Edit tour
Windows
Analysis Report
phish_alert_sp2_2.0.0.0-1.eml
Overview
General Information
| Sample name: | phish_alert_sp2_2.0.0.0-1.eml |
| Analysis ID: | 1631931 |
| MD5: | eaeafc6901262c2a48f1301f0c9bce8e |
| SHA1: | fb06799ed7b4343c03659992a2f6661baa3d3afc |
| SHA256: | c0140d2b25b10be03c08161c6ab71e1ff0333c9ca0483f68341f9dbfd8e8f882 |
| Infos: |   |
 | |
Detection
HTMLPhisher
| Score: | 52 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Yara detected BlockedWebSite
AI detected suspicious elements in Email content
Creates files inside the system directory
Deletes files inside the Windows folder
Detected non-DNS traffic on DNS port
Form action URLs do not match main URL
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores large binary data to the registry
Classification
- System is w10x64_ra
OUTLOOK.EXE (PID: 6876 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \Root\Offi ce16\OUTLO OK.EXE" /e ml "C:\Use rs\user\De sktop\phis h_alert_sp 2_2.0.0.0- 1.eml" MD5: 91A5292942864110ED734005B7E005C0) 
ai.exe (PID: 7008 cmdline: "C:\Progra m Files (x 86)\Micros oft Office \root\vfs\ ProgramFil esCommonX6 4\Microsof t Shared\O ffice16\ai .exe" "865 94648-37B9 -440F-A1A2 -38150CBAD 817" "0D02 791E-45A9- 4E7C-BB4C- 3F40A8BB54 29" "6876" "C:\Progr am Files ( x86)\Micro soft Offic e\Root\Off ice16\OUTL OOK.EXE" " WordCombin edFloatieL reOnline.o nnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD) 
chrome.exe (PID: 6312 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --s tart-maxim ized --sin gle-argume nt https:/ /nam04.saf elinks.pro tection.ou tlook.com/ ?url=http% 3A%2F%2Fte fmedu.com% 2Ftunnel%2 Femail-tem plate.html &data=05%7 C02%7Cacal houn%40olg oonik.com% 7Cbbfdc199 46bd4d5a5e 6b08dd5cbb 0a23%7C341 c5aad39be4 7a3901e146 d297ecd80% 7C0%7C0%7C 6387686811 95303079%7 CUnknown%7 CTWFpbGZsb 3d8eyJFbXB 0eU1hcGkiO nRydWUsIlY iOiIwLjAuM DAwMCIsIlA iOiJXaW4zM iIsIkFOIjo iTWFpbCIsI ldUIjoyfQ% 3D%3D%7C40 000%7C%7C% 7C&sdata=Y CA8wKuMBG5 S%2Bt3WDAp yUG61MP7P5 h8oL6OdO1S pGxI%3D&re served=0 MD5: E81F54E6C1129887AEA47E7D092680BF) - chrome.exe (PID: 6460 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --no-pre-r ead-main-d ll --field -trial-han dle=2060,i ,147410388 7106550949 0,94666853 7401723781 2,262144 - -disable-f eatures=Op timization GuideModel Downloadin g,Optimiza tionHints, Optimizati onHintsFet ching,Opti mizationTa rgetPredic tion --var iations-se ed-version --mojo-pl atform-cha nnel-handl e=2100 /pr efetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
- cleanup
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_BlockedWebSite | Yara detected BlockedWebSite | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_BlockedWebSite | Yara detected BlockedWebSite | Joe Security | ||
| JoeSecurity_BlockedWebSite | Yara detected BlockedWebSite | Joe Security |
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
Phishing |   |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Joe Sandbox AI: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | Classification: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | File created: | ||
| Source: | File deleted: | ||
| Source: | Classification label: | ||
| Source: | File created: | ||
| Source: | File created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Section loaded: | ||
| Source: | Key value queried: | ||
| Source: | Window found: | ||
| Source: | Window detected: | ||
| Source: | Key opened: | ||
| Source: | Key value created or modified: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information set: | ||
| Source: | Process information queried: | ||
| Source: | Queries volume information: | ||
| Source: | Key value queried: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 11 Browser Extensions | 1 Process Injection | 11 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Modify Registry | LSASS Memory | 12 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | 2 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Process Injection | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 1 Ingress Tool Transfer | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 File Deletion | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| s-part-0044.t-0009.fb-t-msedge.net | 13.107.253.72 | true | false | high | |
| e329293.dscd.akamaiedge.net | 95.101.182.112 | true | false | high | |
| nam04.safelinks.eop-tm2.outlook.com | 104.47.73.156 | true | false | high | |
| www.google.com | 142.250.185.68 | true | false | high | |
| e13678.dscg.akamaiedge.net | 2.19.106.98 | true | false | high | |
| www.tm.a.prd.aadg.akadns.net | 20.190.160.130 | true | false | high | |
| s-0005.dual-s-msedge.net | 52.123.129.14 | true | false | high | |
| s-part-0032.t-0009.t-msedge.net | 13.107.246.60 | true | false | high | |
| js.monitor.azure.com | unknown | unknown | false | high | |
| c.s-microsoft.com | unknown | unknown | false | high | |
| nam04.safelinks.protection.outlook.com | unknown | unknown | false | high | |
| aadcdn.msftauth.net | unknown | unknown | false | high | |
| login.microsoftonline.com | unknown | unknown | false | high | |
| mem.gfx.ms | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | unknown | ||
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.185.78 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.206 | unknown | United States | 15169 | GOOGLEUS | false | |
| 95.101.149.131 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 52.123.129.14 | s-0005.dual-s-msedge.net | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 13.107.246.60 | s-part-0032.t-0009.t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 104.73.232.18 | unknown | United States | 16625 | AKAMAI-ASUS | false | |
| 52.109.32.39 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 2.19.106.98 | e13678.dscg.akamaiedge.net | European Union | 16625 | AKAMAI-ASUS | false | |
