Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Sample name:phish_alert_sp2_2.0.0.0.eml
Analysis ID:1632124
MD5:87266fa0febf254738bc9b02f5b6499a
SHA1:ce0dac52c384570d0adcd2f80361a1867bf53b39
SHA256:083e0d8c7df0ad5d5e0b0abc2b4fa7eb91ed313a52c3148e5e915c45c3ea1902
Infos:

Detection

HTMLPhisher
Score:92
Range:0 - 100
Confidence:100%

Signatures

AI detected phishing page
Antivirus detection for URL or domain
Suricata IDS alerts for network traffic
Yara detected HtmlPhish10
AI detected landing page (webpage, office document or email)
AI detected suspicious Javascript
AI detected suspicious elements in Email content
Detected use of open redirect vulnerability
HTML page contains suspicious onload / onerror event
Creates files inside the system directory
Deletes files inside the Windows folder
Detected suspicious crossdomain redirect
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML title does not match URL
Invalid 'forgot password' link found
Invalid T&C link found
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 1160 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6732 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "30B0EA54-6470-4B03-9F46-5E69FA2B05B3" "DDC9AB6D-74ED-44D4-9250-A7CEAD74B52C" "1160" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZX2AXTR\Murex_Vmail_GZXUVYW.svg MD5: E81F54E6C1129887AEA47E7D092680BF)
      • chrome.exe (PID: 5440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,1284305459996640671,10258124130986455387,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup

Yara Signatures

HTML

SourceRuleDescriptionAuthorStrings
3.4.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
    3.6.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
      3.5.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security

        Sigma Signatures

        Sigma detected: Office Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1160, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
        Sigma detected: Outlook Security Settings Updated - Registry
        Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZX2AXTR\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 1160, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

        Suricata Signatures

        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2025-03-07T18:53:58.104890+010020566432Possible Social Engineering Attempted192.168.2.1749784148.251.193.195443TCP
        2025-03-07T18:54:31.686523+010020566432Possible Social Engineering Attempted192.168.2.1749823148.251.193.195443TCP
        2025-03-07T18:54:32.642010+010020566432Possible Social Engineering Attempted192.168.2.1749824148.251.193.195443TCP
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2025-03-07T18:53:51.611887+010020573331Successful Credential Theft Detected192.168.2.1749781148.251.193.195443TCP

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus detection for URL or domain
        Source: https://wbgssmarters.com/files/images/Logo.pngAvira URL Cloud: Label: phishing
        Source: https://wbgssmarters.com/favicon.icoAvira URL Cloud: Label: phishing

        Phishing

        barindex
        AI detected phishing page
        Source: https://www.gojordantours.com/vmail/Joe Sandbox AI: Score: 7 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'www.gojordantours.com' does not match the legitimate domain for Microsoft., The domain 'gojordantours.com' appears unrelated to Microsoft and suggests a travel-related site., There is no clear association between the brand 'Microsoft' and the domain 'gojordantours.com'., The presence of an email input field with a non-Microsoft domain email address (murex.com) is suspicious in the context of a Microsoft-branded site. DOM: 2.2.pages.csv
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comJoe Sandbox AI: Score: 7 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'wbgssmarters.com' does not match the legitimate domain for Microsoft., The domain 'wbgssmarters.com' contains no recognizable association with Microsoft., The URL does not contain any subdomain or path that might suggest a legitimate Microsoft service., The domain name 'wbgssmarters.com' appears to be unrelated and potentially suspicious due to its lack of association with the brand. DOM: 3.5.pages.csv
        Yara detected HtmlPhish10
        Source: Yara matchFile source: 3.4.pages.csv, type: HTML
        Source: Yara matchFile source: 3.6.pages.csv, type: HTML
        Source: Yara matchFile source: 3.5.pages.csv, type: HTML
        AI detected landing page (webpage, office document or email)
        Source: https://www.gojordantours.com/vmail/Joe Sandbox AI: Page contains button: 'Listen to Voicemail' Source: '2.2.pages.csv'
        AI detected suspicious Javascript
        Source: 0.0.i.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: file:///C:/Users/user/AppData/Local/Microsoft/Wi... This script demonstrates high-risk behavior by dynamically executing a hex-encoded URL, which could potentially lead to a malicious redirect. The use of obfuscated code and the ability to execute remote content pose significant security risks.
        Source: 1.3..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://www.gojordantours.com/vmail/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated URLs. The script decodes a URL and then redirects the user to that URL with the user's email address as a query parameter, which could be used for malicious purposes such as phishing or credential theft. Additionally, the use of a worker script with an obfuscated URL further increases the risk of this script.
        Source: 1.4..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW... The script uses the 'Function' constructor to execute dynamic code, which is a high-risk indicator of potential malicious behavior. This allows for the execution of arbitrary JavaScript, which could be used to perform harmful actions.
        AI detected suspicious elements in Email content
        Source: EmailJoe Sandbox AI: Detected potential phishing email: Suspicious random string 'lsbbmrp' appended to subject line is a common phishing tactic. SVG attachment is a high-risk file type often used to deliver malicious code. Subject line formatting with underscores and unusual timestamp format is typical of automated phishing campaigns
        Detected use of open redirect vulnerability
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Proxy from: links.sendclean.net/link/load/?uid=67c0546d842d21d7cb8b4578-67c05bdf35cd82412ad31ce5-67c05b08842d21a2d28b459e&uri=https://www.gojordantours.com/vmail/ to https://www.gojordantours.com/vmail/
        HTML page contains suspicious onload / onerror event
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: (new function(atob(this.dataset.digest)))();
        Source: https://www.gojordantours.com/vmail/HTTP Parser: Number of links: 0
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Number of links: 0
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: <input type="password" .../> found but no <form action="...
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Base64 decoded: (function(){var e=[],b={};try{function c(a){if("object"===typeof a&&null!==a){var f={};function n(l){try{var k=a[l];switch(typeof k){case "object":if(null===k)break;case "function":k=k.toString()}f[l]=k}catch(t){e.push(t.message)}}for(var d in a)n(d);try{...
        Source: https://www.gojordantours.com/vmail/HTTP Parser: Title: Voicemail Notification does not match URL
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Title: Authenticating ... does not match URL
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Invalid link: Forgot password?
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Invalid link: Terms of use
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Invalid link: Privacy & cookies
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Invalid link: Terms of use
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Invalid link: Privacy & cookies
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Invalid link: Terms of use
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: Invalid link: Privacy & cookies
        Source: EmailClassification: Credential Stealer
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: <input type="password" .../> found
        Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/HZX2AXTR/Murex_Vmail_GZXUVYW.svgHTTP Parser: No favicon
        Source: https://www.gojordantours.com/vmail/HTTP Parser: No favicon
        Source: https://www.gojordantours.com/vmail/HTTP Parser: No favicon
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No favicon
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No favicon
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No favicon
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No favicon
        Source: https://www.gojordantours.com/vmail/HTTP Parser: No <meta name="author".. found
        Source: https://www.gojordantours.com/vmail/HTTP Parser: No <meta name="author".. found
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No <meta name="author".. found
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No <meta name="author".. found
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No <meta name="author".. found
        Source: https://www.gojordantours.com/vmail/HTTP Parser: No <meta name="copyright".. found
        Source: https://www.gojordantours.com/vmail/HTTP Parser: No <meta name="copyright".. found
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No <meta name="copyright".. found
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No <meta name="copyright".. found
        Source: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comHTTP Parser: No <meta name="copyright".. found
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries

