hxxp://Received[:] from DU7PR01CA0037[.]eurprd01[.]prod[.]exchangelabs[.]com (2603[:]10a6[:]10[:]50e[::]27) by AS8PR02MB9627[.]eurprd02[.]prod[.]outlook[.]com (2603[:]10a6[:]20b[:]5aa[::]13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15[.]20[.]7091[.]38; Wed, 3 Jan 2024 07[:]34[:]25 +0000 Received[:] from DU6PEPF0000B621[.]eurprd02[.]prod[.]outlook[.]com (2603[:]10a6[:]10[:]50e[:]cafe[::]bb) by DU7PR01CA0037[.]outlook[.]office365[.]com (2603[:]10a6[:]10[:]50e[::]27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15[.]20[.]7135[.]25 via Frontend Transport; Wed, 3 Jan 2024 07[:]34[:]25 +0000 Authentication-Results[:] spf=pass (sender IP is 159[.]135[.]225[.]165) smtp[.]mailfrom=lc[.]serenitydojo[.]academy; dkim=pass (signature was verified) header[.]d=lc[.]serenitydojo[.]academy;dmarc=none action=none header[.]from=serenity-dojo[.]com;compauth=fail reason=001 Received-SPF[:] Pass (protection[.]outlook[.]com[:] domain of lc[.]serenitydojo[.]academy designates 159[.]135[.]225[.]165 as permitted sender) receiver=protection[.]outlook[.]com; client-ip=159[.]135[.]225[.]165; helo=m225-165[.]mailgun[.]net; pr=C Received[:] from m225-165[.]mailgun[.]net (159[.]135[.]225[.]165) by DU6PEPF0000B621[.]mail[.]protection[.]outlook[.]com (10[.]167[.]8[.]138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15[.]20[.]7159[.]9 via Frontend Transport; Wed, 3 Jan 2024 07[:]34[:]24 +0000 DKIM-Signature[:] a=rsa-sha256; v=1; c=relaxed/relaxed; d=lc[.]serenitydojo[.]academy; q=dns/txt; s=mailo; t=1704267263; x=1704274463; h=Message-Id[:] List-Unsubscribe[:] Reply-To[:] To[:] To[:] From[:] From[:] Subject[:] Subject[:] Content-Type[:] Mime-Version[:] Date[:] Sender[:] Sender; bh=XpRwX/zC1l9D0s2MyMVGw13k17S7pXm06JreD663UYo=; b=Jl+NV1KImYk99LB5B2iJldI1SsZSmywLTFxDlj9f6B9fO3WC5FmOKnpgcEeHjr6y9tANrn/qwVP3pu5RxPBtqTbRyYY/dqBUHn11M0zy7pohy7q/ZqMtjGPHL2zwLdP10G2QztCzdH2OO/lJRAcbG78w3cRp99KEwtzaEvguH9g= X-Mailgun-Sending-Ip[:] 159[.]135[.]225[.]165 X-Mailgun-Sid[:] WyI4MDZjNCIsIm1hcmsuaGF0ZmllbGRAc2VjY2wudGVjaCIsIjU1NjNiNCJd Received[:] from <unknown> (<unknown> []) by 040b6f744457 with HTTP id 65950dff05a232c0eb08d172; Wed, 03 Jan 2024 07[:]34[:]23 GMT Sender[:] john=serenity-dojo[.]com@lc[.]serenitydojo[.]academy Date[:] Wed, 03 Jan 2024 07[:]34[:]23 +0000 Mime-Version[:] 1[.]0 Content-Type[:] text/plain Subject[:] Here's Your Free eBook[:] The 7 Qualities of Highly Effective BDD Scenarios From[:] John Ferguson Smart <john@serenity-dojo[.]com> To[:] mark[.]hatfield@seccl[.]tech X-Mailgun-Tag[:] com_lcsPwMCbJCzJ6uyUNLuK X-Mailgun-Tag[:] et_workflow