| 23.192.245.8 | unknown | United States | 16625 | AKAMAI-ASUS | false | |
| 142.250.185.142 | unknown | United States | 15169 | GOOGLEUS | false | |
| 20.190.160.130 | www.tm.a.prd.aadg.akadns.net | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 142.250.186.35 | unknown | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.68 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 1.1.1.1 | unknown | Australia | 13335 | CLOUDFLARENETUS | false | |
| 108.177.15.84 | unknown | United States | 15169 | GOOGLEUS | false | |
| 104.47.73.28 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 2.16.164.113 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 142.250.181.227 | unknown | United States | 15169 | GOOGLEUS | false | |
| 2.22.242.81 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 13.107.253.72 | s-part-0044.t-0009.fb-t-msedge.net | United States | 8068 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 51.105.71.136 | unknown | United Kingdom | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 104.47.73.156 | nam04.safelinks.eop-tm2.outlook.com | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 142.250.185.74 | unknown | United States | 15169 | GOOGLEUS | false | |
| 95.101.182.112 | e329293.dscd.akamaiedge.net | European Union | 20940 | AKAMAI-ASN1EU | false | |
| 2.19.106.8 | unknown | European Union | 16625 | AKAMAI-ASUS | false |
| IP |
|---|
| 192.168.2.16 |
| 192.168.2.5 |
| 192.168.2.23 |
| 192.168.2.15 |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1631931 |
| Start date and time: | 2025-03-07 16:39:41 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 15 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | stream |
| Analysis stop reason: | Timeout |
| Sample name: | phish_alert_sp2_2.0.0.0-1.eml |
| Detection: | MAL |
| Classification: | mal52.phis.winEML@24/45@18/157 |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): svchost.exe
- Excluded IPs from analysis (whitelisted): 2.22.242.81, 2.22.242.136, 2.22.242.105, 2.22.242.113, 2.22.242.130, 2.22.242.145, 52.109.32.39, 52.109.32.46, 52.109.32.38, 52.109.32.47, 52.123.129.14
- Excluded domains from analysis (whitelisted): ecs.office.com, omex.cdn.office.net, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, dual-s-0005-office.config.skype.com, nleditor.osi.office.net, prod-eu-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, a1864.dscd.akamai.net
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenFile calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- VT rate limit hit for: https://nam04.safelinks.protection.outlook.com/Content/Scripts/safelinksv2.css
- VT rate limit hit for: https://nam04.safelinks.protection.outlook.com/Content/Scripts/site.js
- VT rate limit hit for: https://nam04.safelinks.protection.outlook.com/Content/images/cross.png
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250307T1040130240-6876.etl
Download File
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | modified |
| Size (bytes): | 102400 |
| Entropy (8bit): | 4.497254123594792 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 58F1E95D70DD8ADBF199A1D460DE6D98 |
| SHA1: | CE525B0849542AD45E68F918DB2B3CD46C48A9B4 |
| SHA-256: | 9036A70F62AFC8AF07ADA4FB91C94D89F88EC17CC9A267AAC8C811CBE31B2101 |
| SHA-512: | 5EC596E64212985414BCF7955AA7858103F18F71575FBBBE53008F1A2A92242695D076FEE460B6434855401B90D630682128F33D8C37E2307064FDAE2521FB73 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 271360 |
| Entropy (8bit): | 2.571404653367734 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 73D4167832BB45C5FD029FCB88D05DD8 |
| SHA1: | 2DE45F23FF4AEBDBB6DB0EE003D9DACB9C176257 |
| SHA-256: | 88F4D0807C429D4940B1D676B452A6FF98F9F8758385B8C7024E5C1C3DB85347 |
| SHA-512: | BD978D12F39E30157BA34914AB65B5753230AD64A34387C18026615556473FFD1FBC1B1FB4C2C8B7F64C7395D287E4C7C21212AD0861181B9AAF1021C9EF851A |
| Malicious: | true |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 131072 |
| Entropy (8bit): | 3.8237823046275716 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 798F249D441D668DEE2870027218070E |
| SHA1: | 478C52D1D51753F7309AC736A2855CB9153B9309 |
| SHA-256: | B601C551D0F1B12F070E47667FCFCA9E35A7DE95D9F58F3401DECECE37982E37 |
| SHA-512: | B31701D3A8B23BD699099E8E6D53927AC678E5055EB158C6B0754461CA635DB914D214192A99B18E8FF1FE4D3A9DC3736837E78B1F13CBDA1D3DD53BDD078B3F |
| Malicious: | true |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 89476 |
| Entropy (8bit): | 5.2896589255084425 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | DC5E7F18C8D36AC1D3D4753A87C98D0A |
| SHA1: | C8E1C8B386DC5B7A9184C763C88D19A346EB3342 |
| SHA-256: | F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D |
| SHA-512: | 6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/lib/jquery/dist/jquery.min.js?v=9_aliU8dGd2tb6OSsuzixeV4y_faTqgFtohetphbbj0 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 149977 |
| Entropy (8bit): | 5.425465014322962 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 107489D1ED6BE77BFD69EBE4D7B52B6D |
| SHA1: | FD56DF206A1DD0223D6D18ADAC841582282A346E |
| SHA-256: | 3BBC0000E28054DDBE38B2E7A21DCA8D66FDA56EA48448BCE4658BC6B518A970 |
| SHA-512: | 51C5F6D9D7D10D06777ADE20C7E63CBFA354B830B68D32FEDE4B93C15D80873C501C0CCC4D006FD58C639662D2DCBBA193B61427D30F8938EDA4B9049743BC65 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/lib/oneds/dist/ms.analytics-web-4.0.2.min.js?v=O7wAAOKAVN2-OLLnoh3KjWb9pW6khEi85GWLxrUYqXA |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3778 |
| Entropy (8bit): | 5.004372765557715 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A824F02CF55E0619E785A349B3981642 |
| SHA1: | B4AF2FBF702319FA7183FF2B2E1696680332F27D |