        Networking

        barindex
        Suricata IDS alerts for network traffic
        Source: Network trafficSuricata IDS: 2057333 - Severity 1 - ET PHISHING MAMBA Credential Phish Landing Page 2024-11-08 : 192.168.2.17:49781 -> 148.251.193.195:443
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: links.sendclean.net to https://www.gojordantours.com/vmail/
        Source: Network trafficSuricata IDS: 2056643 - Severity 2 - ET PHISHING Javascript Browser Fingerprinting POST Request : 192.168.2.17:49784 -> 148.251.193.195:443
        Source: Network trafficSuricata IDS: 2056643 - Severity 2 - ET PHISHING Javascript Browser Fingerprinting POST Request : 192.168.2.17:49823 -> 148.251.193.195:443
        Source: Network trafficSuricata IDS: 2056643 - Severity 2 - ET PHISHING Javascript Browser Fingerprinting POST Request : 192.168.2.17:49824 -> 148.251.193.195:443
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 51.132.193.104
        Source: unknownTCP traffic detected without corresponding DNS query: 2.17.190.73
        Source: unknownTCP traffic detected without corresponding DNS query: 52.109.28.46
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
        Source: global trafficHTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
        Source: global trafficHTTP traffic detected: GET /link/load/?uid=67c0546d842d21d7cb8b4578-67c05bdf35cd82412ad31ce5-67c05b08842d21a2d28b459e&uri=https://www.gojordantours.com/vmail/ HTTP/1.1Host: links.sendclean.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /vmail/ HTTP/1.1Host: www.gojordantours.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /wikipedia/commons/4/44/Microsoft_logo.svg HTTP/1.1Host: upload.wikimedia.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://www.gojordantours.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.gojordantours.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.gojordantours.com/vmail/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /wikipedia/commons/4/44/Microsoft_logo.svg HTTP/1.1Host: upload.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2022/08/cropped-fav-32x32.png HTTP/1.1Host: www.gojordantours.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.gojordantours.com/vmail/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: icwp-wpsf-notbot=exp-1741370611
        Source: global trafficHTTP traffic detected: GET /wp-content/uploads/2022/08/cropped-fav-32x32.png HTTP/1.1Host: www.gojordantours.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: icwp-wpsf-notbot=exp-1741370611
        Source: global trafficHTTP traffic detected: GET /m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.com HTTP/1.1Host: wbgssmarters.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://www.gojordantours.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /files/images/Logo.png HTTP/1.1Host: wbgssmarters.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://wbgssmarters.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /w3css/4/w3.css HTTP/1.1Host: www.w3schools.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://wbgssmarters.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: wbgssmarters.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: wbgssmarters.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
        Source: global trafficDNS traffic detected: DNS query: links.sendclean.net
        Source: global trafficDNS traffic detected: DNS query: www.google.com
        Source: global trafficDNS traffic detected: DNS query: www.gojordantours.com
        Source: global trafficDNS traffic detected: DNS query: upload.wikimedia.org
        Source: global trafficDNS traffic detected: DNS query: 365-sweet-voice-4de6.dry-tooth-5302.workers.dev
        Source: global trafficDNS traffic detected: DNS query: wbgssmarters.com
        Source: global trafficDNS traffic detected: DNS query: cdn.socket.io
        Source: global trafficDNS traffic detected: DNS query: www.w3schools.com
        Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
        Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
        Source: global trafficDNS traffic detected: DNS query: accessing.icu
        Source: unknownHTTP traffic detected: POST /m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.com HTTP/1.1Host: wbgssmarters.comConnection: keep-aliveContent-Length: 146944Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: https://wbgssmarters.comContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _cid=834596d51ce05b4391c20135fb7cbc42
        Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Fri, 07 Mar 2025 17:54:12 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
        Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
        Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
        Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
        Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
        Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
        Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49677
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
        Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
        Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
        Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
        Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
        Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
        Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
        Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
        Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
        Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
        Source: unknownNetwork traffic detected: HTTP traffic on port 49682 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
        Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
        Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
        Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
        Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
        Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
        Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
        Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
        Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
        Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
        Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\scoped_dir6420_1145117396
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\scoped_dir6420_1145117396
        Source: classification engineClassification label: mal92.phis.winEML@27/19@30/177
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\Chrome\Application\Dictionaries
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250307T1252460279-1160.etl
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
        Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "30B0EA54-6470-4B03-9F46-5E69FA2B05B3" "DDC9AB6D-74ED-44D4-9250-A7CEAD74B52C" "1160" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZX2AXTR\Murex_Vmail_GZXUVYW.svg
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,1284305459996640671,10258124130986455387,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "30B0EA54-6470-4B03-9F46-5E69FA2B05B3" "DDC9AB6D-74ED-44D4-9250-A7CEAD74B52C" "1160" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\HZX2AXTR\Murex_Vmail_GZXUVYW.svg
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,1284305459996640671,10258124130986455387,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile opened: C:\Windows\SysWOW64\MsftEdit.dll
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow detected: Number of UI elements: 16
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\Chrome\Application\Dictionaries
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation31
        Browser Extensions        		1
        Process Injection        		13
        Masquerading        		OS Credential Dumping1
        Process Discovery        		Remote ServicesData from Local System1
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        DLL Side-Loading        		1
        DLL Side-Loading        		1
        Modify Registry        		LSASS Memory1
        File and Directory Discovery        		Remote Desktop ProtocolData from Removable Media1
        Web Protocols        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
        Process Injection        		Security Account Manager13
        System Information Discovery        		SMB/Windows Admin SharesData from Network Shared Drive3
        Ingress Tool Transfer        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
        DLL Side-Loading        		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture4
        Non-Application Layer Protocol        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        File Deletion        		LSA SecretsInternet Connection DiscoverySSHKeylogging5
        Application Layer Protocol        		Scheduled TransferData Encrypted for Impact

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        phish_alert_sp2_2.0.0.0.eml0%VirustotalBrowse

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        https://otelrules.svc.static.microsoft/rules/rule704151v0s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule701100v1s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule120119v0s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule702451v1s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule704200v0s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule704101v0s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule701651v1s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule120128v0s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule701650v1s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule224900v0s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule702450v1s19.xml0%Avira URL Cloudsafe
        https://links.sendclean.net/link/load/?uid=67c0546d842d21d7cb8b4578-67c05bdf35cd82412ad31ce5-67c05b08842d21a2d28b459e&uri=https://www.gojordantours.com/vmail/0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule704150v0s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule704100v0s19.xml0%Avira URL Cloudsafe
        file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/HZX2AXTR/Murex_Vmail_GZXUVYW.svg0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule701101v1s19.xml0%Avira URL Cloudsafe
        https://otelrules.svc.static.microsoft/rules/rule704201v0s19.xml0%Avira URL Cloudsafe
        https://www.gojordantours.com/wp-content/uploads/2022/08/cropped-fav-32x32.png0%Avira URL Cloudsafe
        https://www.gojordantours.com/favicon.ico0%Avira URL Cloudsafe
        https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css0%Avira URL Cloudsafe
        https://wbgssmarters.com/files/images/Logo.png100%Avira URL Cloudphishing
        https://wbgssmarters.com/favicon.ico100%Avira URL Cloudphishing

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        e329293.dscd.akamaiedge.net
        		92.123.12.139
        		truefalse
          		high
          accessing.icu
          		104.21.16.1
          		truefalse
            		unknown
            s-part-0039.t-0009.t-msedge.net
            		13.107.246.67
            		truefalse
              		high
              links.sendclean.net
              		45.249.55.22
              		truetrue
                		unknown
                www.gojordantours.com
                		92.205.3.103
                		truetrue
                  		unknown
                  d2vgu95hoyrpkh.cloudfront.net
                  		18.245.31.33
                  		truefalse
                    		high
                    cdnjs.cloudflare.com
                    		104.17.25.14
                    		truefalse
                      		high
                      wbgssmarters.com
                      		148.251.193.195
                      		truetrue
                        		unknown
                        www.google.com
                        		142.250.186.36
                        		truefalse
                          		high
                          upload.wikimedia.org
                          		185.15.59.240
                          		truefalse
                            		high
                            s-0005.dual-s-msedge.net
                            		52.123.128.14
                            		truefalse
                              		high
                              s-part-0032.t-0009.t-msedge.net
                              		13.107.246.60
                              		truefalse
                                		high
                                365-sweet-voice-4de6.dry-tooth-5302.workers.dev
                                		104.21.112.1
                                		truefalse
                                  		unknown
                                  a1400.dscb.akamai.net
                                  		72.247.153.195
                                  		truefalse
                                    		high
                                    aadcdn.msftauth.net
                                    		unknown
                                    		unknownfalse
                                      		high
                                      www.w3schools.com
                                      		unknown
                                      		unknownfalse
                                        		high
                                        cdn.socket.io
                                        		unknown
                                        		unknownfalse
                                          		high

