fc0e51d32c7eff27e4ffde2489ec5edd3702354338ef72b82301c1a38c39125668c1adbade7b554232c90a4c433c512
SSDEEP:	3072:o1sr/vOwq/p5AJPi/RayHck66HgZT8Giz:E4/GZ5AJK/kDiz
TLSH:	FFE3E1152AFA0515F1B7AF354AF644A29A37FD427C38C94E21953B0D0AB3A41EC61F3B
File Content Preview:	........................>.......................................................v..............................................................................................................................................................................

Subject:	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park, GA)
From:	"Serdentriss Stokes via DocuSign" <dse_NA4@docusign.net>
To:	"Robert W Craig-Gray" <robert.w.craig-gray@faa.gov>
Cc:
BCC:
Date:	Wed, 24 Apr 2024 02:42:57 +0200
Communications:	CAUTION: This email originated from outside of the Federal Aviation Administration (FAA). Do not click on links or open attachments unless you recognize the sender and know the content is safe. Serdentriss Stokes sent you a document to review and sign. REVIEW DOCUMENTS Serdentriss Stokes serdentriss.stokes@faa.gov PRIVATE MESSAGE Good day, Do not forward this email. The information contained in this email is privileged and confidential. The information stated is not to be shared and is only sent to those in a need to know position. If you have any questions, contact me, your intake specialist. This is notification an individual has entered the EEO Complaint Process; please see the attachments. You have been identified as the MOP, Management Official Primary, who has authority to provide a possible resolution. The RMO, Responsible Management Official, who the alleged complaint is against is Arnold Angelici. After reading Notification #1, please sign the Acknowledgement: Receipt of Informal Complaint Memo. You will be contacted by an EEO Counselor to discuss the next steps. If you have any additional questions, please do not hesitate to reach out. Good day, The link contained in this email will provide access to a document packet via DocuSign containing counseling documents. Retain this email/link to access these documents throughout the counseling process. Creation of a DocuSign account is optional, it is not required to proceed through the process Please review and take appropriate action on the attached material and contact me if you have questions or concerns. Serdentriss Stokes EEO Assistant/Intake Team Office of Civil Rights Office: 609-485-6675 Email:Serdentriss.Stokes@faa.gov Federal Aviation Administration Office of Civil Rights William J Hughes Technical Center Atlantic City, NJ 08405 www.FAA.Gov FY23: The Year of Inclusion - Please click the image to provide feedback Click here to file an EEO Complaint This Federal Aviation Administration (FAA) Civil Rights app provides federal civil rights information and resources to FAA employees, customers, airports, stakeholders, and all interested parties.... To download the new FAA Civil Rights App please use the following links: Apple/iOS devices: https://apps.apple.com/us/app/faa-civil-rights/id1594221821 Android/Google devices: https://play.google.com/store/apps/details?id=com.quickseries.rca.faa.civil.rights This e-mail message is intended solely for the recipient(s) above. The information may be privileged and confidential. If you are not the intended recipient of this message, notify the sender immediately and delete the original message. Thank You! Do Not Share This Email This email contains a secure link to DocuSign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit DocuSign.com, click 'Access Documents', and enter the security code: 1682D2AD3AAF4E0489E56F16EBD523DA7 About DocuSign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- DocuSign provides a professional trusted solution for Digital Transaction Management. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you are having trouble signing the document, please visit the Help with Signing page on our Support Center. <https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend> Download the DocuSign App This message was sent to you by Serdentriss Stokes who is using the DocuSign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.
