hxxp://X-Triage-Noise-Reduction[:] state=101 X-Triage-Noise-Reduction[:] score=300 X-Triage-Noise-Reduction[:] verdict=phishing Received[:] from SJ2PR05MB9759[.]namprd05[.]prod[.]outlook[.]com (2603[:]10b6[:]a03[:]4c5[::]15) by CO6PR05MB7601[.]namprd05[.]prod[.]outlook[.]com with HTTPS; Tue, 4 Jul 2023 22[:]35[:]47 +0000 Received[:] from DM6PR13CA0012[.]namprd13[.]prod[.]outlook[.]com (2603[:]10b6[:]5[:]bc[::]25) by SJ2PR05MB9759[.]namprd05[.]prod[.]outlook[.]com (2603[:]10b6[:]a03[:]4c5[::]15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15[.]20[.]6500[.]36; Tue, 4 Jul 2023 22[:]34[:]20 +0000 Received[:] from DM6NAM04FT030[.]eop-NAM04[.]prod[.]protection[.]outlook[.]com (2603[:]10b6[:]5[:]bc[:]cafe[::]63) by DM6PR13CA0012[.]outlook[.]office365[.]com (2603[:]10b6[:]5[:]bc[::]25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15[.]20[.]6565[.]18 via Frontend Transport; Tue, 4 Jul 2023 22[:]34[:]19 +0000 Authentication-Results[:] spf=softfail (sender IP is 67[.]231[.]152[.]47) smtp[.]mailfrom=coventryuk[.]org; dkim=pass (signature was verified) header[.]d=coventryuk[.]org;dmarc=pass action=none header[.]from=coventryuk[.]org;compauth=pass reason=100 Received-SPF[:] SoftFail (protection[.]outlook[.]com[:] domain of transitioning coventryuk[.]org discourages use of 67[.]231[.]152[.]47 as permitted sender) Received[:] from mx0a-000e4101[.]pphosted[.]com (67[.]231[.]152[.]47) by DM6NAM04FT030[.]mail[.]protection[.]outlook[.]com (10[.]13[.]159[.]132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15[.]20[.]6565[.]22 via Frontend Transport; Tue, 4 Jul 2023 22[:]34[:]19 +0000 Received[:] from pps[.]filterd (m0040803[.]ppops[.]net [127[.]0[.]0[.]1]) by mx0b-000e4101[.]pphosted[.]com (8[.]17[.]1[.]19/8[.]17[.]1[.]19) with ESMTP id 364DX4V8019193 for <uchaczilona@johndeere[.]com>; Tue, 4 Jul 2023 17[:]34[:]18 -0500 Authentication-Results-Original[:] ppops[.]net; spf=pass smtp[.]mailfrom=wilson@coventryuk[.]org; dkim=pass header[.]s=turbo-smtp header[.]d=coventryuk[.]org; dmarc=pass header[.]from=coventryuk[.]org Received[:] from nbjjceehccdf[.]turbo-smtp[.]net (nbjjceehccdf[.]turbo-smtp[.]net [199[.]244[.]72[.]235]) by mx0b-000e4101[.]pphosted[.]com (PPS) with ESMTPS id 3rmmdk9w9q-1 (version=TLSv1[.]2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <uchaczilona@johndeere[.]com>; Tue, 04 Jul 2023 17[:]34[:]16 -0500 DKIM-Signature[:] v=1; a=rsa-sha256; c=relaxed/relaxed; d=coventryuk[.]org; s=turbo-smtp; x=1689114856; h=Received[:] Received[:]From[:]Subject[:]To[:]Content-Type[:]MIME-Version[:]Reply-To[:]Date[:] Feedback-Id[:]Message-ID; bh=q/CZ72m+SRebbBEKwGHrYda/Gf2shyKv14hBi v5k+hg=; b=0jzDe9agCQ+Dg3Uqq8hAoAGMEsbO3vnstuSVYerWTRRUt+WKAqX8W jeQe737wdibHNBnD2hD26TbxVmMYt32ba/IVpAc32PeAu1OiUlhc473r7IQs/IpK XkzV5qNoyNsEscdDfpIu02ZWC4aqxQXCyN6W8uYvkntSYTukYE8QuI= Received[:] (qmail 3575344 invoked from network); 4 Jul 2023 22[:]34[:]15 -0000 Received[:] from ?UNAVAILABLE? (HELO vps2569536[.]trouble-free[.]net) (authenticated@67[.]211[.]218[.]36) by turbo-smtp[.]com with SMTP; 4 Jul 2023 22[:]34[:]14 -0000 X-TurboSMTP-Tracking[:] 64-0125ce85-000018cef712ea812000-000-3c34bfbb From[:] "C O V E N T R Y" <wilson@coventryuk[.]org> Subject[:] London Training 2023 To[:] "uchaczilona" <uchaczilona@johndeere[.]com> Content-Type[:] multipart/alternative; boundary="JScQmYKVq=_a5qNf1novx6DQToomWR4FGJ" Reply-To[:] "Coventry Academy, UK" <info@coventryacademy[.]com> Date[:] Tue, 4 Jul 2023 15[:]34[:]14 -0700 Feedback-Id[:] 19254917 Message-ID[:] <64-0125ce85-000018cef712ea812000-000-3c34bfbb@xhf97[.]trackmails1[.]com> X-CLX-Shades[:] MLX X-Proofpoint-ORIG-GUID[:] 3ayIuFiTnLz3Kx3Pl5C0IGaToBhulpFw X-Proofpoint-GUID[:] 3ayIuFiTnLz3Kx3Pl5C0IGaToBhulpFw