                                          Contacted URLs

                                          NameMaliciousAntivirus DetectionReputation
                                          https://otelrules.svc.static.microsoft/rules/rule704151v0s19.xmlfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://otelrules.svc.static.microsoft/rules/rule704200v0s19.xmlfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.cssfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://wbgssmarters.com/favicon.icotrue
                                          • Avira URL Cloud: phishing
                                          		unknown
                                          https://otelrules.svc.static.microsoft/rules/rule702451v1s19.xmlfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://otelrules.svc.static.microsoft/rules/rule120607v1s19.xmlfalse
                                            		high
                                            https://www.w3schools.com/w3css/4/w3.cssfalse
                                              		high
                                              https://otelrules.svc.static.microsoft/rules/rule701650v1s19.xmlfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://otelrules.svc.static.microsoft/rules/rule224900v0s19.xmlfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://otelrules.svc.static.microsoft/rules/rule704100v0s19.xmlfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://otelrules.svc.static.microsoft/rules/rule704150v0s19.xmlfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://otelrules.svc.static.microsoft/rules/rule704201v0s19.xmlfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://otelrules.svc.static.microsoft/rules/rule120119v0s19.xmlfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.gojordantours.com/vmail/true
                                                		unknown
                                                https://upload.wikimedia.org/wikipedia/commons/4/44/Microsoft_logo.svgfalse
                                                  		high
                                                  https://wbgssmarters.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ISlBibFE9JnVpZD1VU0VSMTAwMjIwMjVVMzAwMjEwMTk=N0123Njoacob@murex.comtrue
                                                    		unknown
                                                    https://otelrules.svc.static.microsoft/rules/rule701100v1s19.xmlfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://www.gojordantours.com/wp-content/uploads/2022/08/cropped-fav-32x32.pngfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://otelrules.svc.static.microsoft/rules/rule120128v0s19.xmlfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xmlfalse
                                                      		high
                                                      https://www.gojordantours.com/favicon.icofalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://otelrules.svc.static.microsoft/rules/rule701651v1s19.xmlfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://wbgssmarters.com/files/images/Logo.pngtrue
                                                      • Avira URL Cloud: phishing
                                                      		unknown
                                                      https://otelrules.svc.static.microsoft/rules/rule704101v0s19.xmlfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://otelrules.svc.static.microsoft/rules/rule702450v1s19.xmlfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://links.sendclean.net/link/load/?uid=67c0546d842d21d7cb8b4578-67c05bdf35cd82412ad31ce5-67c05b08842d21a2d28b459e&uri=https://www.gojordantours.com/vmail/true
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/HZX2AXTR/Murex_Vmail_GZXUVYW.svgfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://otelrules.svc.static.microsoft/rules/rule701101v1s19.xmlfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown

                                                      World Map of Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public IPs

                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      142.250.185.206
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      13.107.246.67
                                                      		s-part-0039.t-0009.t-msedge.netUnited States
                                                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      173.194.76.84
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      18.245.31.33
                                                      		d2vgu95hoyrpkh.cloudfront.netUnited States
                                                      		16509AMAZON-02USfalse
                                                      13.107.246.60
                                                      		s-part-0032.t-0009.t-msedge.netUnited States
                                                      		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      216.58.206.35
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      104.21.112.1
                                                      		365-sweet-voice-4de6.dry-tooth-5302.workers.devUnited States
                                                      		13335CLOUDFLARENETUSfalse
                                                      142.250.185.163
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      2.22.242.10
                                                      		unknownEuropean Union
                                                      		20940AKAMAI-ASN1EUfalse
                                                      185.15.59.240
                                                      		upload.wikimedia.orgNetherlands
                                                      		14907WIKIMEDIAUSfalse
                                                      52.109.32.97
                                                      		unknownUnited States
                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      104.21.96.1
                                                      		unknownUnited States
                                                      		13335CLOUDFLARENETUSfalse
                                                      148.251.193.195
                                                      		wbgssmarters.comGermany
                                                      		24940HETZNER-ASDEtrue
                                                      92.123.12.181
                                                      		unknownEuropean Union
                                                      		16625AKAMAI-ASUSfalse
                                                      142.250.186.35
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      142.250.185.67
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      104.21.16.1
                                                      		accessing.icuUnited States
                                                      		13335CLOUDFLARENETUSfalse
                                                      142.250.186.36
                                                      		www.google.comUnited States
                                                      		15169GOOGLEUSfalse
                                                      92.205.3.103
                                                      		www.gojordantours.comGermany
                                                      		8972GD-EMEA-DC-SXB1DEtrue
                                                      92.123.12.139
                                                      		e329293.dscd.akamaiedge.netEuropean Union
                                                      		16625AKAMAI-ASUSfalse
                                                      45.249.55.22
                                                      		links.sendclean.netIndia
                                                      		132952ENOW-ASENOWINtrue
                                                      216.58.206.42
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      142.250.185.238
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      72.247.153.195
                                                      		a1400.dscb.akamai.netUnited States
                                                      		20940AKAMAI-ASN1EUfalse
                                                      52.123.128.14
                                                      		s-0005.dual-s-msedge.netUnited States
                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      142.250.181.227
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      51.116.253.170
                                                      		unknownUnited Kingdom
                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      52.109.28.48
                                                      		unknownUnited States
                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      142.250.185.174
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      52.109.28.47
                                                      		unknownUnited States
                                                      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                      142.250.185.74
                                                      		unknownUnited States
                                                      		15169GOOGLEUSfalse
                                                      104.17.25.14
                                                      		cdnjs.cloudflare.comUnited States
                                                      		13335CLOUDFLARENETUSfalse

                                                      Private

                                                      IP
                                                      192.168.2.17
                                                      192.168.2.7
                                                      192.168.2.5

                                                      General Information

                                                      Joe Sandbox version:42.0.0 Malachite
                                                      Analysis ID:1632124
                                                      Start date and time:2025-03-07 18:52:16 +01:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                      Number of analysed new started processes analysed:17
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • EGA enabled
                                                      Analysis Mode:stream
                                                      Analysis stop reason:Timeout
                                                      Sample name:phish_alert_sp2_2.0.0.0.eml
                                                      Detection:MAL
                                                      Classification:mal92.phis.winEML@27/19@30/177
                                                      Cookbook Comments:
                                                      • Found application associated with file extension: .eml

                                                      Warnings

                                                      • Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
                                                      • Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.109.28.47, 2.22.242.10, 2.22.242.137, 2.22.242.9, 2.22.242.113, 2.22.242.122, 2.22.242.106, 2.22.242.121, 2.22.242.136, 2.22.242.130, 51.116.253.170, 52.109.28.48, 52.123.128.14, 20.190.159.64
                                                      • Excluded domains from analysis (whitelisted): osiprod-uks-bronze-azsc-000.uksouth.cloudapp.azure.com, omex.cdn.office.net, odc.officeapps.live.com, europe.odcsm1.live.com.akadns.net, eur.roaming1.live.com.akadns.net, roaming.officeapps.live.com, dual-s-0005-office.config.skype.com, login.live.com, otelrules.svc.static.microsoft, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, onedscolprdgwc07.germanywestcentral.cloudapp.azure.com, c.pki.goog, a1864.dscd.akamai.net, ecs.office.com, self-events-data.trafficmanager.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, uks-azsc-000.odc.officeapps.live.com, uks-azsc-000.roaming.officeapps.live.com, config.officeapps.live.com, ecs.office.trafficmanager.net, omex.cdn.office.net.akamaized.net, europe.configsvc1.live.com.akadns.net, prod.odcsm1.live.com.akadns.net
                                                      • Not all processes where analyzed, report is missing behavior information
                                                      • Report size getting too big, too many NtOpenFile calls found.
                                                      • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                      • Report size getting too big, too many NtSetValueKey calls found.
                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                      • VT rate limit hit for: www.gojordantours.com