Attachments:

Key	Value
Received	from docusign.net ([127.0.0.1]) by SE101FE32.corp.docusign.net with Microsoft SMTPSVC(10.0.17763.1697);
00	43:08 +0000
by MN2PR09MB4987.namprd09.prod.outlook.com (2603	10b6:208:212::19) with
2024 00	43:04 +0000
(2603	10b6:5:160::29) with Microsoft SMTP Server (version=TLS1_2,
Transport; Wed, 24 Apr 2024 00	43:03 +0000
Authentication-Results	spf=fail (sender IP is 204.108.8.6)
Received-SPF	Pass (amcrelay1.faa.gov: domain of
15.20.7519.19 via Frontend Transport; Wed, 24 Apr 2024 00	43:02 +0000
by oexinternalrelay1.faa.gov with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Apr 2024 20	43:01 -0400
ip4	208.184.224.19 ip4:162.248.184.0/22 ip4:64.207.216.0/22
Authentication-Results-Original	amcrelay1.faa.gov; spf=Pass
IronPort-SDR	66285594_PMaxQ+OqaSI4aCyyhKmOwY4z5vkGVmWJLsFWj20S9WCraCB
X-IPAS-Result	=?us-ascii?q?A0AeAAAcVShmhonbz0BXAxwBAQEBAQEHAQESAQEEBAEBZ?=
IronPort-PHdr	A9a23:9gU6RBDHDlQttRR67ofhUyQU/kQY04WdBeZowoRy0uEGe/G55J2nJ
IronPort-Data	A9a23:6APscKA6BDtWRxVW/xTow5YqxClBgxIJ4kV8jS/XYbTApDlzhjQFz
IronPort-HdrOrdr	A9a23:ygVXGK/Y1RfC2pMpCmRuk+BEI+orL9Y04lQ7vn2ZKCYlCPBw8v
X-Talos-CUID	9a23:RN8hhm279yZaDICwpYXsn7xfFPE6dnbYxV7rLGSCVXh1Q7SNSHiU5/Yx
X-Talos-MUID	=?us-ascii?q?9a23=3Ab0IvZQ+1x21OKptx6LC61JSQf+FV+qq3DQcprbg?=
X-IronPort-Anti-Spam-Filtered	true
X-IronPort-AV	E=Sophos;i="6.07,222,1708408800";
by amcrelay1.faa.gov with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Apr 2024 19	43:00 -0500
for <robert.w.craig-gray@faa.gov>; Wed, 24 Apr 2024 00	42:58 +0000 (UTC)
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/simple; d=docusign.net;
Tue, 23 Apr 2024 17	42:57 -0700
Sender	DocuSign NA4 System <dse_NA4@docusign.net>
Reply-To	"Serdentriss Stokes" <serdentriss.stokes@faa.gov>
Recipient-Id	46fcc958-3af2-49ba-80fe-97ac29c6e84a
X-Debug	False
X-Email-Rejection-Mode	LearningMode
X-Api-Host	na4.docusign.net
Site-Id	7
X-BounceEmailVersion	1
From	"Serdentriss Stokes via DocuSign" <dse_NA4@docusign.net>
To	"Robert W Craig-Gray" <robert.w.craig-gray@faa.gov>
Message-ID	<72b8378d6fa843c89647c32aa6cf9218@docusign.net>
Date	Tue, 23 Apr 2024 17:42:57 -0700
Subject	Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park, GA)
MIME-Version	1.0
Content-Type	multipart/alternative;
X-OriginalArrivalTime	24 Apr 2024 00:42:57.0793 (UTC) FILETIME=[5A1D3F10:01DA95E0]
Return-Path	dse_NA4@docusign.net
X-MS-Exchange-Organization-ExpirationStartTime	24 Apr 2024 00:43:02.7402
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	b3dea8b9-e05b-46af-22c4-08dc63f77f87
X-EOPAttributedMessage	0
X-MS-Exchange-Organization-MessageDirectionality	Originating
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	BL02EPF0001B416:EE_\|MN2PR09MB4987:EE_\|CO6PR09MB8567:EE_
X-MS-Exchange-Organization-AuthSource	BL02EPF0001B416.namprd09.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-OriginatorOrg	usfaa.onmicrosoft.com
X-MS-Office365-Filtering-Correlation-Id	b3dea8b9-e05b-46af-22c4-08dc63f77f87
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:3;
X-Forefront-Antispam-Report	CIP:204.108.8.6;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:oexinternalrelay1.faa.gov;PTR:ErrorRetry;CAT:NONE;SFS:(13230031)(5073199003)(4123199003)(5063199003)(82310400014)(4143199003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	24 Apr 2024 00:43:02.2871
X-MS-Exchange-CrossTenant-Network-Message-Id	b3dea8b9-e05b-46af-22c4-08dc63f77f87
X-MS-Exchange-CrossTenant-Id	2b69d099-dc61-447b-84c8-001733d8be3a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp	TenantId=2b69d099-dc61-447b-84c8-001733d8be3a;Ip=[204.108.8.6];Helo=[oexinternalrelay1.faa.gov]