X-CLX-Response[:] 1TFkXBxseEhEKWUQXZB9bSU1kellQWnoRClhYF2NbbUtpbGxgE2BSEQp4Thd nRxNefAEbYW1TSREKeEsXY1ttS2lsbGATYFIRCnhMF2xAfx4SUkRQQ0tGEQp5TBdgfWlyQB9nW3 xrWBEKQ0gXBxsYExEKQ1kXBxgcHxEKQ0kXGgQaGhoRCllNF2dmchEKWUkXGnEaEBp3BgcbGBJxG BAfHHcGBxgaBhoRClleF2xseREKSUYXQEVCRE5PT1hPdUJFWV5PThEKSUcXeE9NEQpDThcZS1Nj X2xDfkRmUBlhUhl6Rh9pGmNtS35FaEJfRlpsXREKWFwXHwQaBBkbEwUbGgQbGxoEGxkeBBkfEBs eGh8aEQpeWRdIGEFnbxEKTVwXGx8eEQpMWhduG24fQ00RCkVZF2hraxEKTF8XegUFBQUFBQUFBR 0RCk1OF2hoEQpMRhdva2tja2sRCkJPF2N+XxteRl9IThhpEQpDWhcbExMEGB4eBB0YBBgZHxEKQ l4XGxEKQlwXGxEKXk4XGxEKQksXYBgbT29LSGFDGXwRCkJJF2AYG09vS0hhQxl8EQpCRRdsAWwa ZX5Pfk1IYhEKQk4XYBgbT29LSGFDGXwRCkJMF2NCc3BSa2hvUnB5EQpCbBdkR2trRhISXxpYbRE KQkAXaX1tc04YYxtSU34RCkJYF2d+XUB9RxgfRR9gEQp5QxdkG3kde0F6YXBvaxEKWUsXGxgZEQ paSxcTEhIRCnBnF2VwW2MbXG4cR0xBEAcSEhEKcGgXegV/bl9pbVkBXxIQBx8YEQpwaBdkXlkTR lJuSBpEQRAHHxgRCnBoF2MbZ0FbBRNkGxp+EAcdEhEKcGgXY0ZnSUxYfkx5YVAQBxIdEQpwaBdh Qm9kewV7a1hgUhAHHBoRCnBoF2YFGF1iS0FwaxN+EAcbGxMRCnBoF29jE3AefE19eHJiEAcZHRE KcGgXbhpMWwVbaVNjTFMQBxIaEQpwbBdjUlJTGXofHX5FQRAHEhoRCnBDF2l+SxoaenpcQhhwEA cSEhEKbX4XGhEKWE0XSxEg X-Proofpoint-Virus-Version[:] vendor=baseguard engine=ICAP[:]2[.]0[.]254,Aquarius[:]18[.]0[.]957,Hydra[:]6[.]0[.]591,FMLib[:]17[.]11[.]176[.]26 definitions=2023-07-04_14,2023-07-04_01,2023-05-22_02 X-Proofpoint-Spam-Details[:] rule=defaultinbound_notspam policy=defaultinbound score=0 suspectscore=0 phishscore=0 unknownsenderscore=20 lowpriorityscore=43 adultscore=0 clxscore=-148 malwarescore=0 spamscore=0 mlxscore=0 impostorscore=0 mlxlogscore=837 bulkscore=43 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8[.]12[.]0-2305260000 definitions=main-2307040199 domainage_hfrom=123 domainage_replyto=988 Return-Path[:] wilson@coventryuk[.]org X-MS-Exchange-Organization-ExpirationStartTime[:] 04 Jul 2023 22[:]34[:]19[.]2674 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason[:] OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval[:] 1[:]00[:]00[:]00[.]0000000 X-MS-Exchange-Organization-ExpirationIntervalReason[:] OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id[:] f5856162-711b-4ae2-37a5-08db7cdece88 X-EOPAttributedMessage[:] 0 X-EOPTenantAttributedMessage[:] 39b03722-b836-496a-85ec-850f0957ca6b[:]0 X-MS-Exchange-Organization-MessageDirectionality[:] Incoming X-MS-PublicTrafficType[:] Email X-MS-TrafficTypeDiagnostic[:] DM6NAM04FT030[:]EE_|SJ2PR05MB9759[:]EE_|CO6PR05MB7601[:]EE_ X-MS-Exchange-Organization-AuthSource[:] DM6NAM04FT030[.]eop-NAM04[.]prod[.]protection[.]outlook[.]com X-MS-Exchange-Organization-AuthAs[:] Anonymous X-MS-Office365-Filtering-Correlation-Id[:] f5856162-711b-4ae2-37a5-08db7cdece88 X-MS-Exchange-AtpMessageProperties[:] SA|SL X-MS-Exchange-Organization-SCL[:] -1 X-Microsoft-Antispam[:] BCL[:]7; X-Forefront-Antispam-Report[:] CIP[:]67[.]231[.]152[.]47;CTRY[:]US;LANG[:]en;SCL[:]-1;SRV[:];IPV[:]NLI;SFV[:]NSPM;H[:]mx0a-000e4101[.]pphosted[.]com;PTR[:]mx0b-000e4101[.]pphosted[.]com;CAT[:]NONE;SFS[:];DIR[:]INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime[:] 04 Jul 2023 22[:]34[:]19[.]1112 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id[:] f5856162-711b-4ae2-37a5-08db7cdece88 X-MS-Exchange-CrossTenant-Id[:] 39b03722-b836-496a-85ec-850f0957ca6b X-MS-Exchange-CrossTenant-AuthSource[:] DM6NAM04FT030[.]eop-NAM04[.]prod[.]protection[.]outlook[.]com X-MS-Exchange-CrossTenant-AuthAs[:] Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader[:] Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped[:] SJ2PR05MB9759 X-MS-Exchange-Transport-EndToEndLatency[:] 00[:]01[:]28[.]5113677 X-MS-Exchange-Processed-By-BccFoldering[:] 15[.]20[.]6565[.]014 X-Microsoft-Antispam-Mailbox-Delivery[:] ucf[:]0;jmr[:]0;auth[:]0;dest[:]I;ENG[:](910001)(944506478)(944626604)(920097)(930097); X-Microsoft-Antispam-Message-Info[:] =?utf-8?B?SEJFVkZHRW5tMkdvN05ueDR2QWxrNWh2UnpwOFF6WGpsQnk5bkp0em85STFt?