                                                      Created / dropped Files

                                                      C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250307T1252460279-1160.etl

                                                      Download File
                                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                      File Type:data
                                                      Category:modified
                                                      Size (bytes):131072
                                                      Entropy (8bit):4.66389673007942
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:40E957EC230A6BE4715E4E550244E284
                                                      SHA1:E50A90CE6E3236CED353D8CF5F17CC5843177239
                                                      SHA-256:6A66F5E7532E7A085EA571090385278CF430CD0F252805759FF482C412CABB9A
                                                      SHA-512:F2B611798A52C7763DC5F6D48473D483952A672E50884B2BFE214347DDCC92875594C85C363B6C1725993624D514F8D357C4ACFA2BD8F2D61F72EC51109CE10B
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:............................................................................b..................................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1........................................................... ..O3..........................v.2._.O.U.T.L.O.O.K.:.4.8.8.:.e.b.0.e.5.5.7.4.e.b.8.d.4.f.a.f.b.c.5.e.c.7.5.1.2.e.9.a.a.4.f.a...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.3.0.7.T.1.2.5.2.4.6.0.2.7.9.-.1.1.6.0...e.t.l.............P.P................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                                      Download File
                                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                      File Type:Microsoft Outlook email folder (>=2003)
                                                      Category:dropped
                                                      Size (bytes):271360
                                                      Entropy (8bit):2.6222590273828947
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:5697A3172A8D7D50ED28A5DCCC36FB2D
                                                      SHA1:BEE9D710398A96FF9309663F4A212C34AB549851
                                                      SHA-256:8ED6F4BE01256A2BEED5632AC157470A5CBFECB5F4E0904C0F645DAAA506621B
                                                      SHA-512:4DFB358B4FFC80154F3F292C3BC1ED55453F8DA91B9C7C30058D6F1A88C790F7DB4690F5285F975BBB18038C70ED171288153368F6CB72A19A7D2E6E9C2BB669
                                                      Malicious:true
                                                      Reputation:unknown
                                                      Preview:!BDN}.F.SM......\.......P......H.......a................@...........@...@...................................@...........................................................................$.......D......@R..............D...............G...........................................................................................................................................................................................................................................................................................0...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                                                      Download File
                                                      Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):131072
                                                      Entropy (8bit):3.0627285898001664
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:7D332B5644D6F269CB6E8897E924BCF5
                                                      SHA1:C9A52E306850F11CAC5642E2AFB0AEDEA964E5D1
                                                      SHA-256:B56B9CCB1E03994CD10138766558CB9654D50A5DA490AC2E0464635171384555
                                                      SHA-512:9482081845922542FA67E0C33DF482E14ECCA8AED2BD842491A546B8CAD03B86DEA87A31711D57AC30C7DB974144E5AF3FF75B93F95350E857B52C0295F5583B
                                                      Malicious:true
                                                      Reputation:unknown
                                                      Preview:P.2.0...j...........+...........D............#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................LB]/.D.......>B.0...k...........+...........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                                                      Chrome Cache Entry: 64

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                      Category:downloaded
                                                      Size (bytes):23427
                                                      Entropy (8bit):5.112735417225198
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:BA0537E9574725096AF97C27D7E54F76
                                                      SHA1:BD46B47D74D344F435B5805114559D45979762D5
                                                      SHA-256:4A7611BC677873A0F87FE21727BC3A2A43F57A5DED3B10CE33A0F371A2E6030F
                                                      SHA-512:FC43F1A6B95E1CE005A8EFCDB0D38DF8CC12189BEAC18099FD97C278D254D5DA4C24556BD06515D9D6CA495DDB630A052AEFC0BB73D6ED15DEBC0FB1E8E208E7
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://www.w3schools.com/w3css/4/w3.css
                                                      Preview:./* W3.CSS 4.15 December 2020 by Jan Egil and Borge Refsnes */.html{box-sizing:border-box}*,*:before,*:after{box-sizing:inherit}./* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */.html{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}.article,aside,details,figcaption,figure,footer,header,main,menu,nav,section{display:block}summary{display:list-item}.audio,canvas,progress,video{display:inline-block}progress{vertical-align:baseline}.audio:not([controls]){display:none;height:0}[hidden],template{display:none}.a{background-color:transparent}a:active,a:hover{outline-width:0}.abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}.b,strong{font-weight:bolder}dfn{font-style:italic}mark{background:#ff0;color:#000}.small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}.sub{bottom:-0.25em}sup{top:-0.5em}figure{margin:1em 40px}img{border-style:none}.code,kbd,p

                                                      Chrome Cache Entry: 67

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
                                                      Category:downloaded
                                                      Size (bytes):2407
                                                      Entropy (8bit):7.900400471609788
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:9D372E951D45A26EDE2DC8B417AAE4F8
                                                      SHA1:84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
                                                      SHA-256:4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
                                                      SHA-512:78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
                                                      Preview:...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx|............|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

                                                      Chrome Cache Entry: 68

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
                                                      Category:dropped
                                                      Size (bytes):199
                                                      Entropy (8bit):6.766983163126765
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:21B761F2B1FD37F587D7222023B09276
                                                      SHA1:F7A416C8907424F9A9644753E3A93D4D63AE640E
                                                      SHA-256:72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
                                                      SHA-512:77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

                                                      Chrome Cache Entry: 72

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:JSON data
                                                      Category:dropped
                                                      Size (bytes):41
                                                      Entropy (8bit):4.180365114215879
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:64E1C1EB9F4CAF0CF0E7484D7AFCEDB9
                                                      SHA1:69E40D8C48A866A84046FD8BD17AF47FF02B79A4
                                                      SHA-256:8ACAC48BC106C4EAE580C08071597F9DAFAB96D959DEFF65BEC44514DA907B1D
                                                      SHA-512:F109767D57E85127D18B1AD2030A48C0EAD69F79A15C4008712407B1F62691654B74C9D6E225FFDC4A922847EABB928DC7520A656C7081B585124CF678B54E59
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:{"code":1,"message":"Session ID unknown"}

                                                      Chrome Cache Entry: 74

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:SVG Scalable Vector Graphics image
                                                      Category:downloaded
                                                      Size (bytes):272
                                                      Entropy (8bit):4.825230707379318
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:363FDD53D34303B727D9DAB161B8E88B
                                                      SHA1:5B170117926AE5A5E451AA24676B5A124C2FA122
                                                      SHA-256:3D41251F93127B4B42C2F69FA423D204946CF9C307D786EA36B8D9BEF4179282
                                                      SHA-512:6369E9E3B0F49D5BE6C43724C01D34E7B9871E9D709C628ED0963B94183729AABB2D9778EED4405D87C5080DEA19156970DAB6B8D69EDB860ADC5C1A400FAFB3
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://upload.wikimedia.org/wikipedia/commons/4/44/Microsoft_logo.svg
                                                      Preview:<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 23 23"><path fill="#f3f3f3" d="M0 0h23v23H0z"/><path fill="#f35325" d="M1 1h10v10H1z"/><path fill="#81bc06" d="M12 1h10v10H12z"/><path fill="#05a6f0" d="M1 12h10v10H1z"/><path fill="#ffba08" d="M12 12h10v10H12z"/></svg>