X-MS-Exchange-CrossTenant-AuthSource	BL02EPF0001B416.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped	MN2PR09MB4987
X-MS-Exchange-Transport-EndToEndLatency	00:00:06.2646488
X-MS-Exchange-Processed-By-BccFoldering	15.20.7472.035
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?QYJYXHJDohFe9MtSi1gGRJS5jdO6ocizAQFAm0d0kDr2Ebm1Yxp7UreZRHP9?=
date	Wed, 24 Apr 2024 02:42:57 +0200

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 17:18:10.152720928 CEST	59221	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:10.152720928 CEST	54647	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:10.237863064 CEST	53	49393	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:10.336998940 CEST	53	54950	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:10.962310076 CEST	53	52122	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:12.871330023 CEST	54063	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:12.871584892 CEST	65505	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:12.874335051 CEST	51775	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:12.874335051 CEST	64505	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:12.985404015 CEST	53	51775	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:12.985632896 CEST	53	64505	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:13.451129913 CEST	56863	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:13.451368093 CEST	57326	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:13.609678030 CEST	56278	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:13.609848976 CEST	58768	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:13.719916105 CEST	53	58768	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:13.720304012 CEST	53	56278	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:14.196074963 CEST	64721	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:14.196439981 CEST	65380	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:14.305907965 CEST	53	64721	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:14.306694984 CEST	53	65380	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:14.876781940 CEST	59365	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:14.876781940 CEST	53666	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:14.986985922 CEST	53	53666	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:14.987323046 CEST	53	59365	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:16.608347893 CEST	55923	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:16.608488083 CEST	63496	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:17.320743084 CEST	64577	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:17.320920944 CEST	57994	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:17.857278109 CEST	61647	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:17.857646942 CEST	57198	53	192.168.2.16	1.1.1.1
Apr 25, 2024 17:18:18.226955891 CEST	53	58848	1.1.1.1	192.168.2.16
Apr 25, 2024 17:18:27.872436047 CEST	53	63231	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 17:18:10.263776064 CEST	1.1.1.1	192.168.2.16	0x1770	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:10.263899088 CEST	1.1.1.1	192.168.2.16	0x6a95	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:12.982146978 CEST	1.1.1.1	192.168.2.16	0x56c8	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:12.982753038 CEST	1.1.1.1	192.168.2.16	0x3e43	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:12.985404015 CEST	1.1.1.1	192.168.2.16	0xeb68	No error (0)	a.docusign.com	arya-1323461286.