= =?utf-8?B?VUkyVEVUSGVtR1BWTUlJTWV1TFVWUXU4cjcrd3JhNVMzQU5hRnVFYitOT24v?= =?utf-8?B?MFNkQjJNeVgrbzl6SjRBbHRsUVhTenVOQzBnRWNhaUhHTzVjWldUSHE3Slhu?= =?utf-8?B?RXM3dDlNVm9qb29DUFpzNkdZK2d3K0VQeDduUUUyT3gzbHlhMlFHZ3lZWXBK?= =?utf-8?B?Tk55RG9BcDJQbDA0eUVOQm40U0ZtTzZ6WkJqRTVDTkxEWHA1OW0ram9NMS9y?= =?utf-8?B?cm5mWmVVemxvd1M4TTFIeHh1Rkw5eXVUbGdTNFlXNGg0RjFxQW56cGdxVGVh?= =?utf-8?B?OW5tVWJPcFdhYmxEeUxWWk1jRVhJM084UGYyeEhRTU5rZ2FrNlVwOXNDVzVz?= =?utf-8?B?TWcvWUZtWFFCRkF6ZnZmUmc1R0RHdzd6Z0hWYUVFVzEzSkdYRDZsSDhYMS9r?= =?utf-8?B?bEVkVnhWbmNoeTJJSUI3c0ErWUJrazNROUdZWTYwRlh6b0l2OVFNOGd0ZHla?= =?utf-8?B?bXdxSkhsYW1ZWDJEVUJRZFlKUTlOanhTVXEvM2QxSmcrajArbUtJVXdxL0lP?= =?utf-8?B?NnZWdkNzZDJWdWlSd2lkUGprMTVoMSs5RURSa3hDaE14RnoyRUdvZjRCL3JR?= =?utf-8?B?SjZrR2Z0MEw0eDViMDhJVndPTlNmTUpmejNoY1F4R1ZIeTExNWR2eTNTQUlh?= =?utf-8?B?Q2FNL0RlNHJxVCswaitscy85UXR0anBUdU5yaktLaS9SRTY5ajRtWjk1blJW?= =?utf-8?B?d29xb0t5Ym4zZ25IeXVkUC9mWnJqbHdnUVUyUUEyT3ROZVoydWVoSXJZT25i?= =?utf-8?B?Vk1NQTBSRG9pYVEwQUJGWklrQ253TXppeWdmS0dDSVBsM0hicXZqU2tjOWpm?= =?utf-8?B?bEtxN3lXV0NVSHdBSDlscjVmbHVKOGZMMkt5QVByZ3lDMDJZdnlXTW5nZzNi?= =?utf-8?B?N1I1Znd3SERrTkNYc3pJRGdkOWk4QUNySm8wL3NBNytWOVE4WmFoTVVXWWRV?= =?utf-8?B?dWQzTER2K2FiMTZwYVlHcU9iMkE5V1ZjSGVtR3MzblZWNklsamJ0RDJ3ZHU0?= =?utf-8?B?L0hVQklCNHZkVytRaGMzVnpnSmdhL1AzWjhXVnpXT1FPSlhKc1l5Qk5YT3Jq?= =?utf-8?B?cnVYbjNBYkpmMXQvZkJkZ3BiUjFDVTgzamhTdk9pWkQyYmNUL2tCZGdrUFIy?= =?utf-8?B?WlBKalVqcXExT3NmRk0vOU5ab2I0SVB4UlVqZzdWa0pWY1NLM0I2S0k1Z3Bj?= =?utf-8?B?SWxBSThERmRhUlpUY0RzVWlrbEpHUTRnamcxL2c3aTZyNTMyRm1MVi9FNHlY?= =?utf-8?B?WjJrbFBYUjN6TmNKS1Fma1pKT2pZRTA2VzQyUE5mb1YrY2UvMlhVVGxvZ0xo?= =?utf-8?B?cmFIenBuZlc3ZE9tQVJqdTdLWSt3ZEV6ZVlZL1drd00yU2ZMcFMwKzRudWMx?= =?utf-8?B?cjJMV251ekI2K0g5RUJGSmsyVVNNUGduYmpvTzNNWk44MS9KT3RodHhFSVha?= =?utf-8?B?MEh2ajR4aDFOK25MNUpidGhSaE5aSzVBWGlJMTNwclBEMXNpdmFPWjU0SlJF?= =?utf-8?B?MGY3Sk5TaVd3MFVHVEhwcjF5OFViWExZRjVCQlVFUkd5dThoYkFuMlRURGx2?= =?utf-8?B?T1gwcVlGUHF2YUhXVEZnVmphQWlGeVVoSlFrb1MwUXZmUGFJa01udHRqT2xq?= =?utf-8?B?TGVVUXA4S1A2UUdIRWs1UzJuNkxaWGk1QXV6Nm50TVZNcDEyMXVoUXZPTTNs?= =?utf-8?B?dFg4eitlWjBlZVFTaWVuRnhSWGNyRndmM2RkeFZZVGdwM1FqbTcxRjBQaXJ5?= =?utf-8?B?ZmZZU2RMSjR4eTFvWFhaT05GYlpUSFNTS2lDK3B2U0VZUVVxT3lhYjMzRlNx?= =?utf-8?B?bTBna3p6L1YvbGlzR3ZrSW1hSW1ZUmhHd0Z6MjUzNm12NFpZWFdVYjZPcUsv?= =?utf-8?B?bnBiVkp5Nk1xL2tKeWw2alhIMjhMYXQxV1NSSFFkenRuUFZwenA2cjR3ZnBv?= =?utf-8?B?aDRZWlZuU0NOMWxpWjdrSjJvSkhzSllpRVliZUxkS0Z5cEJpMVRpYjVVbFRi?= =?utf-8?B?Y1RaQVVUdXJEeE5pUXgrSEVRZVVmVFdjc3ZMbGtmWEdxNy9YY3ZYVUZOajJv?= =?utf-8?B?cCtUekhUUEY4S2hKWjg2RHR4N3BPY3FRZVFFUG5jZExhUjh5WjVRY3hQaTNp?= =?utf-8?B?MHVYVnZnN2U5amJqWkZwWGRCc2VmbTNobklaZ092UHVNeEx5UllSL0FRbnds?= =?utf-8?B?TTRoZmxEaUl5Y29DeDBXZDdHSU9XYVd0RUZtWnJING5OQU9pM0NtVjd2MjNP?= =?utf-8?B?V1VtYlVkeFQ3cTRsV0JoOXI5TDluVXFndnpMb2pzNXlQMndoams1aFNHcFN4?= =?utf-8?B?UklYSi9JZVlXZE9LNFJleCs0QlkxbzhNeVNadzdlTkFTWnIzdXgxa0JRN2Zm?= =?utf-8?B?amw5SUtQbDNFRmR4S1U0cXFndjRqVGJXdk1tdDcwVWZxaCtIRTNLa0xYdWxK?= =?utf-8?B?cjQxYXlGM3BYbGVxMjF4NENrYjFZNkU1NUlnc1UrdWgxemJtd2FwK0trQ0Zp?= =?utf-8?B?emtGNjNvZUFhWVliMkJYajNCTXR0Zld6akJhZ2RBNFJ0WDJzUVAyZ04wWTEv?= =?utf-8?B?R1oxMXRjaVowcjZkNDFmU3RiclhIaDFQdkpkR2sxa0psWUtES25uSEZCT0sx?= =?utf-8?B?WTkvckZpQ29uUUVJWVJGVG5QRXFEVUFST3BiSWFqTW5JUnpNM0NwckJ0V1Qz?= =?utf-8?B?Q2h4SHkyTTFCMVRQM1VZQ1l6VjJDNjlVRGtCbnhwN01kUCs4aDZ6UVpVUFha?= =?utf-8?B?ZWdCVDBaT2VGNVl5NFd5YnhFWG9tNXQ3aU1PUEFzTHROTCs1MVF5SDdVay9I?= =?utf-8?B?ZG82bnhIREhBd1F3MXFNKzJCUjJCbXdmdEVCaVdaOG5NMVU2S2twVWRlTUx3?= =?utf-8?B?amd3bnpDd2M0TWJPLzBETmpQN2R0S1A1bFRnOEtDbGU0RHNxTjcrNnY4VTdi?= =?utf-8?Q?Kaj6/kX8yXkAVI=3D?= MIME-Version[:] 1[.]0