                                                      Chrome Cache Entry: 75

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (432), with CRLF line terminators
                                                      Category:downloaded
                                                      Size (bytes):5198
                                                      Entropy (8bit):4.751721248783462
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:C5625BF21ABC751B05ACDD2210C0EA5C
                                                      SHA1:5CE340C4B466467888A1C1539D35899A01059FD0
                                                      SHA-256:19C0FA4E03AEEBD99002EB0DE3988AC54E12946D2458729E485FBCC405556577
                                                      SHA-512:527E09258DB40ACA0A9D503FEDDE22A2DE26BF81956D0A9FD6285D95928C6F31F9A4756135D377B386B3881E0DA6A11EE817D7BBDC6A8F7F75FBDB7E800D9A8C
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://www.gojordantours.com/vmail/
                                                      Preview:<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>.... Voicemail Notification</title>.. <style>.. body {.. font-family: 'Segoe UI', Arial, sans-serif;.. background: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB3wAAALOCAYAAABCuGJqAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjw') no-repeat center center fixed;.. background-size: cover;.. display: flex;.. align-items: center;.. justify-content: center;.. height: 100vh;.. }.. .container {.. width: 480px;.. background: rgba(255, 255, 255, 0.95);.. padding: 45px;.. border-radius: 10px;.. box-shadow: 0 6px 14px rgba(0, 0, 0, 0.2);.. text-align: left;.. }.. .header {.. display: flex;.. align-items: center;.. gap: 15px;..

                                                      Chrome Cache Entry: 78

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:gzip compressed data, from Unix, original size modulo 2^32 49993
                                                      Category:downloaded
                                                      Size (bytes):15034
                                                      Entropy (8bit):7.987504978428562
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:33D4A87F65D8E36B7D1108EF30ACAB4E
                                                      SHA1:9912CAA21D837180072B07CBEC69F0A0D07D9507
                                                      SHA-256:A2D69D79C8A26557D65FA1FC7712D17AB7A8D0B7791B769DF1E53F44E4F04C5A
                                                      SHA-512:07083D2997FACA8B297685E07A93A592F979F43165BDB6F02BC64EA7088254D07EFF12C2A3954921FBCE0DBF938C5B1EDAB2DB24B59C32D41545768B10FA2C4A
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://cdn.socket.io/4.7.5/socket.io.min.js
                                                      Preview:...........}.w.6....W..^..hY...K..&N.....vW....l..I.........$h;.~.....@<..ya.......|..U..o:...o..1......pw.....n....8.;..l...%KJ6.9+:.u^...y..XV.>......:.Ui..,..k/?...*/.....O;..*/.......4csoGf.......O_..+?.<Y........~r>..G..".....I...H.~..fS..i.Osll.W...j$0.u.:eU.0..L.`K.....<....:?.0......bER..X.MU(...0...c.Y.Ao.3.;.c..#...".r.l,....C..V...3...;>.Pq..d..../;...|....E^..Q.ey.%.e'..IYv...Q=6j.xr..^$E'....a._..Z..^/...".&.tT.Y.>...,Yl.l6;..q..gk..3...d.f^.u.n./..EZ.. |C...H..W....;~.U.bWa._........c...8....A...r..g.....#..i..Ez.V........LS&.......f.AW......B6S........u..e...$..J'..a.x..!.gg0............. ..OCY"..y.K.y..E..1.a.....@...n.@.........Zg.S..Z.i.3..!.m..j&.EU...Y6...'i6..c.3..U<.U.....-.J.....,Vy.j:.........m...o.39.>......M.i....y\.i?Y..W. ....k.S.K!...0..r...k.....$.:B...e/:'.._w..Z.#c.$Tg.K*...1...B.5.U.B=]..\.....).f....Ki..R..d.[Y.S..gV....t.......c\.!6.;.;&.Hn.JyKW...... }X....X...b........).4...dg...../..U...`...d...*.d...9.

                                                      Chrome Cache Entry: 79

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1636
                                                      Category:downloaded
                                                      Size (bytes):790
                                                      Entropy (8bit):7.724574132641631
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:D6342579C1096868453B6B2DE4A5CB86
                                                      SHA1:D23F1A7822E8C14DCF7F9034AEF8664C27A27DFF
                                                      SHA-256:1068E05365AB35B0FA7EBE2BB144335E9BE4172358808FA96AE25EC4E998BB0A
                                                      SHA-512:74B3F208F2CBBD38B03117EAB5D1B3AB432E07708BC7585F0480F76E21A51BBEE496242CE8AB535B4B7E7EB72C8BC37F04B40247C47761592DB64768C71E9061
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
                                                      Preview:..........uUK..1..+hz.1....=q.+..P.2H.e....9..Tl>L.8~|........z]w.4.._...;.-.}..b.Y.[.O...\....t..*.N....ug.f.....j:M..f.....jY..>....y.s:......[nV..i\<..'.zv[6;.6..H/..$[....B.U.....-{.w.$..-I......(..y ....^...@..A...vb.6.%./..c2b.#A.~'F.]`*...U;Q....'.o...:....s#D./N.V..FG....dJ>...^..%.....o(.z.H.a..41..bYM....$..r.(JB.^......e.I...XYk.X....Y.P.!.K}..DR)+2..B.....&...4..z.K.+9i.z..lX..1..P70c.(..W..su.'.....J.HVp....q.....6]...2..W.(E...pn...q.E.S..5...cl..6.Zn.hXn..q3...}.b<....](....j....T:k!.s............).I%56Y.-..PqpP..|...N.8..$*.z.)F&he..d.6.....#..!T..y).. e5.)M.;,.a......FB.>......3a'(\...u..o...F..\.*!jm.}....J)g1..C.......J-...Ry..I....<.H...J..\.]\..8}.B.k.+B.'..C..e....}y.........9zG.[b.D.U..[._].5?.......c.....Id...

                                                      Chrome Cache Entry: 80

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                      Category:dropped
                                                      Size (bytes):2228
                                                      Entropy (8bit):7.82817506159911
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:EF9941290C50CD3866E2BA6B793F010D
                                                      SHA1:4736508C795667DCEA21F8D864233031223B7832
                                                      SHA-256:1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
                                                      SHA-512:A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6...*.Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6...*..,xz.._......B."#...L(n..f..Yb...*.8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o......*....x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.*....-.A.}.......I .P.....S....|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.*iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

                                                      Chrome Cache Entry: 81

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
                                                      Category:downloaded
                                                      Size (bytes):673
                                                      Entropy (8bit):7.6596900876595075
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:0E176276362B94279A4492511BFCBD98
                                                      SHA1:389FE6B51F62254BB98939896B8C89EBEFFE2A02
                                                      SHA-256:9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
                                                      SHA-512:8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
                                                      Preview:...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q...*..~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1.....*.#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

                                                      Chrome Cache Entry: 82

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                      Category:dropped
                                                      Size (bytes):2783
                                                      Entropy (8bit):7.897790571789496
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:3F8BB77FB54AECAA01D11335ED4A921A
                                                      SHA1:BC004D11A30FF435967CABA039B1BAFC098E869E
                                                      SHA-256:A993A497BF96E1E4BD379B4962637F7E48CDF5101DA09715C8E952C060508C00
                                                      SHA-512:44707AFC69B2F963F17C1D6AC6EDD00F1571AC3C25C8B29D5E22147BA3307F38D01D0C61C1E46D441269A262C2FED1693E244419DF945113C8044EE2E9818FC1
                                                      Malicious:false
                                                      Reputation:unknown
                                                      Preview:.PNG........IHDR... ... .....szz.....IDATX...o..u...~3;.....*.")J.D.r..RlWV."..1.?.i..v.....;.."HQ.E...rA.:..Z...b.,..w."....r.s..N.f.*.c...`.....|..|.......'?.~....?;1JN:....D...7FQ.[+e...-.(...m..=x.......[.l-...G..G...xs.....W.."...~.............)..Y&......".. ....2..5.x........[..........g.0....h~y.v........?..o]..^..=tgu.+..._...q.GL.....@J...A.1.....4K{ak..n..o..?.|5..^.=..@..W...|..n..8?...FZ.y..K..R.5...6v^......=..tJ4...0.. .b..A".y..;6lg'...W.j.+{.....K.w.Jyvj.yzj.....~.h#U7.W.Y.....>_~}.....H.u......Z8...>.N.... DI+@H+...x.h.......p3_..Q9.....nl.{..y...1...W.@......46.rm.r.}...'....*....E...GCT"....!.@D.+.,..Q....i.<..S....\...+...Jc....$._.....#...x.+..?.x...~.gG[.3KK...[.~C.v...L.....".\..6...9...s?..e.........qu.|~/.....N.u.7w.."....}..h?9ro..!...W......3.=.z.AJ@, .....X..!*.@.J1.w.....C..#...i.ue...cw4.2J<.Q.O.BLT../__.(-.V...if........z..M1..f..$t..n.1 ...?..6R*.4.Ja.a.W.*..3b....(.R...e.....p..QO../.j'.,.....2.z....I.