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:12.985404015 CEST	1.1.1.1	192.168.2.16	0xeb68	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		54.186.38.246	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:12.985404015 CEST	1.1.1.1	192.168.2.16	0xeb68	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		54.148.51.66	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:12.985404015 CEST	1.1.1.1	192.168.2.16	0xeb68	No error (0)	arya-1323461286.us-west-2.elb.amazonaws.com		35.162.217.246	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:12.985632896 CEST	1.1.1.1	192.168.2.16	0x1011	No error (0)	a.docusign.com	arya-1323461286.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:13.561314106 CEST	1.1.1.1	192.168.2.16	0x727f	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:13.562062979 CEST	1.1.1.1	192.168.2.16	0xf475	No error (0)	docucdn-a.akamaihd.net	docucdn-a.akamaihd.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:13.720304012 CEST	1.1.1.1	192.168.2.16	0x94ce	No error (0)	api.mixpanel.com		35.190.25.25	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:13.720304012 CEST	1.1.1.1	192.168.2.16	0x94ce	No error (0)	api.mixpanel.com		107.178.240.159	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:13.720304012 CEST	1.1.1.1	192.168.2.16	0x94ce	No error (0)	api.mixpanel.com		35.186.241.51	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:13.720304012 CEST	1.1.1.1	192.168.2.16	0x94ce	No error (0)	api.mixpanel.com		130.211.34.183	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.305907965 CEST	1.1.1.1	192.168.2.16	0x668a	No error (0)	api.mixpanel.com		35.186.241.51	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.305907965 CEST	1.1.1.1	192.168.2.16	0x668a	No error (0)	api.mixpanel.com		107.178.240.159	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.305907965 CEST	1.1.1.1	192.168.2.16	0x668a	No error (0)	api.mixpanel.com		35.190.25.25	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.305907965 CEST	1.1.1.1	192.168.2.16	0x668a	No error (0)	api.mixpanel.com		130.211.34.183	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.986985922 CEST	1.1.1.1	192.168.2.16	0x6b28	No error (0)	www.google.com		64.233.177.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.986985922 CEST	1.1.1.1	192.168.2.16	0x6b28	No error (0)	www.google.com		64.233.177.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.986985922 CEST	1.1.1.1	192.168.2.16	0x6b28	No error (0)	www.google.com		64.233.177.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.986985922 CEST	1.1.1.1	192.168.2.16	0x6b28	No error (0)	www.google.com		64.233.177.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.986985922 CEST	1.1.1.1	192.168.2.16	0x6b28	No error (0)	www.google.com		64.233.177.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.986985922 CEST	1.1.1.1	192.168.2.16	0x6b28	No error (0)	www.google.com		64.233.177.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 17:18:14.987323046 CEST	1.1.1.1	192.168.2.16	0xada9	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 17:18:16.720035076 CEST	1.1.1.1	192.168.2.16	0x4bad	No error (0)	cdn.optimizely.com	cdn.o6.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:16.720658064 CEST	1.1.1.1	192.168.2.16	0xb940	No error (0)	cdn.optimizely.com	cdn.o6.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:17.430816889 CEST	1.1.1.1	192.168.2.16	0x15b	No error (0)	cdn.optimizely.com	cdn.o6.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:17.430989981 CEST	1.1.1.1	192.168.2.16	0xcec5	No error (0)	cdn.optimizely.com	cdn.o6.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:17.968549967 CEST	1.1.1.1	192.168.2.16	0x7a6	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 17:18:18.125607967 CEST	1.1.1.1	192.168.2.16	0x10f0	No error (0)	na4.docusign.net	na4.docusign.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:05 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 15:18:06 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0790) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=143129 Date: Thu, 25 Apr 2024 15:18:06 GMT Connection: close X-CID: 2