Sharing

Behavioral task

behavioral1

Sample

http://X-Triage-Noise-Reduction: state=101 X-Triage-Noise-Reduction: score=300 X-Triage-Noise-Reduction: verdict=phishing Received: from SJ2PR05MB9759.namprd05.prod.outlook.com (2603:10b6:a03:4c5::15) by CO6PR05MB7601.namprd05.prod.outlook.com with HTTPS; Tue, 4 Jul 2023 22:35:47 +0000 Received: from DM6PR13CA0012.namprd13.prod.outlook.com (2603:10b6:5:bc::25) by SJ2PR05MB9759.namprd05.prod.outlook.com (2603:10b6:a03:4c5::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6500.36; Tue, 4 Jul 2023 22:34:20 +0000 Received: from DM6NAM04FT030.eop-NAM04.prod.protection.outlook.com (2603:10b6:5:bc:cafe::63) by DM6PR13CA0012.outlook.office365.com (2603:10b6:5:bc::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6565.18 via Frontend Transport; Tue, 4 Jul 2023 22:34:19 +0000 Authentication-Results: spf=softfail (sender IP is 67.231.152.47) smtp.mailfrom=coventryuk.org; dkim=pass (signature was verified) header.d=coventryuk.org;dmarc=pass action=none header.from=coventryuk.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning coventryuk.org discourages use of 67.231.152.47 as permitted sender) Received: from mx0a-000e4101.pphosted.com (67.231.152.47) by DM6NAM04FT030.mail.protection.outlook.com (10.13.159.132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6565.22 via Frontend Transport; Tue, 4 Jul 2023 22:34:19 +0000 Received: from pps.filterd (m0040803.ppops.net [127.0.0.1]) by mx0b-000e4101.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 364DX4V8019193 for <[email protected]>; Tue, 4 Jul 2023 17:34:18 -0500 Authentication-Results-Original: ppops.net; spf=pass [email protected]; dkim=pass header.s=turbo-smtp header.d=coventryuk.org; dmarc=pass header.from=coventryuk.org Received: from nbjjceehccdf.turbo-smtp.net (nbjjceehccdf.turbo-smtp.net [199.244.72.235]) by mx0b-000e4101.pphosted.com (PPS) with ESMTPS id 3rmmdk9w9q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Tue, 04 Jul 2023 17:34:16 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coventryuk.org; s=turbo-smtp; x=1689114856; h=Received: Received:From:Subject:To:Content-Type:MIME-Version:Reply-To:Date: Feedback-Id:Message-ID; bh=q/CZ72m+SRebbBEKwGHrYda/Gf2shyKv14hBi v5k+hg=; b=0jzDe9agCQ+Dg3Uqq8hAoAGMEsbO3vnstuSVYerWTRRUt+WKAqX8W jeQe737wdibHNBnD2hD26TbxVmMYt32ba/IVpAc32PeAu1OiUlhc473r7IQs/IpK XkzV5qNoyNsEscdDfpIu02ZWC4aqxQXCyN6W8uYvkntSYTukYE8QuI= Received: (qmail 3575344 invoked from network); 4 Jul 2023 22:34:15 -0000 Received: from ?UNAVAILABLE? (HELO vps2569536.trouble-free.net) ([email protected]) by turbo-smtp.com with SMTP; 4 Jul 2023 22:34:14 -0000 X-TurboSMTP-Tracking: 64-0125ce85-000018cef712ea812000-000-3c34bfbb From: "C O V E N T R Y" <[email protected]> Subject: London Training 2023 To: "uchaczilona" <[email protected]> Content-Type: multipart/alternative; boundary="JScQmYKVq=_a5qNf1novx6DQToomWR4FGJ" Reply-To: "Coventry Academy, UK" <[email protected]> Date: Tue, 4 Jul 2023 15:34:14 -0700 Feedback-Id: 19254917 Message-ID: <64-0125ce85-000018cef712ea812000-000-3c34bfbb@xhf97.trackmails1.com> X-CLX-Shades: MLX X-Proofpoint-ORIG-GUID: 3ayIuFiTnLz3Kx3Pl5C0IGaToBhulpFw X-Proofpoint-GUID: 3ayIuFiTnLz3Kx3Pl5C0IGaToBhulpFw X-CLX-Response: 1TFkXBxseEhEKWUQXZB9bSU1kellQWnoRClhYF2NbbUtpbGxgE2BSEQp4Thd nRxNefAEbYW1TSREKeEsXY1ttS2lsbGATYFIRCnhMF2xAfx4SUkRQQ0tGEQp5TBdgfWlyQB9nW3 xrWBEKQ0gXBxsYExEKQ1kXBxgcHxEKQ0kXGgQaGhoRCllNF2dmchEKWUkXGnEaEBp3BgcbGBJxG BAfHHcGBxgaBhoRClleF2xseREKSUYXQEVCRE5PT1hPdUJFWV5PThEKSUcXeE9NEQpDThcZS1Nj X2xDfkRmUBlhUhl6Rh9pGmNtS35FaEJfRlpsXREKWFwXHwQaBBkbEwUbGgQbGxoEGxkeBBkfEBs eGh8aEQpeWRdIGEFnbxEKTVwXGx8eEQpMWhduG24fQ00RCkVZF2hraxEKTF8XegUFBQUFBQUFBR 0RCk1OF2hoEQpMRhdva2tja2sRCkJPF2N+XxteRl9IThhpEQpDWhcbExMEGB4eBB0YBBgZHxEKQ l4XGxEKQlwXGxEKXk4XGxEKQksXYBgbT29LSGFDGXwRCkJJF2AYG09vS0hhQxl8EQpCRRdsAWwa ZX5Pfk1IYhEKQk4XYBgbT29LSGFDGXwRCkJMF2NCc3BSa2hvUnB5EQpCbBdkR2trRhISXxpYbRE KQkAXaX1tc04YYxtSU34RCkJYF2d+XUB9RxgfRR9gEQp5QxdkG3kde0F6YXBvaxEKWUsXGxgZEQ paSxcTEhIRCnBnF2VwW2MbXG4cR0xBEAcSEhEKcGgXegV/bl9pbVkBXxIQBx8YEQpwaBdkXlkTR lJuSBpEQRAHHxgRCnBoF2MbZ0FbBRNkGxp+EAcdEhEKcGgXY0ZnSUxYfkx5YVAQBxIdEQpwaBdh Qm9kewV7a1hgUhAHHBoRCnBoF2YFGF1iS0FwaxN+EAcbGxMRCnBoF29jE3AefE19eHJiEAcZHRE KcGgXbhpMWwVbaVNjTFMQBxIaEQpwbBdjUlJTGXofHX5FQRAHEhoRCnBDF2l+SxoaenpcQhhwEA cSEhEKbX4XGhEKWE0XSxEg X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.591,FMLib:17.11.176.26 definitions=2023-07-04_14,2023-07-04_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=defaultinbound_notspam policy=defaultinbound score=0 suspectscore=0 phishscore=0 unknownsenderscore=20 lowpriorityscore=43 adultscore=0 clxscore=-148 malwarescore=0 spamscore=0 mlxscore=0 impostorscore=0 mlxlogscore=837 bulkscore=43 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2305260000 definitions=main-2307040199 domainage_hfrom=123 domainage_replyto=988 Return-Path: [email protected] X-MS-Exchange-Organization-ExpirationStartTime: 04 Jul 2023 22:34:19.2674 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: f5856162-711b-4ae2-37a5-08db7cdece88 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 39b03722-b836-496a-85ec-850f0957ca6b:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DM6NAM04FT030:EE_|SJ2PR05MB9759:EE_|CO6PR05MB7601:EE_ X-MS-Exchange-Organization-AuthSource: DM6NAM04FT030.eop-NAM04.prod.protection.