                                                      Chrome Cache Entry: 83

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with very long lines (65317)
                                                      Category:downloaded
                                                      Size (bytes):100782
                                                      Entropy (8bit):4.782445110770722
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:6386FB409D4A2ABC96EEE7BE8F6D4CC4
                                                      SHA1:09102CFC60EFB430A25EE97CEE9A6A35DF6DFC59
                                                      SHA-256:0DF5A33710E433DE1F5415B1D47E4130CA7466AEE5B81955F1045C4844BBB3ED
                                                      SHA-512:29F91FC180EC2E4225C10A7A2C59E5F3335D2C6C6EF58000D50BF020D92CE0F85C125412BEA73254B2C3F5A3215DDD77B908E85ED10A368B0E59A66A5E07A5D2
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css
                                                      Preview:/*!. * Font Awesome Free 6.1.1 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). * Copyright 2022 Fonticons, Inc.. */..fa{font-family:var(--fa-style-family,"Font Awesome 6 Free");font-weight:var(--fa-style,900)}.fa,.fa-brands,.fa-duotone,.fa-light,.fa-regular,.fa-solid,.fa-thin,.fab,.fad,.fal,.far,.fas,.fat{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{font-size:.625em;line-height:.1em;vertical-align:.225em}.fa-xs{font-size:.75em;line-height:.08333em;vertical-align:.125em}.fa-sm{font-size:.875em;line-height:.07143em;vertical-align:.05357em

                                                      Chrome Cache Entry: 84

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:downloaded
                                                      Size (bytes):16
                                                      Entropy (8bit):3.625
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:2824F3BA5F591CD0F71B7F459AD29AE5
                                                      SHA1:65369608C6BD54AC4C703B6904D17D7D759878BE
                                                      SHA-256:0C0A807545A0344B360C0F692D284799A2447310C7A9AACF3CB92C22D13E906A
                                                      SHA-512:C1C3FFD34A4E9131B0F68CF6A2A35B62994D55332D18BA06E3464C213D4245B6C89DD55E797317078A3705E265D65AC232E042C8BB9531F65871659EE4DA50DD
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCRL_2dVV8e6FEgUNcK7ZCSFGKvqWJ-u7MA==?alt=proto
                                                      Preview:CgkKBw1wrtkJGgA=

                                                      Chrome Cache Entry: 85

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
                                                      Category:downloaded
                                                      Size (bytes):276
                                                      Entropy (8bit):7.316609873335077
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:4E3510919D29D18EEB6E3E8B2687D2F5
                                                      SHA1:31522A9EC576A462C3F1FFA65C010D4EB77E9A85
                                                      SHA-256:1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
                                                      SHA-512:DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
                                                      Preview:...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....*e.......J).*8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

                                                      Chrome Cache Entry: 87

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
                                                      Category:downloaded
                                                      Size (bytes):1435
                                                      Entropy (8bit):7.8613342322590265
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:9F368BC4580FED907775F31C6B26D6CF
                                                      SHA1:E393A40B3E337F43057EEE3DE189F197AB056451
                                                      SHA-256:7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
                                                      SHA-512:0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
                                                      Preview:...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.|..~.|{~...b{8...zv.....8|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g*.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dg*N.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f*;.....Zhrr.,.U....6.Y....+Zd.*R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

                                                      Chrome Cache Entry: 88

                                                      Download File
                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      File Type:ASCII text, with no line terminators
                                                      Category:downloaded
                                                      Size (bytes):52
                                                      Entropy (8bit):4.190260390968384
                                                      Encrypted:false
                                                      SSDEEP:
                                                      MD5:09BDE5D10D92DEBBB74AE9C3DF3AECAB
                                                      SHA1:2F4EEA05E85C26DE82C5E7CBA471687EC8D855EC
                                                      SHA-256:F67F67274C88240DE01FA51D483271F58A5752B607B13DEE041C7A0671290E7F
                                                      SHA-512:0FF4A460BC9068E61B6EEC0078E97F2AD0DCD12288E8161688351C3BB85A87D624E5B7635C47ED1B5B93C6D3B4A29A756A75A897394B4E6A3986BBB1762CFC6C
                                                      Malicious:false
                                                      Reputation:unknown
                                                      URL:https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIuCTi1l2M2-OroEgUNkWGVThIFDTWGVBwSBQ2RYZVOEgUNkWGVTiG2omSrqaK4Qw==?alt=proto
                                                      Preview:CiQKBw2RYZVOGgAKBw01hlQcGgAKBw2RYZVOGgAKBw2RYZVOGgA=

                                                      Static File Info

                                                      General

                                                      File type:RFC 822 mail, ASCII text, with very long lines (1817), with CRLF line terminators
                                                      Entropy (8bit):6.064526742472313
                                                      TrID:
                                                      • E-Mail message (Var. 5) (54515/1) 100.00%
                                                      File name:phish_alert_sp2_2.0.0.0.eml
                                                      File size:14'770 bytes
                                                      MD5:87266fa0febf254738bc9b02f5b6499a
                                                      SHA1:ce0dac52c384570d0adcd2f80361a1867bf53b39
                                                      SHA256:083e0d8c7df0ad5d5e0b0abc2b4fa7eb91ed313a52c3148e5e915c45c3ea1902
                                                      SHA512:023e0b76746f24f1b3b4d979d8680736680f6231dbec2fcf0cfb2e8c83c9f5d25a1d5cddb6f5f56e9d940051d4a4a72040446a2e6dc0e3947ab620ebcaa90fa0
                                                      SSDEEP:192:d+v3PJozkpi06sDVpTQ2QCXZkR7cH/LO3T7ZwuGuCycE+bor0jgJjo:d+fPJxpi06Mpk2QCXZWcH+ZNLCAhrtU
                                                      TLSH:4C626C62291919347FDA76CBE259B840B3A630C244F3E0D076AACEF112E7155ABC6D4F
                                                      File Content Preview:Received: from SA1PR16MB5691.namprd16.prod.outlook.com.. (2603:10b6:806:3cf::13) by LV8PR16MB6080.namprd16.prod.outlook.com with.. HTTPS; Fri, 7 Mar 2025 13:36:07 +0000..Received: from PH0PR07CA0031.namprd07.prod.outlook.com (2603:10b6:510:e::6).. by SA1P

                                                      Static Mail

                                                      General

                                                      Subject:Phone_Message_Received From 7322773264 Friday-March-2025 13:35 PM lsbbmrp
                                                      From:Murex <naoual@nhmanagement.com>
                                                      To:Gordon Johnson <GJohnson@murexltd.com>
                                                      Cc:
                                                      BCC:
                                                      Date:Fri, 07 Mar 2025 13:35:56 +0000
                                                      Communications:
                                                        Attachments:
                                                        • Murex_Vmail_GZXUVYW.svg