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5F77E8E0-36E5-4446-9930-F4E4D8F34873

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{0C0C367F-5A18-4AE6-9D52-6A4CD006C8B4}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1714058280044004700_8C6187CB-2684-489B-975C-6903BEC2F7D9.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1714058280044851400_8C6187CB-2684-489B-975C-6903BEC2F7D9.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240425T1717590831-6904.etl

C:\Users\user\AppData\Local\Temp\~DF7DE21F9F51F5E2B8.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Windows Analysis Report
Pre-Complaint Packet for Your Review 2024-00253-FAA ( College Park GA).msg

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:06 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 15:18:06 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=143129 Date: Thu, 25 Apr 2024 15:18:06 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 15:18:06 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:07 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-25 15:18:07 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-25 15:18:07 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 25 Apr 2024 15:17:07 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 82fe45e9-463e-4279-a9f8-ffc3f72706c7 PPServer: PPV: 30 H: SN1PEPF0002F035 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 25 Apr 2024 15:18:07 GMT Connection: close Content-Length: 11392
2024-04-25 15:18:07 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:08 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-25 15:18:08 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-25 15:18:08 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 25 Apr 2024 15:17:08 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 6d380488-722b-44c5-8a98-4a2f9437f3c6 PPServer: PPV: 30 H: SN1PEPF0002F0FB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 25 Apr 2024 15:18:08 GMT Connection: close Content-Length: 11392
2024-04-25 15:18:08 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:09 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-25 15:18:09 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-25 15:18:09 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 25 Apr 2024 15:17:09 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 25072bf2-d612-42a0-9d98-6024f8e78043 PPServer: PPV: 30 H: SN1PEPF0002F1B6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 25 Apr 2024 15:18:08 GMT Connection: close Content-Length: 11372
2024-04-25 15:18:09 UTC	11372	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:10 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-25 15:18:10 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-25 15:18:10 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 25 Apr 2024 15:17:10 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 475aa80b-562a-49f4-8c4b-8b2f836aa708 PPServer: PPV: 30 H: SN1PEPF0002F971 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 25 Apr 2024 15:18:09 GMT Connection: close Content-Length: 11372