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id: f5856162-711b-4ae2-37a5-08db7cdece88 X-MS-Exchange-AtpMessageProperties: SA|SL X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:7; X-Forefront-Antispam-Report: CIP:67.231.152.47;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:mx0a-000e4101.pphosted.com;PTR:mx0b-000e4101.pphosted.com;CAT:NONE;SFS:;DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Jul 2023 22:34:19.1112 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f5856162-711b-4ae2-37a5-08db7cdece88 X-MS-Exchange-CrossTenant-Id: 39b03722-b836-496a-85ec-850f0957ca6b X-MS-Exchange-CrossTenant-AuthSource: DM6NAM04FT030.eop-NAM04.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR05MB9759 X-MS-Exchange-Transport-EndToEndLatency: 00:01:28.5113677 X-MS-Exchange-Processed-By-BccFoldering: 15.20.6565.014 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097); X-Microsoft-Antispam-Message-Info: =?utf-8?B?SEJFVkZHRW5tMkdvN05ueDR2QWxrNWh2UnpwOFF6WGpsQnk5bkp0em85STFt?= =?utf-8?B?VUkyVEVUSGVtR1BWTUlJTWV1TFVWUXU4cjcrd3JhNVMzQU5hRnVFYitOT24v?= =?utf-8?B?MFNkQjJNeVgrbzl6SjRBbHRsUVhTenVOQzBnRWNhaUhHTzVjWldUSHE3Slhu?= =?utf-8?B?RXM3dDlNVm9qb29DUFpzNkdZK2d3K0VQeDduUUUyT3gzbHlhMlFHZ3lZWXBK?= =?utf-8?B?Tk55RG9BcDJQbDA0eUVOQm40U0ZtTzZ6WkJqRTVDTkxEWHA1OW0ram9NMS9y?= =?utf-8?B?cm5mWmVVemxvd1M4TTFIeHh1Rkw5eXVUbGdTNFlXNGg0RjFxQW56cGdxVGVh?= =?utf-8?B?OW5tVWJPcFdhYmxEeUxWWk1jRVhJM084UGYyeEhRTU5rZ2FrNlVwOXNDVzVz?= =?utf-8?B?TWcvWUZtWFFCRkF6ZnZmUmc1R0RHdzd6Z0hWYUVFVzEzSkdYRDZsSDhYMS9r?= =?utf-8?B?bEVkVnhWbmNoeTJJSUI3c0ErWUJrazNROUdZWTYwRlh6b0l2OVFNOGd0ZHla?= =?utf-8?B?bXdxSkhsYW1ZWDJEVUJRZFlKUTlOanhTVXEvM2QxSmcrajArbUtJVXdxL0lP?= =?utf-8?B?NnZWdkNzZDJWdWlSd2lkUGprMTVoMSs5RURSa3hDaE14RnoyRUdvZjRCL3JR?= =?utf-8?B?SjZrR2Z0MEw0eDViMDhJVndPTlNmTUpmejNoY1F4R1ZIeTExNWR2eTNTQUlh?= =?utf-8?B?Q2FNL0RlNHJxVCswaitscy85UXR0anBUdU5yaktLaS9SRTY5ajRtWjk1blJW?= =?utf-8?B?d29xb0t5Ym4zZ25IeXVkUC9mWnJqbHdnUVUyUUEyT3ROZVoydWVoSXJZT25i?= =?utf-8?B?Vk1NQTBSRG9pYVEwQUJGWklrQ253TXppeWdmS0dDSVBsM0hicXZqU2tjOWpm?= =?utf-8?B?bEtxN3lXV0NVSHdBSDlscjVmbHVKOGZMMkt5QVByZ3lDMDJZdnlXTW5nZzNi?= =?utf-8?B?N1I1Znd3SERrTkNYc3pJRGdkOWk4QUNySm8wL3NBNytWOVE4WmFoTVVXWWRV?= =?utf-8?B?dWQzTER2K2FiMTZwYVlHcU9iMkE5V1ZjSGVtR3MzblZWNklsamJ0RDJ3ZHU0?= =?utf-8?B?L0hVQklCNHZkVytRaGMzVnpnSmdhL1AzWjhXVnpXT1FPSlhKc1l5Qk5YT3Jq?= =?utf-8?B?cnVYbjNBYkpmMXQvZkJkZ3BiUjFDVTgzamhTdk9pWkQyYmNUL2tCZGdrUFIy?= =?utf-8?B?WlBKalVqcXExT3NmRk0vOU5ab2I0SVB4UlVqZzdWa0pWY1NLM0I2S0k1Z3Bj?= =?utf-8?B?SWxBSThERmRhUlpUY0RzVWlrbEpHUTRnamcxL2c3aTZyNTMyRm1MVi9FNHlY?= =?utf-8?B?WjJrbFBYUjN6TmNKS1Fma1pKT2pZRTA2VzQyUE5mb1YrY2UvMlhVVGxvZ0xo?= =?utf-8?B?cmFIenBuZlc3ZE9tQVJqdTdLWSt3ZEV6ZVlZL1drd00yU2ZMcFMwKzRudWMx?= =?utf-8?B?cjJMV251ekI2K0g5RUJGSmsyVVNNUGduYmpvTzNNWk44MS9KT3RodHhFSVha?= =?utf-8?B?MEh2ajR4aDFOK25MNUpidGhSaE5aSzVBWGlJMTNwclBEMXNpdmFPWjU0SlJF?= =?utf-8?B?MGY3Sk5TaVd3MFVHVEhwcjF5OFViWExZRjVCQlVFUkd5dThoYkFuMlRURGx2?= =?utf-8?B?T1gwcVlGUHF2YUhXVEZnVmphQWlGeVVoSlFrb1MwUXZmUGFJa01udHRqT2xq?= =?utf-8?B?TGVVUXA4S1A2UUdIRWs1UzJuNkxaWGk1QXV6Nm50TVZNcDEyMXVoUXZPTTNs?= =?utf-8?B?dFg4eitlWjBlZVFTaWVuRnhSWGNyRndmM2RkeFZZVGdwM1FqbTcxRjBQaXJ5?= =?utf-8?B?ZmZZU2RMSjR4eTFvWFhaT05GYlpUSFNTS2lDK3B2U0VZUVVxT3lhYjMzRlNx?= =?utf-8?B?bTBna3p6L1YvbGlzR3ZrSW1hSW1ZUmhHd0Z6MjUzNm12NFpZWFdVYjZPcUsv?= =?utf-8?B?bnBiVkp5Nk1xL2tKeWw2alhIMjhMYXQxV1NSSFFkenRuUFZwenA2cjR3ZnBv?= =?utf-8?B?aDRZWlZuU0NOMWxpWjdrSjJvSkhzSllpRVliZUxkS0Z5cEJpMVRpYjVVbFRi?= =?utf-8?B?Y1RaQVVUdXJEeE5pUXgrSEVRZVVmVFdjc3ZMbGtmWEdxNy9YY3ZYVUZOajJv?= =?utf-8?B?cCtUekhUUEY4S2hKWjg2RHR4N3BPY3FRZVFFUG5jZExhUjh5WjVRY3hQaTNp?= =?utf-8?B?MHVYVnZnN2U5amJqWkZwWGRCc2VmbTNobklaZ092UHVNeEx5UllSL0FRbnds?= =?utf-8?B?TTRoZmxEaUl5Y29DeDBXZDdHSU9XYVd0RUZtWnJING5OQU9pM0NtVjd2MjNP?= =?utf-8?B?V1VtYlVkeFQ3cTRsV0JoOXI5TDluVXFndnpMb2pzNXlQMndoams1aFNHcFN4?= =?utf-8?B?UklYSi9JZVlXZE9LNFJleCs0QlkxbzhNeVNadzdlTkFTWnIzdXgxa0JRN2Zm?= =?utf-8?B?amw5SUtQbDNFRmR4S1U0cXFndjRqVGJXdk1tdDcwVWZxaCtIRTNLa0xYdWxK?= =?utf-8?B?cjQxYXlGM3BYbGVxMjF4NENrYjFZNkU1NUlnc1UrdWgxemJtd2FwK0trQ0Zp?= =?utf-8?B?emtGNjNvZUFhWVliMkJYajNCTXR0Zld6akJhZ2RBNFJ0WDJzUVAyZ04wWTEv?= =?utf-8?B?R1oxMXRjaVowcjZkNDFmU3RiclhIaDFQdkpkR2sxa0psWUtES25uSEZCT0sx?= =?utf-8?B?WTkvckZpQ29uUUVJWVJGVG5QRXFEVUFST3BiSWFqTW5JUnpNM0NwckJ0V1Qz?= =?utf-8?B?Q2h4SHkyTTFCMVRQM1VZQ1l6VjJDNjlVRGtCbnhwN01kUCs4aDZ6UVpVUFha?= =?utf-8?B?ZWdCVDBaT2VGNVl5NFd5YnhFWG9tNXQ3aU1PUEFzTHROTCs1MVF5SDdVay9I?= =?utf-8?B?ZG82bnhIREhBd1F3MXFNKzJCUjJCbXdmdEVCaVdaOG5NMVU2S2twVWRlTUx3?= =?utf-8?B?amd3bnpDd2M0TWJPLzBETmpQN2R0S1A1bFRnOEtDbGU0RHNxTjcrNnY4VTdi?= =?utf-8?Q?Kaj6/kX8yXkAVI=3D?= MIME-Version: 1.0