                                                        Headers

                                                        Key Value
                                                        Receivedfrom [192.189.2.18] (192.189.2.18) by AU2PEPF00000015.mail.protection.outlook.com (10.167.240.39) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8511.15 via Frontend Transport; Fri, 7 Mar 2025 13:35:58 +0000
                                                        Arc-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mJ1KZJx0EyY2IWMvQmvN0fZUYGi2vtBQbgvFW+ADug3xPEkMhSA0iCZoVW0d1n/6X7hq7MgWiO49gdZahsSCs6ChivkfmWT4xR4HuClww82gc5eFDyskvNM7/KTZqKYaopzbluS2sd6aeeEBXljpMNPUy3GXjTQr7yH8NVx5/8QypEuykHSfyLVkTDetSNd249UepKnLLVjfYYwNHJBRzlyEtSH308W8rUUuzoVpXGHFdq2q+pVoG72YXLs0lgNiTqV0L1vpBNg7HN1i6ARtkSV2D4TIDoMvNfpIyBfgU+TZlPNtnC0amkPmMzAc9O+BhprTTKCPuh+R31iy8c+d0Q==
                                                        Arc-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LQ1Oln2GL6k0ZeLhA2x7NmeXL0cDj1x8kX6iNiev6w4=; b=NwkxCpO8p98HrFKxWTpIFJioYAFUzss47GxSHJL/JiKM6JvdbCv+elmdhKGAabmZqGKo/S37ieUfmvW7UjMRb94+we+7ucj2jNWizCZPWSicWPqop1NaDoNwuMS+F/UupcEP+tXu+zoP2UsFvpIuC2nIwfvHZ0fa8VMbIRvK2Jnc88I6olturI+3dWwipsUkapW6mdNY9fWhn0pKrezBTJZVM1FKMdhgi93i/dfGZH8PubfksMbooZkg8omjwBjUidrQiXH0sCFULiPqvR5B+va6OTzIXtvVRz8YKLK8b0wC2ayQWO370ZcPVOirOCqtwY+mzNxnjEUDkhrxZ4q/KA==
                                                        Arc-Authentication-Resultsi=1; mx.microsoft.com 1; spf=fail (sender ip is 192.189.2.18) smtp.rcpttodomain=murexltd.com smtp.mailfrom=nhmanagement.com; dmarc=none action=none header.from=nhmanagement.com; dkim=none (message not signed); arc=none (0)
                                                        Authentication-Resultsspf=softfail (sender IP is 2a01:111:f403:c40c::) smtp.mailfrom=nhmanagement.com; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nhmanagement.com;compauth=softpass reason=202
                                                        Received-SpfFail (protection.outlook.com: domain of nhmanagement.com does not designate 192.189.2.18 as permitted sender) receiver=protection.outlook.com; client-ip=192.189.2.18; helo=[192.189.2.18];
                                                        X-Ms-Exchange-Authentication-Resultsspf=fail (sender IP is 192.189.2.18) smtp.mailfrom=nhmanagement.com; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nhmanagement.com;
                                                        Content-Typemultipart/mixed; boundary="----sinikael-?=_1-17413577556670.35299066793951783"
                                                        MIME-Version1.0
                                                        FromMurex <naoual@nhmanagement.com>
                                                        ToGordon Johnson <GJohnson@murexltd.com>
                                                        SubjectPhone_Message_Received From 7322773264 Friday-March-2025 13:35 PM lsbbmrp
                                                        DateFri, 07 Mar 2025 13:35:56 +0000
                                                        Message-Id<174135455622.9660.15721436990259616408@nhmanagement.com>
                                                        X-AzcyzvDSQLLY
                                                        X-YczvlkejMWAIB
                                                        X-CdwhyhrYVDKB
                                                        X-LvahdoyruDHGIMLGML
                                                        X-Accept-Languageen-us, en
                                                        X-Priority3 (Medium)
                                                        X-Msmail-PriorityMedium
                                                        ImportanceMedium
                                                        Return-PathNaoual@nhmanagement.com
                                                        X-Eopattributedmessage1
                                                        X-Ms-Traffictypediagnostic AU2PEPF00000015:EE_|AU2PPF5823BE9D9:EE_|SN1PEPF000252A3:EE_|SA1PR16MB5691:EE_|LV8PR16MB6080:EE_
                                                        X-Ms-Office365-Filtering-Correlation-Id f35c52df-06ee-4de5-23cc-08dd5d7d01c6
                                                        X-Ms-Exchange-Senderadcheck1
                                                        X-Ms-Exchange-Antispam-Relay0
                                                        X-Microsoft-Antispam-Untrusted BCL:0;ARA:13230040|1800799024|376014|36860700013|34070700014|82310400026|8096899003|4053099003;
                                                        X-Microsoft-Antispam-Message-Info-Original VqPjYQMSXud8FAI4Y+hGzNL/JiazS/hPmmNxywsOUB6FBoxj2TCdUYpIMXUIJpvtFsS4QYHWyOyV7WobeJ0u4Pq+Hsz4LW42Q0i1Yxtoem8o2CidxjNCOlIET/jFMBRrUC5VTkOcxYHRZEnscRMkjLZ0iM/tesHS0sB1h6HZw3ZgC/GLXoOchg0dJtpP7v5C1zk7F5rmJEoVGx9f0kJjifZR7JlFL8lgTggrVzJe3wJ4qan9ZXKcjtnK2luGFt/dbcKoUodleJwf8e5gkr026A8wi76MHUDgLtMkl56B6AXOJId3MRHykGEYMZJn6oraiAFnCmMynnh7fUENIUsaITsyVF/060oi9rFghL3vzdfGwUgIfhm2WARFEVIGMWFDK2CchNAyON63mGBDHtEIOn+ZOMVmsyiJtG/lPqbmcl0zHUn/1H/7SK1oW5XU6SQFI5+DL+XKOGWTaTxJYUQ3X0C16hvIXTNkFlXiuyK0Wrm8LqmW66PXl0Mb+VZ3Q0gr+0pvZR8qvkvwlqsQdxx0aSXFD54Ka+zSS72mgAOr1xaiXbgOHzy1u4r7/r8l40F4F2K23r8KyXZVNemTAKflVQD2OwSUFVrQnceefoxPX/Yk/W9fErhC5TG8Kg5AKiv55RECGaVRPTXKaO9s6XQn4e9iTl+yVKJFFj7ZyCru5oFJY2pEYklSIFyO5o9vTLXmpUcH4lcrDW6AmqAGqotJxeLOkF6xaw3GGC3NDPI985s3A7oyJLxXwTKHnyciwhVPyTOHaKucU5E1BcyD36o7Z+tvWTEUEtZtaknvk4aZEK6Uz/ZBXsgZ2OnJIkKVpE0QTs2akLW5fYFCNzGiWiCB98WvOLpJrPYTvl/7XRbyapX3T5s+6SqRwaCBmfuuWCkUBytpNxaW3aQPti7nuvSbDx6EmZpXRVAXubaUETLV+3kB+51YHbNPcEVb30UueVRBjYFHlQCajZ5ZmRhWVQXbwv1L15ibmmvyPwTY+pK31do2IA9by9fp/JqgPS+pqJqIdtKFbOWNl9wxDuDEm5Ea+zZDJglpIBqXqosq8VcO93UuUNvDbTfaEKZhR1c20CdfwCQIMRGWtxHv8a9OK+KlwXWtWtS2nB5xIGhYCYM1EaUswfu//6tq23C9yCFKPOZ2i7RP9q/imDkskskiyCKZvw==
                                                        X-Forefront-Antispam-Report-Untrusted CIP:192.189.2.18;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:[192.189.2.18];PTR:server4.trendyhousemagazine.online;CAT:NONE;SFS:(13230040)(1800799024)(376014)(36860700013)(34070700014)(82310400026)(8096899003)(4053099003);DIR:OUT;SFP:1102;