2024-04-25 15:18:10 UTC	11372	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:13 UTC	540	OUT	GET /ds_arya_wrapper.min.js?f=1 HTTP/1.1 Host: a.docusign.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://na4.docusign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 15:18:13 UTC	313	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 15:18:13 GMT Content-Length: 631 Connection: close Server: DS-Arya Expires: Fri, 26 Apr 2024 15:18:13 GMT Cache-Control: max-age=86400 Set-Cookie: ds_a=db403db3-6eb7-4384-98be-eb60fe2b6dc2;Domain=.docusign.com;Max-Age=63072000;SameSite=None;Secure;Path=/;HttpOnly
2024-04-25 15:18:13 UTC	631	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 75 3d 74 68 69 73 3b 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 69 2c 66 2c 72 2c 65 2c 6f 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 29 72 65 74 75 72 6e 20 64 65 66 69 6e 65 28 6f 29 3b 66 26 26 66 5b 72 5d 3f 66 5b 72 5d 3d 6f 28 6e 2c 30 2c 21 30 2c 66 2c 72 2c 65 29 3a 75 5b 6e 5d 3d 6f 28 6e 2c 30 2c 21 30 2c 66 2c 72 2c 65 29 7d 28 22 44 53 5f 41 72 79 61 22 2c 30 2c 30 2c 75 2e 6d 6f 64 75 6c 65 2c 22 65 78 70 6f 72 74 73 22 2c 22 6c 65 6e 67 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 6e 2c 66 2c 72 2c 65 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 75 3d 7b 7d 2c 63 3d 28 73 28 66 75 6e 63 74 Data Ascii: (function(){var u=this;!function(n,t,i,f,r,e,o){if("function"==typeof define&&define.amd)return define(o);f&&f[r]?f[r]=o(n,0,!0,f,r,e):u[n]=o(n,0,!0,f,r,e)}("DS_Arya",0,0,u.module,"exports","length",function(t,i,n,f,r,e,o){"use strict";var u={},c=(s(funct

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:13 UTC	1091	OUT	GET /track/?data=eyJldmVudCI6ICJtcF9wYWdlX3ZpZXciLCJwcm9wZXJ0aWVzIjogeyIkb3MiOiAiV2luZG93cyIsIiRicm93c2VyIjogIkNocm9tZSIsIiRzY3JlZW5faGVpZ2h0IjogMTAyNCwiJHNjcmVlbl93aWR0aCI6IDEyODAsIm1wX2xpYiI6ICJ3ZWIiLCJkaXN0aW5jdF9pZCI6ICIxOGYxNWQ1ZWNhODUwMy0wM2JlZTgzYjhiYjgyMy0yNjAzMWU1MS0xNDAwMDAtMThmMTVkNWVjYTk2N2QiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJtcF9wYWdlIjogIm5hNC5kb2N1c2lnbi5uZXQiLCJtcF9icm93c2VyIjogIkNocm9tZSIsIm1wX3BsYXRmb3JtIjogIldpbmRvd3MiLCJ0b2tlbiI6ICIzMDRjY2JkZTI0ZDNiMTVmZmUyZDVkZTMwYzEwZGFiMiJ9fQ%3D%3D&ip=1&_=1714058292399 HTTP/1.1 Host: api.mixpanel.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://na4.docusign.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://na4.docusign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 15:18:14 UTC	579	IN	HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-headers: X-Requested-With access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: https://na4.docusign.net access-control-expose-headers: X-MP-CE-Backoff access-control-max-age: 1728000 cache-control: no-cache, no-store content-type: application/json strict-transport-security: max-age=604800; includeSubDomains date: Thu, 25 Apr 2024 15:18:14 GMT Content-Length: 1 x-envoy-upstream-service-time: 0 server: envoy Via: 1.1 google Alt-Svc: clear Connection: close
2024-04-25 15:18:14 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Py61rDE3PdRZfnZ&MD=vHKrEBNy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 15:18:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cbe15aa1-6799-42e0-9f3e-f4d144ca4e8c MS-RequestId: 82fb882f-5564-4fe4-81d9-e6c7f67fb4d5 MS-CV: +XwoRmcY30WPhi9Y.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 15:18:14 GMT Connection: close Content-Length: 24490