Resource

win10v2004-20230703-en

windows10-2004-x64

8 signatures

300 seconds

General

Target

http://X-Triage-Noise-Reduction: state=101 X-Triage-Noise-Reduction: score=300 X-Triage-Noise-Reduction: verdict=phishing Received: from SJ2PR05MB9759.namprd05.prod.outlook.com (2603:10b6:a03:4c5::15) by CO6PR05MB7601.namprd05.prod.outlook.com with HTTPS; Tue, 4 Jul 2023 22:35:47 +0000 Received: from DM6PR13CA0012.namprd13.prod.outlook.com (2603:10b6:5:bc::25) by SJ2PR05MB9759.namprd05.prod.outlook.com (2603:10b6:a03:4c5::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6500.36; Tue, 4 Jul 2023 22:34:20 +0000 Received: from DM6NAM04FT030.eop-NAM04.prod.protection.outlook.com (2603:10b6:5:bc:cafe::63) by DM6PR13CA0012.outlook.office365.com (2603:10b6:5:bc::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6565.18 via Frontend Transport; Tue, 4 Jul 2023 22:34:19 +0000 Authentication-Results: spf=softfail (sender IP is 67.231.152.47) smtp.mailfrom=coventryuk.org; dkim=pass (signature was verified) header.d=coventryuk.org;dmarc=pass action=none header.from=coventryuk.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning coventryuk.org discourages use of 67.231.152.47 as permitted sender) Received: from mx0a-000e4101.pphosted.com (67.231.152.47) by DM6NAM04FT030.mail.protection.outlook.com (10.13.159.132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6565.22 via Frontend Transport; Tue, 4 Jul 2023 22:34:19 +0000 Received: from pps.filterd (m0040803.ppops.net [127.0.0.1]) by mx0b-000e4101.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 364DX4V8019193 for <[email protected]>; Tue, 4 Jul 2023 17:34:18 -0500 Authentication-Results-Original: ppops.net; spf=pass [email protected]; dkim=pass header.s=turbo-smtp header.d=coventryuk.org; dmarc=pass header.from=coventryuk.org Received: from nbjjceehccdf.turbo-smtp.net (nbjjceehccdf.turbo-smtp.net [199.244.72.235]) by mx0b-000e4101.pphosted.com (PPS) with ESMTPS id 3rmmdk9w9q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <[email protected]>; Tue, 04 Jul 2023 17:34:16 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coventryuk.org; s=turbo-smtp; x=1689114856; h=Received: Received:From:Subject:To:Content-Type:MIME-Version:Reply-To:Date: Feedback-Id:Message-ID; bh=q/CZ72m+SRebbBEKwGHrYda/Gf2shyKv14hBi v5k+hg=; b=0jzDe9agCQ+Dg3Uqq8hAoAGMEsbO3vnstuSVYerWTRRUt+WKAqX8W jeQe737wdibHNBnD2hD26TbxVmMYt32ba/IVpAc32PeAu1OiUlhc473r7IQs/IpK XkzV5qNoyNsEscdDfpIu02ZWC4aqxQXCyN6W8uYvkntSYTukYE8QuI= Received: (qmail 3575344 invoked from network); 4 Jul 2023 22:34:15 -0000 Received: from ?UNAVAILABLE? (HELO vps2569536.trouble-free.net) ([email protected]) by turbo-smtp.com with SMTP; 4 Jul 2023 22:34:14 -0000 X-TurboSMTP-Tracking: 64-0125ce85-000018cef712ea812000-000-3c34bfbb From: "C O V E N T R Y" <[email protected]> Subject: London Training 2023 To: "uchaczilona" <[email protected]> Content-Type: multipart/alternative; boundary="JScQmYKVq=_a5qNf1novx6DQToomWR4FGJ" Reply-To: "Coventry Academy, UK" <[email protected]> Date: Tue, 4 Jul 2023 15:34:14 -0700 Feedback-Id: 19254917 Message-ID: <64-0125ce85-000018cef712ea812000-000-3c34bfbb@xhf97.trackmails1.com> X-CLX-Shades: MLX X-Proofpoint-ORIG-GUID: 3ayIuFiTnLz3Kx3Pl5C0IGaToBhulpFw X-Proofpoint-GUID: 3ayIuFiTnLz3Kx3Pl5C0IGaToBhulpFw X-CLX-Response: 1TFkXBxseEhEKWUQXZB9bSU1kellQWnoRClhYF2NbbUtpbGxgE2BSEQp4Thd