| SHA-256: | 307745C6D5C2C9E56E78653EC4C88E938B68DA35A498117C0A9618DAF0ED756C |
| SHA-512: | 7F8AAD0F50EF87B243266C6DD96FF5A3453958DE19EC3D85750DE9BEAC5127D9B23C5D0345894F4A779F5EB1B34362909F932455BEA28FC500E4441E969EE482 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/js/TabControl.min.js?v=MHdFxtXCyeVueGU-xMiOk4to2jWkmBF8CpYY2vDtdWw |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 45941 |
| Entropy (8bit): | 5.396892356675533 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 2D239F75690602434780A10306B90C92 |
| SHA1: | FD2005D03A856C786D53E7B28C00F5026727CFCA |
| SHA-256: | 62124873D78845E0C099FA26D62BF1C0DEB57B78100E4A3C0F0E28AEEFD95E2E |
| SHA-512: | 3DDAE67BCF28D1EBF7718E31582635D27FE8F43C03CA2C38381AD33E09115F6B38565A307B774FD02B601E9AAD07357050E3E3DDBC2C375C3A57C00891CD8D48 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/js/SilentSignInManager.Main.min.js?v=YhJIc9eIReDAmfom1ivxwN61e3gQDko8Dw4oru_ZXi4 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2230 |
| Entropy (8bit): | 5.1220413514345156 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4D56AF8ACF934242A6D0C2D5FD5785E1 |
| SHA1: | 9D58373C57C53221C4762B87BDC186F6E38384D0 |
| SHA-256: | 6F26F0CC605A8C789C557B2956CE78D147D5D2CC16D2F09B3A606306BCA3F4DE |
| SHA-512: | 1ECA9E9FEF9757337739BC530C87AAA8B9209A14C16F570FC8041618274330E3649F6D0A7E9FA97DC45DC8BB8FDE61A18E06F98E8A48E7BC5F22D4D53CC217A3 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/SearchBox/search-box.css?v=bybwzGBajHicVXspVs540UfV0swW0vCbOmBjBryj9N4 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 49982 |
| Entropy (8bit): | 7.995657643114965 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 47B6359A09BBEE6AA41B82E06C5A6105 |
| SHA1: | 7049BB7A20217A9153F9AED16A0A6B6DF27B1038 |
| SHA-256: | EACBD5A1C958B4A2859D1D59FCDF028EDB6DD7567109218A83AA4E263A253A35 |
| SHA-512: | 16CAC5CD306721D5A117CA06CC42BBB38680697E811479F51C315A3967F5716ED9AC2A01A049BDBA027984312F268E2711E359936ED748394100A11953B231FC |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4873 |
| Entropy (8bit): | 5.2268236765669895 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | ED927CF0F8A1BE103DF48446270416EE |
| SHA1: | F7B2BE7FC2B063AAC03E76DF9F3E19D615970213 |
| SHA-256: | EBDD298DFD39A35E5F54469F12953081A17CBEA55F3A4A79C0FD4997D804F7D5 |
| SHA-512: | FCA692C8C7B104FB00C2E6D90C1A0D52A0FF93CDA626338D8FA114A0E9DCE2504DF9282868F98A46648A6E616A96ACD14CAD0460D72477421C8F5EE8F7D34256 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/MeControlCallout/teaching-callout.css?v=690pjf05o15fVEafEpUwgaF8vqVfOkp5wP1Jl9gE99U |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 30032 |
| Entropy (8bit): | 7.992249052849233 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | BE43045E5C1119DB2B2C2C38342A9216 |
| SHA1: | 5028764DAB0DEFCEA18691B1EDF769E924D5AB55 |
| SHA-256: | F2AD20DA85ABF7AD48AFBFE14E5E60A7AC5E648C0AFAECAB8751981644154CF3 |
| SHA-512: | 5ACEC2533F38057EED687121F3EB30C4072C2A64987B7FEAE2352F790352958500F499A2508777CC19DC039BB252D6531D84312F8CE26A1EAFD86A687EEB49AC |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/fonts/support-icons/mdl2/latest_v4_71.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 25664 |
| Entropy (8bit): | 4.972505404550475 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | FF4FEDB556605288FEC259EE6B8D5981 |
| SHA1: | BBC525AB65E54999044F14FF8F31CF25EEDB7754 |
| SHA-256: | 2809B6F62DC341D238F02C33C7347A7BA714F10B6F075BDD39A1CD7C68CE9807 |
| SHA-512: | 9EAE6F8D1822A1EF91B909B0D6A8826BFB323BD34FA76FBF0A2DCA99B5F580BA09173ECD2068F393979EBAE248BF5FF1FC592C5D43D5EEB33E0EC6DDE93E8349 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://nam04.safelinks.protection.outlook.com/Content/images/cross.png |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4054 |
| Entropy (8bit): | 7.797012573497454 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9F14C20150A003D7CE4DE57C298F0FBA |
| SHA1: | DAA53CF17CC45878A1B153F3C3BF47DC9669D78F |
| SHA-256: | 112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960 |
| SHA-512: | D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://uhf.microsoft.com/images/microsoft/RE1Mu3b.png |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 26086 |
| Entropy (8bit): | 5.432818104736514 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A923FB946929633E387E4D2017006546 |
| SHA1: | 84D3DCF57A9EF34EA731A1B28F9ECE4B0B267A08 |
| SHA-256: | 67A664918FD7F224CCE362DB7078440CD693E1EF6B30EFF33C06F112C17102FA |
| SHA-512: | A974D3511DD1ED3197BC6A90F9561CDB83120E99D8276C38E32C79005E59C5C7048C8652E3DF5A1DB06191B3B6793A4C75A5C2060CC12ACB36D1E6F31C2E6BFB |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/Article/css.css?v=Z6ZkkY_X8iTM42LbcHhEDNaT4e9rMO_zPAbxEsFxAvo |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 566897 |
| Entropy (8bit): | 5.427009136389396 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C0BB28600CF931A17482376C5E27CABE |
| SHA1: | 3C9B65F94334C9312F168AC51D2067D07DB3A619 |
| SHA-256: | 70EB3BBB025DC4C9CB7F7297EF68B928E4A7D9F77F8B60BD4DE6C526CF195464 |
| SHA-512: | 5957C114E0A04A949C6B8D8C104F62D810079DA249B87C8E5D3183AD7E57A4B2657C9C7BE8C87FC990754FFD8B30BEC8719A1279AB7B6ECEB114D12690007268 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/lib/ucs/dist/ucsCreativeService.js?v=cOs7uwJdxMnLf3KX72i5KOSn2fd_i2C9TebFJs8ZVGQ |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 25084 |
| Entropy (8bit): | 7.954629745011792 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9AA997545CAD62F24960E39B773AE81C |
| SHA1: | 3EBF01E3B3630F127309F816F13FF86B94798E07 |
| SHA-256: | BC5E9528086858FD7BFF758A1B0AE0D559A9930E279ECDF4955572B6AD1E53EA |