2024-04-25 15:18:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-25 15:18:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:18 UTC	3459	OUT	GET /track/?data=eyJldmVudCI6ICJDQyBSZWNpcGllbnQgVmlldyBTaWdudXAgRm9ybSIsInByb3BlcnRpZXMiOiB7IiRvcyI6ICJXaW5kb3dzIiwiJGJyb3dzZXIiOiAiQ2hyb21lIiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJQYWdlIjogIlNpZ24gJiBSZXR1cm4gTW9kYWwiLCJIYXNoZWRFbWFpbCI6ICIxYmQyODFkYTQzYTExODc0YWQ0ZGMzMjIzMjY2Y2ZhMSIsIlBvc3QgU2lnbmluZyBEaWFsb2ciOiAiRG9uZSIsIkVudmVsb3BlIElEIjogImM4NWFkZDc3ZDE5ZWM3NWFkYWNlNDEyYjc1ZDdjNWQwZTFmNzFlMTgiLCJSZWNpcGllbnQgSUQiOiAiYjBjMzU2Y2Q2YWQ2OWUxNWVhMjczMTE2MTRiMTZmZDBjZmRmMzEwNyIsIlNpZ25lciBJRCI6ICI2ZGVmZmQzOGFmZGFiZjQyNzM2MmIzZmYwYzk1ODRkOTJkZjY3NWRmIiwiQnJvd3NlciBWZXJzaW9uIjogIkNocm9tZSAxMjQuMCIsIkZpZWxkcyBSZWNpcGllbnQiOiAiMzAiLCJGaWVsZHMgRW52ZWxvcGUiOiAiNTciLCJSZXF1aXJlZCBGaWVsZHMiOiAiMiIsIkxhbmd1YWdlIjogImVuIiwiU2lnbmluZyBBY2Nlc3MiOiAiUmVtb3RlIiwiQXV0b05hdiBSdWxlcyI6ICJGaWVsZHNSZXF1aXJlZCIsIlJlY2lwaWVudHMiOiAiNyIsIlJlY2lwaWVudCBUeXBlIjogIlNpZ25lciIsIlJlY2lwaWVudHMgV29ya2Zsb3ciOiAiMyIsIlNlbmRlciBBY2NvdW50IElEIjogImM5NjA0NDhhNDkxYzYzODRlMDQ0YTliNDQ2MjRhN2NjZDU0MzkxOWMiLCJBY2NvdW50IElEIjogIjE2ZmJkMDZmMWNmNzA1MTJmN2M0MGFkMDAzOTE4MWFhYWI0ZTc0ZjEiLCJCcmFuZGVkIjogZmFsc2UsIkJyYW5kZWQgTG9nbyI6IGZhbHNlLCJCcmFuZGVkIENvbG9yIjogZmFsc2UsIkJyYW5kZWQgRmlsZSI6IGZhbHNlLCJDb25jYXQgTW9kZSI6IGZhbHNlLCJBdHRhY2htZW50IEFkZGVkIjogZmFsc2UsIkF0dGFjaG1lbnQgQ291bnQiOiAwLCJBdHRhY2htZW50IE1ldGhvZCI6IG51bGwsIlBhZ2VzIjogIjMxIiwiRG9jcyI6ICI0IiwiQXV0aGVudGljYXRpb24iOiAiTm9uZSIsIkxvZ2dlZCBJbiI6IGZhbHNlLCJDb25zZW50IFNob3duIjogZmFsc2UsIkFjY291bnQgSG9sZGVyIjogZmFsc2UsIkZpZWxkIFNpZ25hdHVyZSI6IHRydWUsIkZpZWxkIEluaXRpYWwiOiBmYWxzZSwiRmllbGQgU3RhbXAiOiBmYWxzZSwiRmllbGQgRGF0ZSI6IHRydWUsIkZpZWxkIFRleHQiOiB0cnVlLCJGaWVsZCBOYW1lIjogZmFsc2UsIkZpZWxkIENvbXBhbnkiOiBmYWxzZSwiRmllbGQgVGl0bGUiOiBmYWxzZSwiRmllbGQgRW1haWwiOiBmYWxzZSwiRmllbGQgQ2hlY2tib3giOiBmYWxzZSwiRmllbGQgUmFkaW8iOiBmYWxzZSwiRmllbGQgRHJvcGRvd24iOiB0cnVlLCJGaWVsZCBBdHRhY2htZW50IjogZmFsc2UsIkZpZWxkIE5vdGUiOiBmYWxzZSwiRmllbGQgQXBwcm92ZSI6IGZhbHNlLCJGaWVsZCBEZWNsaW5lIjogZmFsc2UsIkZpZWxkIFZpZXciOiBmYWxzZSwiRmllbGQgRm9ybXVsYSI6IGZhbHNlLCJUZW1wbGF0ZSBVc2VkIjogZmFsc2UsIlN1cHBsZW1lbnRhbCBEb2N1bWVudCBDb3VudCI6IDAsIlN1cHBsZW1lbnRhbCBEb2N1bWVudCBSZXF1aXJlbWVudHMiOiAiIiwiQXV0b0NvbXBsZXRlIEVuYWJsZWQiOiBmYWxzZSwicHJvZHVjdCBhcmVhIjogIlNpZ25pbmciLCJEU19BIjogImRiNDAzZGIzLTZlYjctNDM4NC05OGJlLWViNjBmZTJiNmRjMiIsIkZyZWVmb3JtIjogZmFsc2UsIlNpZ25pbmdFeHRlbnNpb25zIjogZmFsc2UsIkJyb3dzZXIgV2lkdGggSW5pdGlhbCI6IDEyODAsIkJyb3dzZXIgSGVpZ2h0IEluaXRpYWwiOiA5MDcsIkJyb3dzZXIgV2lkdGgiOiAxMjgwLCJCcm93c2VyIEhlaWdodCI6IDkwNywiU2Vzc2lvbiBBYm91dCB0byBFeHBpcmUgQ291bnQiOiAwLCJUb3AgRmluaXNoIEhpZGRlbiI6IGZhbHNlLCJQb3dlckZvcm0iOiBmYWxzZSwiQS9CIFRlc3RzIjogImlmcmFtZWxlc3M6IG1vYmlsZSIsIlBvd2VyZm9ybSBTZW5kZXIiOiBmYWxzZSwiUGxhdGZvcm0iOiAiV2ViIEFwcCIsInRva2VuIjogIjMwNGNjYmRlMjRkM2IxNWZmZTJkNWRlMzBjMTBkYWIyIn19&ip=1&_=1714058297209 HTTP/1.1 Host: api.mixpanel.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://na4.docusign.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://na4.docusign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 15:18:18 UTC	580	IN	HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-headers: X-Requested-With access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: https://na4.docusign.net access-control-expose-headers: X-MP-CE-Backoff access-control-max-age: 1728000 cache-control: no-cache, no-store content-type: application/json strict-transport-security: max-age=604800; includeSubDomains date: Thu, 25 Apr 2024 15:18:18 GMT Content-Length: 1 x-envoy-upstream-service-time: 39 server: envoy Via: 1.1 google Alt-Svc: clear Connection: close
2024-04-25 15:18:18 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Timestamp	Bytes transferred	Direction	Data