nRxNefAEbYW1TSREKeEsXY1ttS2lsbGATYFIRCnhMF2xAfx4SUkRQQ0tGEQp5TBdgfWlyQB9nW3 xrWBEKQ0gXBxsYExEKQ1kXBxgcHxEKQ0kXGgQaGhoRCllNF2dmchEKWUkXGnEaEBp3BgcbGBJxG BAfHHcGBxgaBhoRClleF2xseREKSUYXQEVCRE5PT1hPdUJFWV5PThEKSUcXeE9NEQpDThcZS1Nj X2xDfkRmUBlhUhl6Rh9pGmNtS35FaEJfRlpsXREKWFwXHwQaBBkbEwUbGgQbGxoEGxkeBBkfEBs eGh8aEQpeWRdIGEFnbxEKTVwXGx8eEQpMWhduG24fQ00RCkVZF2hraxEKTF8XegUFBQUFBQUFBR 0RCk1OF2hoEQpMRhdva2tja2sRCkJPF2N+XxteRl9IThhpEQpDWhcbExMEGB4eBB0YBBgZHxEKQ l4XGxEKQlwXGxEKXk4XGxEKQksXYBgbT29LSGFDGXwRCkJJF2AYG09vS0hhQxl8EQpCRRdsAWwa ZX5Pfk1IYhEKQk4XYBgbT29LSGFDGXwRCkJMF2NCc3BSa2hvUnB5EQpCbBdkR2trRhISXxpYbRE KQkAXaX1tc04YYxtSU34RCkJYF2d+XUB9RxgfRR9gEQp5QxdkG3kde0F6YXBvaxEKWUsXGxgZEQ paSxcTEhIRCnBnF2VwW2MbXG4cR0xBEAcSEhEKcGgXegV/bl9pbVkBXxIQBx8YEQpwaBdkXlkTR lJuSBpEQRAHHxgRCnBoF2MbZ0FbBRNkGxp+EAcdEhEKcGgXY0ZnSUxYfkx5YVAQBxIdEQpwaBdh Qm9kewV7a1hgUhAHHBoRCnBoF2YFGF1iS0FwaxN+EAcbGxMRCnBoF29jE3AefE19eHJiEAcZHRE KcGgXbhpMWwVbaVNjTFMQBxIaEQpwbBdjUlJTGXofHX5FQRAHEhoRCnBDF2l+SxoaenpcQhhwEA cSEhEKbX4XGhEKWE0XSxEg X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.591,FMLib:17.11.176.26 definitions=2023-07-04_14,2023-07-04_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=defaultinbound_notspam policy=defaultinbound score=0 suspectscore=0 phishscore=0 unknownsenderscore=20 lowpriorityscore=43 adultscore=0 clxscore=-148 malwarescore=0 spamscore=0 mlxscore=0 impostorscore=0 mlxlogscore=837 bulkscore=43 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2305260000 definitions=main-2307040199 domainage_hfrom=123 domainage_replyto=988 Return-Path: [email protected] X-MS-Exchange-Organization-ExpirationStartTime: 04 Jul 2023 22:34:19.2674 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: f5856162-711b-4ae2-37a5-08db7cdece88 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 39b03722-b836-496a-85ec-850f0957ca6b:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DM6NAM04FT030:EE_|SJ2PR05MB9759:EE_|CO6PR05MB7601:EE_ X-MS-Exchange-Organization-AuthSource: DM6NAM04FT030.eop-NAM04.prod.protection.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id: f5856162-711b-4ae2-37a5-08db7cdece88 X-MS-Exchange-AtpMessageProperties: SA|SL X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:7; X-Forefront-Antispam-Report: CIP:67.231.152.47;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:NSPM;H:mx0a-000e4101.pphosted.com;PTR:mx0b-000e4101.pphosted.com;CAT:NONE;SFS:;DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Jul 2023 22:34:19.1112 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f5856162-711b-4ae2-37a5-08db7cdece88 X-MS-Exchange-CrossTenant-Id: 39b03722-b836-496a-85ec-850f0957ca6b X-MS-Exchange-CrossTenant-AuthSource: DM6NAM04FT030.eop-NAM04.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR05MB9759 X-MS-Exchange-Transport-EndToEndLatency: 00:01:28.5113677 X-MS-Exchange-Processed-By-BccFoldering: 15.20.6565.014 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097); X-Microsoft-Antispam-Message-Info: =?utf-8?B?SEJFVkZHRW5tMkdvN05ueDR2QWxrNWh2UnpwOFF6WGpsQnk5bkp0em85STFt?= =?utf-8?B?VUkyVEVUSGVtR1BWTUlJTWV1TFVWUXU4cjcrd3JhNVMzQU5hRnVFYitOT24v?= =?utf-8?B?MFNkQjJNeVgrbzl6SjRBbHRsUVhTenVOQzBnRWNhaUhHTzVjWldUSHE3Slhu?= =?utf-8?B?RXM3dDlNVm9qb29DUFpzNkdZK2d3K0VQeDduUUUyT3gzbHlhMlFHZ3lZWXBK?= =?utf-8?B?Tk55RG9BcDJQbDA0eUVOQm40U0ZtTzZ6WkJqRTVDTkxEWHA1OW0ram9NMS9y?