| SHA-512: | 4B2572DEA6B5C777AF39359095D97EB8078B3B252D4A70191837BF5C641B860CD4AF56719B3D96E45CBEBB13465625FD5DD6E66BC03F009487FEBEAF5D9F7169 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/images/en-us/fbf6e41b-ddbe-43db-a616-7a8e48d43d18 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4370 |
| Entropy (8bit): | 5.070419363669657 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 5F05B23BAD0F2D477C4E6B9266F99A74 |
| SHA1: | E6CC0BE0A86B8330B4FD16CE8EB27614FB313B40 |
| SHA-256: | 70099F944DDCE86C3B9E24CE88C3C489EF4C63CEF20C4DA64A5DC33BBFE36512 |
| SHA-512: | 664E997252C7A41F8D4E7A3FD34592D25809AFCD4EF9FB7A2542F9A3C05FC8F841D5F7E58DBF0A6F00C255F43C6A36D6597DDF5C7A0FFC049994002CC851ECB8 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/promotionbanner/promotion-banner.css?v=cAmflE3c6Gw7niTOiMPEie9MY87yDE2mSl3DO7_jZRI |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2974 |
| Entropy (8bit): | 5.078147905018725 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 8C4035FBAA828A7E23B8584328FE8F88 |
| SHA1: | F222869596F1E3E94C131DE6E85BF233ED1EC511 |
| SHA-256: | 0F4950468225BC51D24014536FE8004392A415EF01F0DB92A258818E74F9C59E |
| SHA-512: | 74D807189427397E2C8FC35D986616C1104E9125B39F885F61D9A1AA225D566AB3474061B39C64FF69886E5AEA8D6B4C9F28B4DCC9CB6F552D90DB0C651582DB |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/sitewide/articleCss-overwrite.css?v=D0lQRoIlvFHSQBRTb-gAQ5KkFe8B8NuSoliBjnT5xZ4 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 211842 |
| Entropy (8bit): | 5.548839465294018 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C1338BAD680C7B30034BB2BEE2C447D3 |
| SHA1: | E93C535395F25D15F4AA67E481DFCEAF94F25A1E |
| SHA-256: | 906A3B2A89AA06A9C0DA125FBF248D1F9FD188511B44D4822D9E3FCFD28197E8 |
| SHA-512: | AE28ACA7B8AAB00F7EAF2B5EBCE86F23DD1B91E711100110ED4E2B7B6A68A1284AF777EC87C652789BBBC50B5FA95A18A47A1D1F5B1FF65FDBC6E56EE6FA31E7 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://mem.gfx.ms/scripts/me/MeControl/10.24228.4/en-US/meBoot.min.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 16 |
| Entropy (8bit): | 3.625 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | BEB5075867AC37A3C8903AB23A5ABA22 |
| SHA1: | 86A41106441F795558A31574CBD24D5403E2F054 |
| SHA-256: | BD38B37956C818D4084814F47B69B7798F07AF7889D3D13DEBBD2D76ECB86095 |
| SHA-512: | 976D88CFEF9792BC882CA8BB7F7F784BB97EA2046999D67C43DD4C2391943238BF9EE3DECD50DC2495829E65E9281D999E1272B188B489B1AFF59AECEE3E139A |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCRXvh1KIffkBEgUN6X8KXiHFZLB2FIwrCw==?alt=proto |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 91802 |
| Entropy (8bit): | 5.3603423050848615 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CF5CC7F4B57526CC37893DCB83DED031 |
| SHA1: | E953783BE0A7894585778455AAE3D0DF094D6F29 |
| SHA-256: | 3A790B6C0D26D7A4D292CB27F992EAFAFF42C37E9318B2AB704207039127FCB8 |
| SHA-512: | 2320F9D7811CD773C1E5C2E95A31B39E9FF62A2FA7CA431975873DAB57AE42A75BA720D15AEB47FA2EA127D0766EB5AA15040CFFD04BF7A8CB8BCD7236069C40 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 36888 |
| Entropy (8bit): | 7.993610144308659 |
| Encrypted: | true |
| SSDEEP: | |
| MD5: | 9B0D118DF2786766F3F2ADBDE755ECEF |
| SHA1: | 6256A445CD294EF0EDFA22D410AE40E45355BB3C |
| SHA-256: | F610165947CB23BF323DAA9848F04657202FA468D32D9D3B0C5B6D6EF43852CD |
| SHA-512: | 17B90804883C285BCE6E605DEB1AE7A6C556D9E9E8F0D87136F77A1A1F17C5AD2234B04D13CA7485EC205C8A1F4F25BC8DA3D3BDAC1CA0E988044E6861315403 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/fonts/support-icons/fluent/latest_v2_11.woff2 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 7532 |
| Entropy (8bit): | 7.9007300306218635 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 530E019ACA1B16CCCC6D7F9AF809A5EF |
| SHA1: | 44DE170BF83E1D8DC50DB4C09D01B2AF567BA394 |
| SHA-256: | 180B72AEFEC3FB19BB76E97D00EDF90932D02A9A4DA4CE82711E263DC16971A5 |
| SHA-512: | ECCBA579624B1B5C859F1A89C0BB9157A64D80C6E82E29950802D9874F600FEC817234DF4F84A5030EB3E2A2B124A0EA4D3A5F752B470847A0B68001C9C5121C |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 20946 |
| Entropy (8bit): | 7.93232536946356 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 68B6034D22E6083CF2592BF4B8B71F0E |
| SHA1: | 0981B22AF5F2BF930794557717FF7C7F4FF563FF |
| SHA-256: | 56E5D47C342207184BE9DE6E3CF06CF26C32B34EE799B3ACC95EBEEEEFA5484A |
| SHA-512: | 3CDA6510769E8EE427103B1D76A0035E2A3E62C4EF0E789DBC28969B12F2DF2C1F7E7652FDF9CC99C7C086CF2764A19520D15A5FED86ECC5CAB9D9F77D534E93 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/images/en-us/9e557d93-f803-44df-a274-1282d542cf63 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 72 |
| Entropy (8bit): | 4.241202481433726 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 9E576E34B18E986347909C29AE6A82C6 |
| SHA1: | 532C767978DC2B55854B3CA2D2DF5B4DB221C934 |
| SHA-256: | 88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D |
| SHA-512: | 5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124 |
| Malicious: | false |
| Reputation: | unknown |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 6125 |
| Entropy (8bit): | 5.234103429010352 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 97C18402D0D5AD89F12C548A55C8284F |
| SHA1: | 412ACD023C48FA79C9F846040497C74C2EBEC46D |
| SHA-256: | 464730FF27CB58E32D39C58E96330E89983298C72B1B4183A68E0B7FE4D4CCFA |
| SHA-512: | 38C551DBEC500AA1C450FDADE3E24FA16E71066F7CD75E103E6787C8687838E89BE49181C491F1234D29D7CCECA2B9C0C9FA20010548AD4E5F83D66D0AD1F02F |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/feedback/feedback.css?v=Rkcw_yfLWOMtOcWOljMOiZgymMcrG0GDpo4Lf-TUzPo |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 780 |
| Entropy (8bit): | 4.992440844788031 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CB3531F56366637C3E928C625264646D |
| SHA1: | 3F6B2AC9B3A9C76EF8410FCA587105F1D95238A5 |