X-Mailgun-Tag[:] loc_wt7nksXs8SWGAr2Wz1VA Reply-To[:] john@lc[.]serenitydojo[.]academy mailing_list_unsubscribe_url[:] hxxps://services[.]msgsndr[.]com/emails/builder/unsubscribe-view/wt7nksXs8SWGAr2Wz1VA/NP7sB8xqZqTg79EDYbs6 List-Unsubscribe[:] hxxps://services[.]msgsndr[.]com/emails/builder/unsubscribe-view/wt7nksXs8SWGAr2Wz1VA/NP7sB8xqZqTg79EDYbs6 X-Mailgun-Variables[:] {"c_id"[:] "lcsPwMCbJCzJ6uyUNLuK", "email_type"[:] "workflow", "email_type_id"[:] "805b428a-179a-412b-b7e5-7c1149ff4888", "email_type_step_id"[:] "4ca2d5d3-3eb3-4f5f-9658-9f187dff565d", "loc_id"[:] "wt7nksXs8SWGAr2Wz1VA", "method"[:] "api", "source"[:] "email-isv-worker"} Message-Id[:] <20240103073423[.]349d874e7c7d1655@lc[.]serenitydojo[.]academy> Return-Path[:] bounce+86ae73[.]5563b4-mark[.]hatfield=seccl[.]tech@lc[.]serenitydojo[.]academy X-EOPAttributedMessage[:] 0 X-EOPTenantAttributedMessage[:] 5a646832-b859-46c6-8647-92679ed1ad96[:]0 X-MS-PublicTrafficType[:] Email X-MS-TrafficTypeDiagnostic[:] DU6PEPF0000B621[:]EE_|AS8PR02MB9627[:]EE_ X-MS-Office365-Filtering-Correlation-Id[:] bd5f1b05-8218-4e3b-2997-08dc0c2e6939 X-MS-Exchange-AtpMessageProperties[:] SA|SL X-Forefront-Antispam-Report[:] CIP[:]159[.]135[.]225[.]165;CTRY[:]US;LANG[:]en;SCL[:]5;SRV[:];IPV[:]NLI;SFV[:]SPM;H[:]m225-165[.]mailgun[.]net;PTR[:]m225-165[.]mailgun[.]net;CAT[:]SPOOF;SFTY[:]9[.]25;SFS[:](13230031)(4636009)(230273577357003)(230173577357003)(1690799017)(451199024)(22186003)(83380400001)(66899024)(356005)(83170400001)(5660300002)(166002)(7636003)(7596003)(8676002)(336012)(26005)(1096003)(42882007)(426003)(9686003)(1076003)(6916009)(33964004)(7846003)(58800400005)(76236004)(76899018)(1406899027)(5006899006)(84240200001)(93036002);DIR[:]INB; X-Microsoft-Antispam[:] BCL[:]0; X-Microsoft-Antispam-Message-Info[:] =?utf-8?B?RUVqbTFkbHd5OHFRbzZJUU10MXpCQ1NxbmprUm96QTFaY3l2cWlTa29wWFpG?= =?utf-8?B?bWttR2ZKY05iSlNVUUlKZWxremxQL0ZwalNrRS9LRHhSa1NPL3pFQXVvVUUz?= =?utf-8?B?T2k0TGRpWnVSUmlBWGRvd0g3cU41VFphQlRTcFRyNEh4NFJwVnZJcGZ5WGNL?= =?utf-8?B?Yk01UjZyVE1GaldISWlTNEdoZUtpZEIydFJoekN5b0JNMDNUeXE0REgvZlQr?= =?utf-8?B?T1NUakNRcDJjclJWUmRRaVZGaHh1MGpHTm9UWHJVenJyaHRCc2dFZmZFd3Zy?= =?utf-8?B?RnVRYUc1YVo0bDZIallMaWNjUkxSYXZUZVpPc1JHVE1kMmRCT3dRemtVYmNs?= =?utf-8?B?Mmo5YW1xUldpWFQwalFoMDRIT1I4NGhnL0hsT1F5ODNUa0FnVVZkMG51Tm55?= =?utf-8?B?dzkyUHUzWForYmxUcTMxWlVUVXNndUIwTzdNN3NXSCtSZHZSeUdrSmVrMU8w?= =?utf-8?B?Z2dpaEoyL0RUNWJZTktwemxkYXA2T3FTbEdvK2N6VGRVNGNrdmZNclpVMHY2?= =?utf-8?B?UUxtME1PSWNVY2pzaDhUY2sxcWxZY2hGTUs5UnVYMzAwOHRPT1gvM0c5NGI1?= =?utf-8?B?cXFTRFBDUjMrOGRKdTlOY0JrbGhXcjAvU3hqVTk1OFNqR2NJRFZEb2htQ3hq?