= =?utf-8?B?cm5mWmVVemxvd1M4TTFIeHh1Rkw5eXVUbGdTNFlXNGg0RjFxQW56cGdxVGVh?= =?utf-8?B?OW5tVWJPcFdhYmxEeUxWWk1jRVhJM084UGYyeEhRTU5rZ2FrNlVwOXNDVzVz?= =?utf-8?B?TWcvWUZtWFFCRkF6ZnZmUmc1R0RHdzd6Z0hWYUVFVzEzSkdYRDZsSDhYMS9r?= =?utf-8?B?bEVkVnhWbmNoeTJJSUI3c0ErWUJrazNROUdZWTYwRlh6b0l2OVFNOGd0ZHla?= =?utf-8?B?bXdxSkhsYW1ZWDJEVUJRZFlKUTlOanhTVXEvM2QxSmcrajArbUtJVXdxL0lP?= =?utf-8?B?NnZWdkNzZDJWdWlSd2lkUGprMTVoMSs5RURSa3hDaE14RnoyRUdvZjRCL3JR?= =?utf-8?B?SjZrR2Z0MEw0eDViMDhJVndPTlNmTUpmejNoY1F4R1ZIeTExNWR2eTNTQUlh?= =?utf-8?B?Q2FNL0RlNHJxVCswaitscy85UXR0anBUdU5yaktLaS9SRTY5ajRtWjk1blJW?= =?utf-8?B?d29xb0t5Ym4zZ25IeXVkUC9mWnJqbHdnUVUyUUEyT3ROZVoydWVoSXJZT25i?= =?utf-8?B?Vk1NQTBSRG9pYVEwQUJGWklrQ253TXppeWdmS0dDSVBsM0hicXZqU2tjOWpm?= =?utf-8?B?bEtxN3lXV0NVSHdBSDlscjVmbHVKOGZMMkt5QVByZ3lDMDJZdnlXTW5nZzNi?= =?utf-8?B?N1I1Znd3SERrTkNYc3pJRGdkOWk4QUNySm8wL3NBNytWOVE4WmFoTVVXWWRV?= =?utf-8?B?dWQzTER2K2FiMTZwYVlHcU9iMkE5V1ZjSGVtR3MzblZWNklsamJ0RDJ3ZHU0?= =?utf-8?B?L0hVQklCNHZkVytRaGMzVnpnSmdhL1AzWjhXVnpXT1FPSlhKc1l5Qk5YT3Jq?= =?utf-8?B?cnVYbjNBYkpmMXQvZkJkZ3BiUjFDVTgzamhTdk9pWkQyYmNUL2tCZGdrUFIy?= =?utf-8?B?WlBKalVqcXExT3NmRk0vOU5ab2I0SVB4UlVqZzdWa0pWY1NLM0I2S0k1Z3Bj?= =?utf-8?B?SWxBSThERmRhUlpUY0RzVWlrbEpHUTRnamcxL2c3aTZyNTMyRm1MVi9FNHlY?= =?utf-8?B?WjJrbFBYUjN6TmNKS1Fma1pKT2pZRTA2VzQyUE5mb1YrY2UvMlhVVGxvZ0xo?= =?utf-8?B?cmFIenBuZlc3ZE9tQVJqdTdLWSt3ZEV6ZVlZL1drd00yU2ZMcFMwKzRudWMx?= =?utf-8?B?cjJMV251ekI2K0g5RUJGSmsyVVNNUGduYmpvTzNNWk44MS9KT3RodHhFSVha?= =?utf-8?B?MEh2ajR4aDFOK25MNUpidGhSaE5aSzVBWGlJMTNwclBEMXNpdmFPWjU0SlJF?= =?utf-8?B?MGY3Sk5TaVd3MFVHVEhwcjF5OFViWExZRjVCQlVFUkd5dThoYkFuMlRURGx2?= =?utf-8?B?T1gwcVlGUHF2YUhXVEZnVmphQWlGeVVoSlFrb1MwUXZmUGFJa01udHRqT2xq?= =?utf-8?B?TGVVUXA4S1A2UUdIRWs1UzJuNkxaWGk1QXV6Nm50TVZNcDEyMXVoUXZPTTNs?= =?utf-8?B?dFg4eitlWjBlZVFTaWVuRnhSWGNyRndmM2RkeFZZVGdwM1FqbTcxRjBQaXJ5?= =?utf-8?B?ZmZZU2RMSjR4eTFvWFhaT05GYlpUSFNTS2lDK3B2U0VZUVVxT3lhYjMzRlNx?= =?utf-8?B?bTBna3p6L1YvbGlzR3ZrSW1hSW1ZUmhHd0Z6MjUzNm12NFpZWFdVYjZPcUsv?= =?utf-8?B?bnBiVkp5Nk1xL2tKeWw2alhIMjhMYXQxV1NSSFFkenRuUFZwenA2cjR3ZnBv?= =?utf-8?B?aDRZWlZuU0NOMWxpWjdrSjJvSkhzSllpRVliZUxkS0Z5cEJpMVRpYjVVbFRi?= =?utf-8?B?Y1RaQVVUdXJEeE5pUXgrSEVRZVVmVFdjc3ZMbGtmWEdxNy9YY3ZYVUZOajJv?= =?utf-8?B?cCtUekhUUEY4S2hKWjg2RHR4N3BPY3FRZVFFUG5jZExhUjh5WjVRY3hQaTNp?= =?utf-8?B?MHVYVnZnN2U5amJqWkZwWGRCc2VmbTNobklaZ092UHVNeEx5UllSL0FRbnds?= =?utf-8?B?TTRoZmxEaUl5Y29DeDBXZDdHSU9XYVd0RUZtWnJING5OQU9pM0NtVjd2MjNP?= =?utf-8?B?V1VtYlVkeFQ3cTRsV0JoOXI5TDluVXFndnpMb2pzNXlQMndoams1aFNHcFN4?= =?utf-8?B?UklYSi9JZVlXZE9LNFJleCs0QlkxbzhNeVNadzdlTkFTWnIzdXgxa0JRN2Zm?= =?utf-8?B?amw5SUtQbDNFRmR4S1U0cXFndjRqVGJXdk1tdDcwVWZxaCtIRTNLa0xYdWxK?= =?utf-8?B?cjQxYXlGM3BYbGVxMjF4NENrYjFZNkU1NUlnc1UrdWgxemJtd2FwK0trQ0Zp?= =?utf-8?B?emtGNjNvZUFhWVliMkJYajNCTXR0Zld6akJhZ2RBNFJ0WDJzUVAyZ04wWTEv?= =?utf-8?B?R1oxMXRjaVowcjZkNDFmU3RiclhIaDFQdkpkR2sxa0psWUtES25uSEZCT0sx?= =?utf-8?B?WTkvckZpQ29uUUVJWVJGVG5QRXFEVUFST3BiSWFqTW5JUnpNM0NwckJ0V1Qz?= =?utf-8?B?Q2h4SHkyTTFCMVRQM1VZQ1l6VjJDNjlVRGtCbnhwN01kUCs4aDZ6UVpVUFha?= =?utf-8?B?ZWdCVDBaT2VGNVl5NFd5YnhFWG9tNXQ3aU1PUEFzTHROTCs1MVF5SDdVay9I?= =?utf-8?B?ZG82bnhIREhBd1F3MXFNKzJCUjJCbXdmdEVCaVdaOG5NMVU2S2twVWRlTUx3?= =?utf-8?B?amd3bnpDd2M0TWJPLzBETmpQN2R0S1A1bFRnOEtDbGU0RHNxTjcrNnY4VTdi?= =?utf-8?Q?Kaj6/kX8yXkAVI=3D?= MIME-Version: 1.0

Sharing

General

Malware Config

Signatures

Files