                                                        X-Ms-Exchange-Transport-CrosstenantheadersstampedSA1PR16MB5691
                                                        X-Ms-Exchange-Organization-Expirationstarttime07 Mar 2025 13:36:03.8536 (UTC)
                                                        X-Ms-Exchange-Organization-ExpirationstarttimereasonOriginalSubmit
                                                        X-Ms-Exchange-Organization-Expirationinterval1:00:00:00.0000000
                                                        X-Ms-Exchange-Organization-ExpirationintervalreasonOriginalSubmit
                                                        X-Ms-Exchange-Organization-Network-Message-Id f35c52df-06ee-4de5-23cc-08dd5d7d01c6
                                                        X-Eoptenantattributedmessaged5ea0ba6-3c9e-43c2-9d1e-fffeb0d842e5:0
                                                        X-Ms-Exchange-Organization-MessagedirectionalityIncoming
                                                        X-Ms-Exchange-Transport-Crosstenantheadersstripped SN1PEPF000252A3.namprd05.prod.outlook.com
                                                        X-Ms-Exchange-Transport-Crosstenantheaderspromoted SN1PEPF000252A3.namprd05.prod.outlook.com
                                                        X-Ms-PublictraffictypeEmail
                                                        X-Ms-Exchange-Organization-Authsource SN1PEPF000252A3.namprd05.prod.outlook.com
                                                        X-Ms-Exchange-Organization-AuthasAnonymous
                                                        X-Ms-Office365-Filtering-Correlation-Id-Prvs b9797973-b352-46a6-0543-08dd5d7cfedd
                                                        X-Ms-Exchange-AtpmessagepropertiesSA|SL
                                                        X-Ms-Exchange-Organization-Scl1
                                                        X-Microsoft-Antispam BCL:0;ARA:13230040|35042699022|8096899003|4053099003|78100299003|43540500003;
                                                        X-Forefront-Antispam-Report CIP:2a01:111:f403:c40c::;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DX1P273CU004.outbound.protection.outlook.com;PTR:mail-uaenorthazlp170100000.outbound.protection.outlook.com;CAT:NONE;SFS:(13230040)(35042699022)(8096899003)(4053099003)(78100299003)(43540500003);DIR:INB;
                                                        X-Ms-Exchange-Crosstenant-Originalarrivaltime07 Mar 2025 13:36:03.3848 (UTC)
                                                        X-Ms-Exchange-Crosstenant-Network-Message-Id f35c52df-06ee-4de5-23cc-08dd5d7d01c6
                                                        X-Ms-Exchange-Crosstenant-Idd5ea0ba6-3c9e-43c2-9d1e-fffeb0d842e5
                                                        X-Ms-Exchange-Crosstenant-Originalattributedtenantconnectingip TenantId=4489a1d8-a081-4b67-b0fb-38d9a78277f9;Ip=[192.189.2.18];Helo=[[192.189.2.18]]
                                                        X-Ms-Exchange-Crosstenant-Authsource SN1PEPF000252A3.namprd05.prod.outlook.com
                                                        X-Ms-Exchange-Crosstenant-AuthasAnonymous
                                                        X-Ms-Exchange-Crosstenant-FromentityheaderInternet
                                                        X-Ms-Exchange-Transport-Endtoendlatency00:00:03.7890742
                                                        X-Ms-Exchange-Processed-By-Bccfoldering15.20.8511.019
                                                        X-Microsoft-Antispam-Mailbox-Delivery ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(4710117)(4712020)(920097)(930097)(140003);
                                                        X-Microsoft-Antispam-Message-Info 71HjT0wjNlu1luybVRz5qbBYVv9MBd5vnv8Xjv2FVUjXfuLosaru4Iq1p7zK+GLkfUYJQ/dhLi9GZbJm+4xc6TSAeSAjICpmszxJLtqvdw9fRn4z6co3fuDSJQ6xCYNEUi1D7K739/egmwxMxB52WBSROlotBVibb0QyLuj0Q1aK/JuM/KP97xnFFj9A+CUSRYtPIAGmbhKacfbV4bC78Rl1YrqqmjtR1yjbs3LA2fcyXJBoCZ2BSC6TESGCRfvN5Hma04po/9XrW/yrpH9A0gkEVWIBeCxowFCIEDpLqp/2h0YwZewsTn66pIaRlc5EAlcCu7esL86KW6Suqx/EM6CuRcmqnjpOn5o09bhab8hL8NXndj874KoWJ0Gp1JTtCS0L4O365SigZZHiXLd2jI1vrYtSB3jvHMMtuGCDTvzUmXu218SUCQYheIXgQEP/gH4dCn2fcPQwNdh1gv9ZQeFOti2wsDpctC25y8oX4RfsV+kPDS8RyqcQICrtS9wWtIJqhgYOS5690WBs/A2MRuBjLJ44S14Lp0O1KOjcHhQIYtPKbVLZogGb4JGjjyvzg1Cr3ztaRpYb2SN6pTvPSr0/dJDZL3v2REVnA1LJA9Eq00U1mvjRfqNobcMoB+Kd1+PTpn1af1un7VC6ypM176D4enITKrTXnuZRnqfiU3o/LfIMc49VGTDwulecWebEhtQLvt+crTlrzQGBoMgA4EPvrxFNPggkG9jqIlBGkbuUKT0vsjqwvouXb3wVyNjvlRgHztqchGNrvJyw5By+DypL8gZWVhDR1we89pI6h6eQljjCtg8uU36FE4cAAYXV+uP8p/jNl4GWSjT+oolFByyjHFJuqzgPrx5z5WOh8LDLxcxfYp1l7crE0aXqlH/lcqrqgBd+/P+2scAlVhd8W9l6xiVXqh+FrTMlZYhj7FDKny5Ydm1fUDT5naZNgX5nmWpGcLotVpttutW0wZjb/+rBEynXOwFDMRO+AvSIiBE0hiwYke4GxXq3Gl+hOYTS0ZQuPM7n7LwtpxsRlqPy7ayoAgNdun0LnBKmj1dEBh6XeBLW9UgexEoNYOgvCRInoFIBEjy6M+QliC52Z68WXkYcLhnKvQwZTOPnMBX8jyxo9wBgmegf4cnlqart1DOEp+E5yoVyc4BaLXZtHcxRzCzD3cxmjvHBAxFGlxGxL6090AhYMnN0vwWVAOyNtfm+5XR9vbuqyqwzsJ6VaqMRf/DTtd3TmjXpyjTF0gEcBQTKGakvrfl19Xaq0trL3cBUiuBKg+N7+vbYme01cYGRcETbNce8k0bQkfTmlQNoyfBzp9B3jb0uMMbTOXWpXrdulP3h1MIMkxAFzCS3XHA1IpF50dr/03TLbwqwqh5ZCaUhy5URO2ZQZAIPRyE9BT1s8581bUYM3ytk2axgNFm7l/TTlhQ7W4++gkdCnQTj3KtvwQzSICmq4K01Ap1wsUL9zD5AKC5L/ucHAPf5gZue4CO944/sf7wTVQf75YSxxN9Jf4vXD8aPvJAF2Uxb5db4RtfFutCa17N5qcQR8Q4swP8qaNqlz//LXn4t3XQe8rZnTR6+XRFAiAYhQ7lW5wl0pPzAWksAROsmXxECW0r88za4I6VnAYuQJW79hVUZWs4aV5Uy2hbwF5bq4msaqoWWuZrHOpqlG8kAO8nvoxCZEXBKjylyfukY9aerkg8yczhYk5flGUwuxR4BUBT+0/GXPWfDqlTwkGG1rLoqEc+Mj/Aep0FlsVLNsauWNWnww6Y3vkLQSRF/j1ViDVQk0Zy4dWceA3YMCRBAVe2fXGIzXQ==
                                                        Content-Transfer-Encoding7bit

                                                        File Icon

                                                        Icon Hash:46070c0a8e0c67d6