| SHA-256: | 47F3F44C9BC3F47A111D004476F051D5684D9FB7526EF3985A6540F6D6B16E93 |
| SHA-512: | 5E99E7DCADC11B1BD462D4CE8C1BF4334857E830EAFD4AECBD689F9C3869689D25A568C8B91ACEC69E7A6B1E2FD033DB47D7F84DC260F92BE3823203FCDB8D1A |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/ArticleSupportBridge/article-support-bridge.css?v=R_P0TJvD9HoRHQBEdvBR1WhNn7dSbvOYWmVA9taxbpM |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 138067 |
| Entropy (8bit): | 5.225028044529473 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | B9C3E4320DB870036919F1EE117BDA6E |
| SHA1: | 29B5A9066B5B1F1FE5AFE7EE986E80A49E86606A |
| SHA-256: | A1FE019388875B696EDB373B51A51C0A8E3BAD52CD489617D042C0722BDB1E48 |
| SHA-512: | A878B55E8C65D880CDF14850BAEE1F82254C797C3284485498368F9128E42DCA46F54D9D92750EEEB547C42CAB9A9823AA9AFAB7D881090EBBFA1135CDD410B6 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/lib/uhf/dist/uhfbundle.js?v=of4Bk4iHW2lu2zc7UaUcCo47rVLNSJYX0ELAcivbHkg |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 26288 |
| Entropy (8bit): | 7.984195877171481 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | D0263DC03BE4C393A90BDA733C57D6DB |
| SHA1: | 8A032B6DEAB53A33234C735133B48518F8643B92 |
| SHA-256: | 22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12 |
| SHA-512: | 9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 30703 |
| Entropy (8bit): | 5.276524052892625 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | CCA58D6BF875D0CE4EA493CA26386A89 |
| SHA1: | CF87086E72249F7AD2D687D7BAFA90E1E44960B7 |
| SHA-256: | 7780D5D6323B0EAF447C4DF757470A3433035F8F5D00EBDB33F49F5CCCEBFE11 |
| SHA-512: | E98BDF460BC6C01216B4E128B8D033399F227B7112BCA8554F0F937231F8E3CB8848A9EA81FFFD0F987BD7CF0F037B834B93E4F898444241C93000465891ADA7 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 10966 |
| Entropy (8bit): | 4.77740316827377 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 3E3EA0F20789B9C194D77279528CA129 |
| SHA1: | 99602884211E9F11410506099E1B4D44D7F17CF1 |
| SHA-256: | 54E9EF853E38D4F6B2D1600A1F981D7175E2817A62B8D6DA41C23D0E05F2A031 |
| SHA-512: | A5E62AC34C3BE244E384D962323298C51290CABDF62EFB385F8A07CC1E5FD99B4CB56F43B8722FD5B1CDEDD78600E240ED6238C7DB2D007ADB9771B7DA400F5A |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/glyphs/glyphs.css?v=VOnvhT441Pay0WAKH5gdcXXigXpiuNbaQcI9DgXyoDE |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3385 |
| Entropy (8bit): | 5.293928956465786 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 838B4CF03009164350BEE28EC54B1B28 |
| SHA1: | 7289901F526CD15984F080E40BBF8B8B6098EB73 |
| SHA-256: | 70C7CD74052E7BB3716548F7748B7FBF90C8BB39B0F688495B5D3D8974295A72 |
| SHA-512: | 48763334DD0DE579917B94CC53A7D002AFF1D5EF46D2D4BEA8991B05ACB355CD67A21495751EDCB89DFB0A6AE3F773419DAFF49A6DFE9EA48CC8E80BCBF99BF1 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/StickyFeedback/sticky-feedback.css?v=cMfNdAUue7NxZUj3dIt_v5DIuzmw9ohJW109iXQpWnI |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 104754 |
| Entropy (8bit): | 5.250077681557217 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A65031EAC12F6D3D621FB7F5F9698A63 |
| SHA1: | E48A784F0873B8CF9AFCC69DC6912F4DD228839D |
| SHA-256: | 4A3A797FA54F36A7EDB2959A3033F30D5EB9B4E436302C971D56C461E30D12AD |
| SHA-512: | AC52C3F91FF73E0C3D6BA1FE876288B16203DB82AEE15C2A76DAC3851FD4711B4E89C12D4D046F8A2AA484129F1B1181EE170CDDBB9F9C82C07F6BA3D40ACC8C |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/Article/article.css?v=Sjp5f6VPNqftspWaMDPzDV65tOQ2MCyXHVbEYeMNEq0 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3690 |
| Entropy (8bit): | 5.141541571595828 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A249B03B72AB5E7B60E7806457B9BE61 |
| SHA1: | FF0B5F4FB91A9DBF147262AD59B292C6C2DFE122 |
| SHA-256: | 48FF8C6449BEF199F206C7A1C49403E10DC6341A9D4A1F8946B042DDE66E315F |
| SHA-512: | 29F204E3813972DC76FCE3DD6715093646EB0DA52DEDAC5E7E09B618E5CF8703CDE95D463727EB29F90D461D0C5A73B5701EC39B994A268103A06306144A6F34 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/js/PromotionBanner.Main.min.js?v=SP-MZEm-8ZnyBsehxJQD4Q3GNBqdSh-JRrBC3eZuMV8 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 11071 |
| Entropy (8bit): | 5.11413502481264 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | F8BBFC7AA538BB412A5F94737E74CB9E |
| SHA1: | BCAEE8BA1F100BDBF0233B034DE5D4FC90158055 |
| SHA-256: | 1FE043C5C3AEEBF5A48A03651FAF147C22632FCDCE49DC385F122CEE7663424A |
| SHA-512: | A81578CEFA03D9BAFD9ABCB417697E72F8EF77098FFB7D88DB9148856A4D99303B9B0A5CAFE246A56BD04AEED7419CE100F0AA2FF0CC7681C13CC673A817DA31 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/js/Article.Main.min.js?v=H-BDxcOu6_WkigNlH68UfCJjL83OSdw4XxIs7nZjQko |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 17028 |
| Entropy (8bit): | 7.926562320564401 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | DDCB4FCA39CCADCDF6C1FE2E1F717867 |
| SHA1: | 88238D53920F32AF37A802A5E6BFEEC3B1E6F75D |
| SHA-256: | 097DF2DFA3781F1AEDB631C968D04D8152D7C7FA8E92BC91E233B3000E2F34BB |
| SHA-512: | 316574E565EF67B97E13D0BF01CF4AFA8E0E9CF0748768CE4AE6BBB81352685A6E027EADBC083D2B632C412C950E65963E6EA98FE4CE7692C0AE0B6D956D3D37 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/images/en-us/a9241eee-a729-4513-97b4-5b87c381c21b |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 3932 |
| Entropy (8bit): | 5.202197618496175 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | BBAD95C4A0BE4E5775B7D5B409FBF602 |
| SHA1: | FAD598750B15C207DFEF6E1FEA3C072BAEAC2B66 |
| SHA-256: | 41F78D15AE18C36B84C819D9AF3511C342C180F0ABA8F91DC1CCF4046B56B308 |
| SHA-512: | 4006994F240E4DAB7134F1B716E51E4FFC0DD495EAF3269165FB0C27D89B2F19063AF17086553B39507199D62DBCD8BA6F07F34770BCAF15C40CF5EF06419631 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://nam04.safelinks.protection.outlook.com/Content/Scripts/safelinksv2.css |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 171859 |