2024-04-25 15:18:19 UTC	3609	OUT	GET /track/?data=eyJldmVudCI6ICJPcHRpbWl6ZWx5IEV4cGVyaW1lbnQgU3RhcnRlZCIsInByb3BlcnRpZXMiOiB7IiRvcyI6ICJXaW5kb3dzIiwiJGJyb3dzZXIiOiAiQ2hyb21lIiwiJHNjcmVlbl9oZWlnaHQiOiAxMDI0LCIkc2NyZWVuX3dpZHRoIjogMTI4MCwibXBfbGliIjogIndlYiIsImRpc3RpbmN0X2lkIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCIkaW5pdGlhbF9yZWZlcnJpbmdfZG9tYWluIjogIiRkaXJlY3QiLCJPcHRpbWl6ZWx5RmxhZ0tleSI6ICJzaWdudXBfc2lkZWJhciIsIk9wdGltaXplbHlFeHBlcmltZW50TmFtZSI6ICJkZWZhdWx0LTI2NjY4MTAwMDgxIiwiT3B0aW1pemVseVZhcmlhdGlvbktleSI6ICJvZmYiLCJPcHRpbWl6ZWx5SXNGb3JjZWQiOiBmYWxzZSwiUG9zdCBTaWduaW5nIERpYWxvZyI6ICJEb25lIiwiRW52ZWxvcGUgSUQiOiAiYzg1YWRkNzdkMTllYzc1YWRhY2U0MTJiNzVkN2M1ZDBlMWY3MWUxOCIsIlJlY2lwaWVudCBJRCI6ICJiMGMzNTZjZDZhZDY5ZTE1ZWEyNzMxMTYxNGIxNmZkMGNmZGYzMTA3IiwiU2lnbmVyIElEIjogIjZkZWZmZDM4YWZkYWJmNDI3MzYyYjNmZjBjOTU4NGQ5MmRmNjc1ZGYiLCJCcm93c2VyIFZlcnNpb24iOiAiQ2hyb21lIDEyNC4wIiwiRmllbGRzIFJlY2lwaWVudCI6ICIzMCIsIkZpZWxkcyBFbnZlbG9wZSI6ICI1NyIsIlJlcXVpcmVkIEZpZWxkcyI6ICIyIiwiTGFuZ3VhZ2UiOiAiZW4iLCJTaWduaW5nIEFjY2VzcyI6ICJSZW1vdGUiLCJBdXRvTmF2IFJ1bGVzIjogIkZpZWxkc1JlcXVpcmVkIiwiUmVjaXBpZW50cyI6ICI3IiwiUmVjaXBpZW50IFR5cGUiOiAiU2lnbmVyIiwiUmVjaXBpZW50cyBXb3JrZmxvdyI6ICIzIiwiU2VuZGVyIEFjY291bnQgSUQiOiAiYzk2MDQ0OGE0OTFjNjM4NGUwNDRhOWI0NDYyNGE3Y2NkNTQzOTE5YyIsIkFjY291bnQgSUQiOiAiMTZmYmQwNmYxY2Y3MDUxMmY3YzQwYWQwMDM5MTgxYWFhYjRlNzRmMSIsIkJyYW5kZWQiOiBmYWxzZSwiQnJhbmRlZCBMb2dvIjogZmFsc2UsIkJyYW5kZWQgQ29sb3IiOiBmYWxzZSwiQnJhbmRlZCBGaWxlIjogZmFsc2UsIkNvbmNhdCBNb2RlIjogZmFsc2UsIkF0dGFjaG1lbnQgQWRkZWQiOiBmYWxzZSwiQXR0YWNobWVudCBDb3VudCI6IDAsIkF0dGFjaG1lbnQgTWV0aG9kIjogbnVsbCwiUGFnZXMiOiAiMzEiLCJEb2NzIjogIjQiLCJBdXRoZW50aWNhdGlvbiI6ICJOb25lIiwiTG9nZ2VkIEluIjogZmFsc2UsIkNvbnNlbnQgU2hvd24iOiBmYWxzZSwiQWNjb3VudCBIb2xkZXIiOiBmYWxzZSwiRmllbGQgU2lnbmF0dXJlIjogdHJ1ZSwiRmllbGQgSW5pdGlhbCI6IGZhbHNlLCJGaWVsZCBTdGFtcCI6IGZhbHNlLCJGaWVsZCBEYXRlIjogdHJ1ZSwiRmllbGQgVGV4dCI6IHRydWUsIkZpZWxkIE5hbWUiOiBmYWxzZSwiRmllbGQgQ29tcGFueSI6IGZhbHNlLCJGaWVsZCBUaXRsZSI6IGZhbHNlLCJGaWVsZCBFbWFpbCI6IGZhbHNlLCJGaWVsZCBDaGVja2JveCI6IGZhbHNlLCJGaWVsZCBSYWRpbyI6IGZhbHNlLCJGaWVsZCBEcm9wZG93biI6IHRydWUsIkZpZWxkIEF0dGFjaG1lbnQiOiBmYWxzZSwiRmllbGQgTm90ZSI6IGZhbHNlLCJGaWVsZCBBcHByb3ZlIjogZmFsc2UsIkZpZWxkIERlY2xpbmUiOiBmYWxzZSwiRmllbGQgVmlldyI6IGZhbHNlLCJGaWVsZCBGb3JtdWxhIjogZmFsc2UsIlRlbXBsYXRlIFVzZWQiOiBmYWxzZSwiU3VwcGxlbWVudGFsIERvY3VtZW50IENvdW50IjogMCwiU3VwcGxlbWVudGFsIERvY3VtZW50IFJlcXVpcmVtZW50cyI6ICIiLCJBdXRvQ29tcGxldGUgRW5hYmxlZCI6IGZhbHNlLCJwcm9kdWN0IGFyZWEiOiAiU2lnbmluZyIsIkRTX0EiOiAiZGI0MDNkYjMtNmViNy00Mzg0LTk4YmUtZWI2MGZlMmI2ZGMyIiwiRnJlZWZvcm0iOiBmYWxzZSwiU2lnbmluZ0V4dGVuc2lvbnMiOiBmYWxzZSwiQnJvd3NlciBXaWR0aCBJbml0aWFsIjogMTI4MCwiQnJvd3NlciBIZWlnaHQgSW5pdGlhbCI6IDkwNywiQnJvd3NlciBXaWR0aCI6IDEyODAsIkJyb3dzZXIgSGVpZ2h0IjogOTA3LCJTZXNzaW9uIEFib3V0IHRvIEV4cGlyZSBDb3VudCI6IDAsIlRvcCBGaW5pc2ggSGlkZGVuIjogZmFsc2UsIlBvd2VyRm9ybSI6IGZhbHNlLCJBL0IgVGVzdHMiOiAiaWZyYW1lbGVzczogbW9iaWxlIiwiUG93ZXJmb3JtIFNlbmRlciI6IGZhbHNlLCJQbGF0Zm9ybSI6ICJXZWIgQXBwIiwiW09wdGltaXplbHldIGRlZmF1bHQtMjY2NjgxMDAwODEiOiAib2ZmIiwidG9rZW4iOiAiMzA0Y2NiZGUyNGQzYjE1ZmZlMmQ1ZGUzMGMxMGRhYjIifX0%3D&ip=1&_=1714058297702 HTTP/1.1 Host: api.mixpanel.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://na4.docusign.net Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://na4.docusign.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 15:18:19 UTC	581	IN	HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-headers: X-Requested-With access-control-allow-methods: GET, POST, OPTIONS access-control-allow-origin: https://na4.docusign.net access-control-expose-headers: X-MP-CE-Backoff access-control-max-age: 1728000 cache-control: no-cache, no-store content-type: application/json strict-transport-security: max-age=604800; includeSubDomains date: Thu, 25 Apr 2024 15:18:19 GMT Content-Length: 1 x-envoy-upstream-service-time: 104 server: envoy Via: 1.1 google Alt-Svc: clear Connection: close
2024-04-25 15:18:19 UTC	1	IN	Data Raw: 31 Data Ascii: 1