= =?utf-8?B?V0R4VFBHcHpCbndPWEV3SHo0VHhiclhmYXlPdGFLeUNxR3N0aEdORi9Ndy9k?= =?utf-8?B?NnN5eFBhT1FxS01BZHpwdDZQMTF0U3JFSG1lRjNpaW1iUFVDNThxYnRncFFJ?= =?utf-8?B?WS9ZbVR4OWllaTdEZ0ZZaGVQQnZtamp5ZGJZV3JlSFltMTJTbDhIL3RZLzZW?= =?utf-8?B?bEdFbTVLd0NTdWR1NHVwOEFPOHk4ckRJWjVsTlBrR25UeUx0S2ZkUlpJeUVL?= =?utf-8?B?SmRmKy9iditBWWFUU1kxVjU5anI2RU9vNkhPOUR6VVFzV0JhTWZkb0hXamF2?= =?utf-8?B?K2FrQTBoVkJLWWR4WkhJYXB6Z1ViRXFOV1pxQUVkWEJjZC83SWswakxNMEZu?= =?utf-8?B?VFBtVmVSanVNRUo3RkNib0F4NE9yVERSd2UrRjBkZFNBT3NWN1B1S1dvYzhs?= =?utf-8?B?dytKcGg3RFJuUnFZc2hPOTVKd0h1ajhPODNVS25TN3RJNkt5d0I0b0VmM01K?= =?utf-8?B?TzNzSUN0TkJSck56VzY5eFRqWjRQNmxYaHRLRktXWmREZ3IzMUY5b1YzK0xV?= =?utf-8?B?Q2NhOU1DcGtmeWpFbFV3ZUhyQ3ZYWDl5bDN0WCtSSGdJSGt5MHZUWHpEM2lT?= =?utf-8?B?ekxTTnZoN0I1cjNwUU9qYWU4UlBqTFFsRXZWdmYvZUN3Sm1mWmg3emVvd3NZ?= =?utf-8?B?a2RQdGxRZW9Zd0ZXUis2OVlINDYvNU9IbWZ0VXpoc0pNcmxSeSt2ZkxYdmtR?= =?utf-8?B?UVdqd1B5T21JUVVKRXpnTzJaMlJPc2JzSVpkVjN2dVVTbVB4MjVWOHhHcXBy?= =?utf-8?B?NTd0ZFJSYXZsajZRYUw0RkIrdEV2V0tNUjFwM2gvVVhBMzd5dFJOdVdveTlK?= =?utf-8?B?ajJ3L0JhWHF0OFhuK2VRekVoY0J4dXNnUGo5MW53UXNlSVNJMS9DOWI3cVBD?= =?utf-8?B?SERIeXFmaTk0ZDJLbVMyeDVQUHMvT2MxYk05RjZxRGFoZ0IvOXBpbGRpcEdH?= =?utf-8?B?MHprTXo2VnpRTUtnRjE5V0pLdlJyTmxGVU9FeUhQOEc2MytPblBRRTExMlgx?= =?utf-8?B?OWZ4ck54WDBFTGs2blN6c1pSZUZjQ1ptVzM1OXU4MGVnRUFWMzlEVzMvZU5p?= =?utf-8?B?MDFRUWNialQzSWx1WEtkaHZ5VlNYT2tsdldYbjNCcG9mVGgzQjN6Z1ZQN1B3?= =?utf-8?B?Ukd1ZkExNG01N2RLOWNmN2MxZytHMUlCZnRPNGhLTHhDNGtMcTM2ZTB6ekFs?= =?utf-8?B?NnF0QUdyb01tUUtwQ0hMWDkzQTNpNkRZQkw3MCsxMGhxUVpYUWtNSnVSd3Js?= =?utf-8?B?SGg4NlFZeE9IaFUyTWUxRzhLd1ZaSE11dmVCY2owZlBWMitBM0JJWW5Kellu?= =?utf-8?B?UFZhVTVuOUNqYWVWOTl2MDdlbXJZZ2NudFpjeVQ5b09tb1c5NEJadGo1ZENL?= =?utf-8?B?WjNnQUJCUHRrTWFWMUZwU2I3L3k3SFVrRmxaSkhGT3FXMkpaSlVPbGdqSm4r?= =?utf-8?B?eXZmZ1dDTU9sYW12L24yK0kyeUhkYnBtVGNCa3NEWE1VQmxEbjNTUFJEYnhO?= =?utf-8?B?ZnFmNXFJR3Y2MGkwdWlqZlZIREVJTWM1THlOYUdNQ0RBWUdrWUo1Y04xVFgv?= =?utf-8?B?OG5XMERXUzMxUStYVDVIMGJhVjkrUHRNWjhuSmJZYXNleTg5US9SY1A2MlU4?= =?utf-8?B?Qys1VjIrMUluWXZsaUh4NUtlTWMyek5SaTdWa1J2RmRlbDlRdGJYOGkyam1V?= =?utf-8?B?MTBtWlBJSVJqK0xrSldFb0dONGJKcDA4NW1NYzZjdm5iQVBxSkx3YVFxN1VM?= =?utf-8?B?SWY2dlBWbTFUbFJJZnRMenI5YUY2NkFFUWY5eGhCTjRMQXZQSFJFdWoyUFRj?= =?utf-8?B?YTRKd1pwL1B2TkJnY2RKZHMybm52eUxKZENWMFc3ejRPRTZwNmRDZFF0ekJG?= =?utf-8?B?aFV0Q0pRajlsZlhWUFowc1ZueHhxN2tXWjl3SC9MVEIxRU9rbFdTU1JDRjZR?= =?utf-8?B?dEZwVDdUZTlWSGwxT3gvZ01CR2RZOXFQSnBYc3hNNFpsOXhkcFplV0pkVEtX?= =?utf-8?B?ejB0d25FYVIyZ0F0cDhhVVcySXliOXRxMXQ2SDNJSit2bU85OWd5NDlJQjMw?= =?utf-8?B?YTE3Z2Rjampwd0M4QTBMUXYzeHpBTmRzR0dVRWpIc3V1dXVjYlNnQXo4MU5v?