| Entropy (8bit): | 5.043961161012678 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 97A7AD53DCC2CB34895CA7932A24F1D6 |
| SHA1: | 0CD7562FCBB6E6782F379EA4AEDFBC1FD68916BE |
| SHA-256: | A4CF9C20DA583D6053F6D120467224875DE6C3F740FAD08ABD1E041A0C3F18B6 |
| SHA-512: | 616595A1450DB203CBAE3485F2C079A36AAF82B625585783E063D5169EBF48AFD42DD98FD3BF39EA248CE5CD4AFD074B6B14C07D557E7672A0DE9E451683AB47 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/60-6a98d7/c9-be0100/a6-e969ef/43-9f2e7c/82-8b5456/a0-5d3913/84-6d4f33/ae-f1ac0c?ver=2.0&_cf=02242021_3231 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1230676 |
| Entropy (8bit): | 5.468391348753175 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 4730ADC834E2A7DD777A49738B957BA5 |
| SHA1: | 9DAB5916633383DB2799B83B972D31B5948545FC |
| SHA-256: | 67314E6307110FDA53BECA76E9E82BA025D888AD6599ED8F35CF9233794877DF |
| SHA-512: | 5813DA927DE7E3A060813ECAA65EFD106FE0E7DD9C90AFD9DE55C88A325231FA997D5282BDE3D2AA8DCF7BA8AA7A134E925891BCA386D0F1526E3E10FBCBE1CF |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/js/Support.Main.min.js?v=ZzFOYwcRD9pTvsp26egroCXYiK1lme2PNc-SM3lId98 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 4222 |
| Entropy (8bit): | 5.765568153820395 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 32660AE318E2B32E6EEE2BC0A1FC6049 |
| SHA1: | 8E52EDA53094DC4FE1948A71920130C5341AE34E |
| SHA-256: | 2E4C459AB12B783D0B1FC4694E5A0762C511D394FAA504B3BC3B0358355CBD4C |
| SHA-512: | 9707B0C3EB5C75413B147D910CD885BBC8CB9B798FE989108C887C872078BE199CA97CAD9A3EE96AA0EF74E1A2ED1C5341BC8EF678AB1AF654870F43C20CCD9D |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftefmedu.com%2Ftunnel%2Femail-template.html&data=05%7C02%7Cacalhoun%40olgoonik.com%7Cbbfdc19946bd4d5a5e6b08dd5cbb0a23%7C341c5aad39be47a3901e146d297ecd80%7C0%7C0%7C638768681195303079%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&sdata=YCA8wKuMBG5S%2Bt3WDApyUG61MP7P5h8oL6OdO1SpGxI%3D&reserved=0 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 21727 |
| Entropy (8bit): | 5.232101618468897 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | C49C34EE38F103BCB82F58DED32F57DB |
| SHA1: | 757C8CE6D92102903F636C20B70E414A5E9A2E20 |
| SHA-256: | BDBBDA3BD97031FF5BCB76B427D2ECD9C4617922C3860F662E51FB18AC5CC591 |
| SHA-512: | 5C5307784F8B7D3CF479154CADF3525D1D1BF05216D72BB32ABEF6E25183E26FB4D84DB7B14AA2868B11F54E23284D02BFE0309EE4D560AC79A507F762DBC219 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/js/feedback.js?v=vbvaO9lwMf9by3a0J9Ls2cRheSLDhg9mLlH7GKxcxZE |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1588 |
| Entropy (8bit): | 5.174121809218917 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 3AF1FDB9A3F664A6683D212F4787733A |
| SHA1: | 59063D49B723A1988236C8D39C2804C6EBC5FF95 |
| SHA-256: | A9CE4840FF0D613B456081DEA64E46EB717A1F8BFA5AFB05D3BD058F294E416C |
| SHA-512: | F8872E0C875BE6037C14480630E461FC1ADFA2049DB03BAE5D8CB6B320A2C084D4B266AEB02E24009B4BA84821E216690CA875B165164447FE8329B48C9E261F |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://nam04.safelinks.protection.outlook.com/Content/Scripts/site.js |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 1789 |
| Entropy (8bit): | 4.942432446447246 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A994A7E8C64A7067E10B96EB4EC80FD8 |
| SHA1: | 20AFCA199B332D7BF7D0FC629C2AFF30EEE2E20A |
| SHA-256: | 5D673164F48498DDED9C758054C385B0094F26AEDABA0E3D7D419BF2C693363C |
| SHA-512: | 5ACFE9825A27A1C0A35B9DDEC6C69F99FB7718620AC9186B059F9D9953D8CDA0C0780754568A32DA6C33547D9E71DBD79A3F167B58BAF114E352D6E185836224 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/css/fonts/site-fonts.css?v=XWcxZPSEmN3tnHWAVMOFsAlPJq7aug49fUGb8saTNjw |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2728 |
| Entropy (8bit): | 5.253272384445131 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | 468D4ACC570CFFC7101AC8A63514AD31 |
| SHA1: | 6983E89B6EC798B5B8C2B3B76D9311808437B572 |
| SHA-256: | B4B342F2025799CA602A75590B324E7493B0903726720BCE4CA793207C83255C |
| SHA-512: | 9042A219E8511FF281B9F680B3577CE3EAE29E881F24BE1D2B46C89D1F0013E30AA890C1A0181FF83975E125F62C0C6E896D3B8515067221143D9A3290B42865 |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/js/MeControlCallout.Main.min.js?v=tLNC8gJXmcpgKnVZCzJOdJOwkDcmcgvOTKeTIHyDJVw |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 558 |
| Entropy (8bit): | 4.98634955391743 |
| Encrypted: | false |
| SSDEEP: | |
| MD5: | A3BC5418F2834309CE2918B15F3B8EEA |
| SHA1: | 62BA2712C6D4960F1057E103F6E1F3C95F2C701B |
| SHA-256: | B2B62643A7C4FE4A4E12934AD819F0293CC00181B78D8091AFFFF3617CEB96B1 |
| SHA-512: | 460E22E36E93BEC194D00D47754108539D2E54FF59D4293EEC25463BC3D642879C10D9BBFD881BBE5EC244819F325C422B6D7A7504000BBCE432E4D2A08FB58B |
| Malicious: | false |
| Reputation: | unknown |
| URL: | https://support.microsoft.com/js/shimmerExperiment.Main.min.js?v=srYmQ6fE_kpOEpNK2BnwKTzAAYG3jYCRr__zYXzrlrE |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.095349796557954 |
| TrID: |
|
| File name: | phish_alert_sp2_2.0.0.0-1.eml |
| File size: | 18'283 bytes |
| MD5: | eaeafc6901262c2a48f1301f0c9bce8e |
| SHA1: | fb06799ed7b4343c03659992a2f6661baa3d3afc |
| SHA256: | c0140d2b25b10be03c08161c6ab71e1ff0333c9ca0483f68341f9dbfd8e8f882 |
| SHA512: | 1cfda9bd9c1b101704f0c4c225a0b363e529c297bc39ebedd15bce115f77c0d426662fdeb173c6b02972478fdc926579afbfc21b3b2d98cb2359fd451ebd7be4 |
| SSDEEP: | 384:tELQUDyLkTY1kLBZrcQlP5+LGirhsfuor1/OjKRtRhlzmEKLiEOLSKOL+iMRrB:tAbDySY1kLB9Bqsfu81i+z |
| TLSH: | 58828EA1E89868661BC732DDA2217B0173D661C685A7F8C030BEBBC126C7455BB5B70F |
| File Content Preview: | Received: from SA6PR08MB10307.namprd08.prod.outlook.com.. (2603:10b6:806:408::9) by SN6PR08MB6061.namprd08.prod.outlook.com with.. HTTPS; Thu, 6 Mar 2025 14:28:38 +0000..Received: from MN2PR15CA0045.namprd15.prod.outlook.com.. (2603:10b6:208:237::14) by S |
| Subject: | [EXTERNAL] OCE0319355 BILLING REPORT |
| From: | Lori McCormick <Lori.Mccormick@zust.com> |
| To: | Ajayi Calhoun <acalhoun@olgoonik.com> |
| Cc: | |
| BCC: | |
| Date: | Thu, 06 Mar 2025 14:27:33 +0000 |
| Communications: |
|
| Attachments: |
| Key | Value |
|---|---|
| Received | from BY1PR06MB9096.namprd06.prod.outlook.com ([fe80::fd1e:1696:8b67:9944]) by BY1PR06MB9096.namprd06.prod.outlook.com ([fe80::fd1e:1696:8b67:9944%6]) with mapi id 15.20.8511.017; Thu, 6 Mar 2025 14:27:33 +0000 |
| Arc-Seal | i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ccR3CP+zKHoUSmIyuMFg877ecoRGJfr6Ajt/tKOvQskr/x44sffsCqjMJDYffuKRXLW+DDuXzOrh12BkAtLCIbRR8zBpwtolu4l2FK/XvzgCODOgIW5wG6N0Y65H8+eOVf7JtsLX8ut01/cpvA1wOzJWUtW1dq1FtQOZmkM94MjIXtqE4ZMkCB/7isIm+zWPwjRiHEXlfYHjfRJQlpxAoGjeSp3uZlTezTTF+vwoAysdPz4HARWAtf6vQEFXvblBdzhWFxbKPD54FhUIbElYFhOGgS0mXKBgz8vgZcyaLIwEI1MXMMcgtSXf0TBoG9eNwK983J6iY4cFyPehy3mbhA== |
| Arc-Message-Signature | i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=uc8QbE++lSrVV6TjIMtULQNoNbU5qkpudNkHtDmPBy4=; b=UcERKPJnRrxSIWwLnNKw7rqUpQQh7Hh92i//SEdO57Yzg4tzQlqca1bMQ560No8fI2DFAufCKWVxGT5fzP7iw5C3oqEl2yf0Nv0BAV67WqeHRqypPE27iwFZJiCbeRmf980WiqYwNZC/F9CKlC7l+zHw6M2XXFpbqwnuXvEVmsv0oqETxPFXqOqQ/Bzi1eWCGH5uop9G/uwrSst9t58o2sooawwxIz7n757rdUZSqFff1A5gCyay+GNDIzuk0i6Vj+av9uQ/hMIo09JGvNrlK3ZRVlelI4bl8Vs7OFkx5GrH8W0kTzNe/axaDHDq/WChQZjm+YeETAPIV/X4U2fMKQ== |
| Arc-Authentication-Results | i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=zust.com; dmarc=pass action=none header.from=zust.com; dkim=pass header.d=zust.com; arc=none |
| Authentication-Results | spf=pass (sender IP is 2a01:111:f403:2408::72f) smtp.mailfrom=zust.com; dkim=fail (no key for signature) header.d=zust.com;dmarc=bestguesspass action=none header.from=zust.com;compauth=pass reason=109 |
| Received-Spf | Pass (protection.outlook.com: domain of zust.com designates 2a01:111:f403:2408::72f as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:2408::72f; helo=NAM04-BN8-obe.outbound.protection.outlook.com; pr=C |
| Dkim-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=zust.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uc8QbE++lSrVV6TjIMtULQNoNbU5qkpudNkHtDmPBy4=; b=psp/M4dH4PdKkYYLQzHTTeGIzethVd92On7kcGG7im6tu4dnkzvqg63ngbjfiYygelUUX5+SD20jr5UY/3L7YoFuzOlHccuSOwBNLmNLlGbKWb0ATYcm0HdXnYtQzxxEn8NAjY80KHwuOXwDxDPczZ3WA7HEbc0unkQi5k3L5lc= |
| From | Lori McCormick <Lori.Mccormick@zust.com> |
| Subject | [EXTERNAL] OCE0319355 BILLING REPORT |
| Thread-Index | AduOmSEYsnoK2Uv3TeGl54fjU8ZzeQ== |
| Date | Thu, 06 Mar 2025 14:27:33 +0000 |
| Message-Id | <BY1PR06MB90968185D6677392C1FBAA8EF7CA2@BY1PR06MB9096.namprd06.prod.outlook.com> |
| Accept-Language | en-US |
| Content-Language | en-US |
| Authentication-Results-Original | dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=zust.com; |
| X-Ms-Traffictypediagnostic | BY1PR06MB9096:EE_|PH0PR06MB7637:EE_|BN3PEPF0000B370:EE_|SA6PR08MB10307:EE_|SN6PR08MB6061:EE_ |
| X-Ms-Office365-Filtering-Correlation-Id | bbfdc199-46bd-4d5a-5e6b-08dd5cbb0a23 |
| X-Ms-Exchange-Senderadcheck | 1 |
| X-Ms-Exchange-Antispam-Relay | 0 |
| X-Microsoft-Antispam-Untrusted | BCL:0;ARA:13230040|1800799024|366016|7416014|376014|27013499003|38070700018|8096899003; |
| X-Microsoft-Antispam-Message-Info-Original | LR5nMs/68VRz9dcWhR3AezY+aEVSkfrivneHdo5d/+pAu1+4TTXTBpPm9281WHfdxHCwhr4IBhhvUwOT+ns6kbBHhvWQFlU158oP2ZkRRiKp3MyRxKKbeR79DOGjAVz5dDgSyDJlOaCjBYdcdkZk9Y1ZrQPvdgfguifzoPrLD43gI++wVXYHIXAcv1GN4kh3RAp7avEJzi/lWihXJGHCV+Diu1yOboPQTuql5wD8/5CZD4A8BkfirTGjEF1dEvfHLBUrjPcnmfR5gr1FpED/1vr0ctvdOZKOzy3QjNGLTSyIZ7r9BB0THXuO+HGfQEMC/LKhCONjgF/R+hAvVIZ5BATZBKwHTDSENsYEfi+TzOqBYATa5KKsC7PyAViuy0WNA8aAMQkcmeew9pBJ5C5PhEapBoPPzDQ0jb7gpLiUyb8FBXY2IXFoTirecC+Sg3uy/yVTGdv5QGnqYG6DNsPN2hOY5XTVlwfrXkV0yqvf4qJVLcNXPq+4DIeOSGBbqkNi2MUu5TuSYYQb9jlrh+pvuVUQ0JQHFjMZLrJjThV0EXbIIRD5pWsCFwdhlaDodOKWnxw/62MaaFw805MvlxmHsR3gXLUFRgkg4LaXQqTs8Raa8ETgwF4ecw2XGYucFhCEVZzGzOZngz1Wdh8Rp6l/rH8P5JYNTt6mw3Yp3u8/7FjFvtQ+grsxcidaan9PY77sl8yBMJjcNf5GRjUMX2GXv2A92T2zv7NFdvzbKlsQ1V+IQpYqxDgEGRz/2aFhn54udFheE9TMqBdRQ5S7IwOMYtkcOBd+EaYkhjn2JlpWwN3bkdks8vslfwZt3zehv/XjI3+LYlX3hq8UFiGad9L0J5ZGKybMX9SVepY9ySzvAbiJJeD/BxHm0I89DZWpWDPcRisHh8qPzEPmHTXCjqHsofNJdDB4wMWqAPWiUTbP+DTlelObwTHFqwgV/EPEttXhvOQ8TL66H9qxaGaBqUpt9yUAl+o+30PyDq1Xn60uX61ovAFbQMpwgLJIUVs/JxH1n1WBHqrhr8GEhGHRZOMla7ctTOB3qlz/zHKLcBhLdAR50cJGkfHVSFnTH7R5yGLdGuMMYk6r5waS+KxYWUBjPf5zDc/um29Jz0kCNtz7MZsN+/iQNkFCX0vznnZRhtycq5kJ3Ep/ujQrUIEZMcolqNIADIBDDNq+Wmdu149wvJv4FZkZBjT0Vm01BZ9CVEtTekT3Bi1j4Ew5xJB/RIwVRhCIU7UJcGaesgkhOUCP8dLXXoynW5pBWhplF4JPVNnz3Db/6RN2KH8hDq9HTJCbldRzFhBi/GdfxrydQnjGiW+0OCcQEyiVQlzaQkQHFFJAa8yehvH8qOvDt5Sz69/OxRnQF+BASpgyG5fHcFG/QAwD1yIgccO00bjK2S8023Sd |
| X-Forefront-Antispam-Report-Untrusted | CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BY1PR06MB9096.namprd06.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(7416014)(376014)(27013499003)(38070700018)(8096899003);DIR:OUT;SFP:1102; |
| X-Ms-Exchange-Antispam-Messagedata-Original-Chunkcount | 1 |
| X-Ms-Exchange-Antispam-Messagedata-Original-0 | YEJ6cuhCbaL3ElVGWQ+BLUJIhB2q0TwwHwr+NfZFk/jJsv8j0bDoBCXYvBNED67iURHv7dmYXxGxcV7t2sPU4fSuPPd1fYO7H4p8pT6kdHHAZaY/QG1wy7FF/cNtr5B7YZNyhJLcKRtslHCtkYBATZ56RdeU7LWD24d0+Wq9O14mjxUcbTDg++5cFR38ulq1b5+c+FHbdr334OPRi0xeYbAjtdBWGXJCT07XtF5rX4WsLE583K7EVMAjONP7OTS+4Y0a65rMWO4fD71h4cjxMpqKiPAzq2BBWZibB/hSZ4JPFIvrCK8EcJ2aexIlGoE9xGnZbHfUg8vOemRPFd7Tq90Prs/CEmkeTcRcT22j72/aYAAQNXyW8/q2QD1WujA37xA+AEFoTNbLyxHGvWkXH8YeJx8gUM920rz3PakptHZ5bjR1nxHK3z1ax2jH2KUt4zVQDT4ZuhkOZKbVwYqSWDcQ1FUYMjI+BPBOZAC8qyhuy33ZbnL35mQgVvzBYJx7W7F1sBQPjNh2t3a8S2kE2mmwvhexGwW5j0lA/C+9Iz1++oFxqaXle92WetGww7uKGM8Cm7y2kbltuMEBhjGKtS1lC0TjxJTtxs0fswcYFwDGGg42If52F3KF6X6Xl8FstiQf8mxq9j/lnoQsOOhoczOhHZnoVvh0D274YcXAMaSlIaxA5szquDSubYx+svC0TcfnnsUDTXYu/lRcZQnRWep25HgBFiPz2QAKHsqw070ziK6FADdokrUFbYr19Jxbfwazu5ZuOXiZyXyr7zxW+mb1YkqHMyRSuEYXh1B+9VjM3WB98ix32o3XEeq9LeFqKlS8Eu7z52Q7e8iU7U7Au8gjpG/mEZaE3iZpCe0UvV31HZlAU3675DfxgfPxuXZMltMOGGpt1h3+BKLJ2N9kI7Wf7IYvy4FSd4GBAoO/dYpNcPCqf3z6xrc/vYm5+GC+HVGjc/HUwk/z5E9NUOthb3YPiqVqgbi89a5XXhV5dYaX/Fyodld6QhZk1lvjm74ZeVT54KDI/PVPT+Rf0bsAt6Xr77iO983Sl9W8tMxaScFoFm1ultFNn98ftfdeMiS4f9GmjIHaBH71Lzap3Jij2G8rHKCgxKjkxaNc9pcrtqaJ2GVHR8OJiYlBMUgKuLMrR0MXI78LNakNBUfPOBBYUWFgDeQFuOF2UmdbXv9sA/oKIH+2nKkA0wz2kPaTvpEM+tafGHOgthHIyoIhwpPg5jEUF8kn4yR/v0G3qSRCoOjFendmJQyApDJZuO2OhuyfmF+KsvBuQ7l7rMlnLKY/mfb+wJBcYoz7Fw6PbmbZNjcUP09aXKeDfGcKIOKI23rx8eHNvQ3FSZuUXaT9tWN3T0Tw5abi46RMXqRuVWXFGIfbCjFHZFIhJswONW0kRNBR9lmSFpDSK10S//HUGlPgWVwRRuEecGuEBPtRXzx+AfYJjOcupARNBzWmYLZtiMgwSbiQHrKs7+E3LNpIkV1O3/inwMM6nrMbM62ad/Cb2tTe9lSbGgFOnhKqJd/R8FzTnyfSVT0gzu+C0gNH6dhzpspoDRUcC+vE9ho+Alj6STe9S2SSlhotB3hY7XpHKjJY |
| Content-Type | multipart/mixed; boundary="----sinikael-?=_1-17412713788830.8893967548744428" |
| MIME-Version | 1.0 |
| X-Ms-Exchange-Transport-Crosstenantheadersstamped | SA6PR08MB10307 |
| Return-Path | Lori.Mccormick@zust.com |
| X-Ms-Exchange-Organization-Expirationstarttime | 06 Mar 2025 14:27:35.5208 (UTC) |
| X-Ms-Exchange-Organization-Expirationstarttimereason | OriginalSubmit |
| X-Ms-Exchange-Organization-Expirationinterval | 1:00:00:00.0000000 |
| X-Ms-Exchange-Organization-Expirationintervalreason | OriginalSubmit |
| X-Ms-Exchange-Organization-Network-Message-Id | bbfdc199-46bd-4d5a-5e6b-08dd5cbb0a23 |
| X-Eopattributedmessage | 0 |
| X-Eoptenantattributedmessage | 341c5aad-39be-47a3-901e-146d297ecd80:0 |
| X-Ms-Exchange-Organization-Messagedirectionality | Incoming |
| X-Ms-Exchange-Transport-Crosstenantheadersstripped | BN3PEPF0000B370.namprd21.prod.outlook.com |
| X-Ms-Exchange-Transport-Crosstenantheaderspromoted | BN3PEPF0000B370.namprd21.prod.outlook.com |
| X-Ms-Publictraffictype | |
| X-Ms-Exchange-Organization-Authsource | BN3PEPF0000B370.namprd21.prod.outlook.com |
| X-Ms-Exchange-Organization-Authas | Anonymous |
| X-Ms-Office365-Filtering-Correlation-Id-Prvs | 9bb354af-024a-4a0d-b48b-08dd5cbb08f8 |
| X-Ms-Exchange-Atpmessageproperties | SA|SL |
| Noolgoonikaddress | 1 |
| X-Ms-Exchange-Organization-Scl | 1 |
| X-Microsoft-Antispam | BCL:0;ARA:13230040|2092899012|35042699022|12012899012|13003099007|8096899003; |
| X-Forefront-Antispam-Report | CIP:2a01:111:f403:2408::72f;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:NAM04-BN8-obe.outbound.protection.outlook.com;PTR:mail-bn8nam04on2072f.outbound.protection.outlook.com;CAT:NONE;SFS:(13230040)(2092899012)(35042699022)(12012899012)(13003099007)(8096899003);DIR:INB; |
| X-Ms-Exchange-Crosstenant-Originalarrivaltime | 06 Mar 2025 14:27:35.2395 (UTC) |
| X-Ms-Exchange-Crosstenant-Network-Message-Id | bbfdc199-46bd-4d5a-5e6b-08dd5cbb0a23 |
| X-Ms-Exchange-Crosstenant-Id | 341c5aad-39be-47a3-901e-146d297ecd80 |
| X-Ms-Exchange-Crosstenant-Authsource | BN3PEPF0000B370.namprd21.prod.outlook.com |
| X-Ms-Exchange-Crosstenant-Authas | Anonymous |
| X-Ms-Exchange-Crosstenant-Fromentityheader | Internet |
| X-Ms-Exchange-Transport-Endtoendlatency | 00:01:03.4470788 |
| X-Ms-Exchange-Processed-By-Bccfoldering | 15.20.8511.017 |
| X-Microsoft-Antispam-Mailbox-Delivery | ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(4710117)(4713020)(920097)(930097)(140003)(1420198); |
| X-Microsoft-Antispam-Message-Info | gX31DSkDCjnhvI8GnyespU/BPWlPErbhgTsKS36cfISLhur0oEHPXe5yUzk2af98RYY6Irq+0uPfXbj5ZCMy7Obn58e1gku3ED7zssCU8nGS7MPv9n7uOlA0Afjm5IIh+K6Ue6qSs7JJzUmvgqmnsMJaCchCILeI2dgV2RxWFHeyDIMo5cPERbMyVtde6eyzNHzNpwvzY8rlStG8mrEEVmrtnBBBQ2km3JMoWrkaS0U/y6Ew1+FiBPeM33iCYEds5HijJJ/yOYwbVsi7SDS2b+HGe6Q13akIEM1SI8g+In7W8o1/2O7yGHMuxlwlEkKSeMbemze9Qe6ojHTHuWNT658+4QL4dQFnJdenelNU+cRv3UvR5pBOaT66gc2KBfOGuVBS6IpTFqn1ZTj3UPHc8tIxZ37MzsvuXjtCtoCPdQie3aGlEDsen+kq8MeESvL/TkZoKRLEu2NP8rFBgSRGUa7JKt5Rg4xbbA1rInUlV4oV97OwZKG/GETaGNfyBkCOXMAA7DhLJJCw80M26gHzKBmmrjNq8svnAwezY6APENWtz4LbA2mqw500hx5FWS5XOBfgyBQqoBhWcOBWwoeCbCyxbn428/EZxTCaKBg2C7N72bwL5iAkOSmBU4sJvRUsJs/a5UtlLUJ3FjkuSllNft6nihFqvmIgr9h3u7L77u7Uyfnz/AaltFBqUxcjeQztlVO3q+rHyKYEfSznPlrYh8U2eNbF8YqAKN1pOOxRNb6L4GGLZ4/7ypweKsJpwynUEgvesYsDB6ZDqwpgpKNkOrj5Gfxrys2SK51M9IkDrooCm26BLFbutSW4ilAcdkpyOUSt3uqQvK+ZWklc+osiKQinQ7o63j2Bzqo9vqT7KVSAOEnCbG+2zyPGPRnAUDZYShaw8KBUHRSFy3HTc6R78d8Plnn6MPrY1FcEBU2hdArzGKur8xfdX32xdFfZFBzbIGhoqCCmmE+5I/TEXkfCzvAHm4oU0UYYyhI9KuIXqHSz3ATt4kJMoaGLw8fx1iHcLdoAbcrhdh+alpKfUUO3rUyOPgrBufc+ZVK4SWIe9JGMP+hGmZLkTnSvIQlLBlA6CozPRMPHR/iol8njnKmG3bswkvtBY9nGchT+XnriLiLy4H58640cfFt0u2dwWiPV7Y0ypfvNJrTteHSDkjuZfIiImBU8zXvd9qYvYJoYANytsnkvl+Au1drcZZHxm/5GfJLd5B4zYQut3J2hY9JhAQ6j14Vbw3tPFFejIrZUYmj5g/BS2akzUSQM2yFRjBsuKa0o6jcXyA0Vqf4p8YchS8zg3Os+2IFZvYPgFgxQ6xS7tNRJ/1qNFutIdI48Pyxh8gW/jlK8l9ZPYUsTvWV47ISzjkHofM1WF7vBgUvcZXrhZlhBlUQ3R0AFUbl8OGpjJmWb1EJDLiM9vvn0HLmSXxA9vjn3PCBvPxLMA+dhepIGOJLOq3kklRFoZwM+6kssm63OKZdSGjNvIWEEcdslxxqw8K7l4PM6+YdXfVlDwPyKOsFheOrAerdnfkhh2A/bnGcCxoG5W+UhOjDCQ9TbN3oQXiwGE8KfzW3Zn+dbFYLwP9/Pjwmo14odsuiD0a6UdsmOppQ0tiYOO8nEoAwN/j5QYXsxVoHKvk3UshLrNRh0eBxSsN8hDBZLQbnJVmZAmTnAumztc7+dXuObbhfvWsZa6UiCsrRK57ELGwBNf2auowjG9naj/nJ9Fgn/tNMAynI7Vgaw1ScTtaYSzCHLVynisqm1gDy04Ao0Oj699EkjRcCrj1otCWjuOd5YrH6shSmNH1Du25C4AK8hSXuZsJB0Biv6xnRc94TnYnaJ19DT3RaTzhpkiwsvPNaJ+pRXIY5VSDJbUKAyOH4Dq2tK9EWBlHJbXe3Pkisyt/kf5eDHaQWKqpiHs3C5KO/oOd2By511noioLjdIsR2Z3q5cgny+7yYBo/+7CO24ZLwo4BdBCvQYel5oltGXSu8Z3fwd |
| To | Ajayi Calhoun <acalhoun@olgoonik.com> |
| Content-Transfer-Encoding | 7bit |
 | |
| Icon Hash: | 46070c0a8e0c67d6 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node