= =?utf-8?B?OUwwd1g0dEdUWHlVblloMWk5dFBwWFhsSTRQOUJzZ2lzWDhlQUkzM3VqRXJ3?= =?utf-8?B?czNDdzR3OEFOZGJTNGRKUklxSUMrMU5pWkdPSjE3RnJoWmVUNzdXQ3hGZmg1?= =?utf-8?B?SFhLZlRKTytnM095em5BZTN2eFJnOFNQN3FFaDlHT1duUHl2UDBJQkhxUjFJ?= =?utf-8?B?UFZBdVVFVXR2TUhrZ3dLVVBzWU1ZZ3JOTmY4ZGRmWlN2Z2JmNGt1czQyQ3hM?= =?utf-8?B?dE9JeGpsbElpWUI3RnQvU3RyUWF6N0diVnhadUV2bXE2V3luUWhPT2hUN3Rj?= =?utf-8?B?NnNHMlFsVXhQb1NNeXk1U055RDJUOE01c215MVNqUnhoclpDam1zNG1OV1gx?= =?utf-8?B?K0VBd1RkNTc1ZUxDckVKZTU2RldvZFQ5K21VTFdYMHkyZVJaVitIYThkR2Nz?= =?utf-8?B?cGdtaFNDQlVPS0RQSk5DWi9wUnhWbFp5YkRQdzNZUW5rZTBhUlBrSHIrNTVh?= =?utf-8?B?YVVwY09sbTNSRmx3b1kzbnhkbFVlanVBeWYzdDVxSXFER1IzRyt1NlZuZkNI?= =?utf-8?B?QXpEVzI3aTVvYnUxWENmQzRUbFZKODQzL2FmSTF4YmZWWW40bE5BL2MzMmtR?= =?utf-8?B?L0JZZk4vN2dLZUlrZTRqTVdneCtzKzl4Ly9scXZIS2ZSOUU4N2l0anJoVFF3?= =?utf-8?B?Tjd6MnhDeVd5U0tTNllkN3dDY2JNUk1VbkxnZFkwRjM4VmVLSEZybTl6ZWdu?= =?utf-8?B?RlErc2FBV1JzRlByRSt4Vi9BdTljMUJ3dDdpSzBaTm5KcmxIWHZMYld4Mktw?= =?utf-8?Q?SERW5ZAyi4TUXwQ4eS0zajNTsYEXoIDhJ?=

Sharing

Behavioral task

behavioral1

Sample

http://Received: from DU7PR01CA0037.eurprd01.prod.exchangelabs.com (2603:10a6:10:50e::27) by AS8PR02MB9627.eurprd02.prod.outlook.com (2603:10a6:20b:5aa::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.38; Wed, 3 Jan 2024 07:34:25 +0000 Received: from DU6PEPF0000B621.eurprd02.prod.outlook.com (2603:10a6:10:50e:cafe::bb) by DU7PR01CA0037.outlook.office365.com (2603:10a6:10:50e::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.25 via Frontend Transport; Wed, 3 Jan 2024 07:34:25 +0000 Authentication-Results: spf=pass (sender IP is 159.135.225.165) smtp.mailfrom=lc.serenitydojo.academy; dkim=pass (signature was verified) header.d=lc.serenitydojo.academy;dmarc=none action=none header.from=serenity-dojo.com;compauth=fail reason=001 Received-SPF: Pass (protection.outlook.com: domain of lc.serenitydojo.academy designates 159.135.225.165 as permitted sender) receiver=protection.outlook.com; client-ip=159.135.225.165; helo=m225-165.mailgun.net; pr=C Received: from m225-165.mailgun.net (159.135.225.165) by DU6PEPF0000B621.mail.protection.outlook.com (10.167.8.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.9 via Frontend Transport; Wed, 3 Jan 2024 07:34:24 +0000 DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=lc.serenitydojo.academy; q=dns/txt; s=mailo; t=1704267263; x=1704274463; h=Message-Id: List-Unsubscribe: Reply-To: To: To: From: From: Subject: Subject: Content-Type: Mime-Version: Date: Sender: Sender; bh=XpRwX/zC1l9D0s2MyMVGw13k17S7pXm06JreD663UYo=; b=Jl+NV1KImYk99LB5B2iJldI1SsZSmywLTFxDlj9f6B9fO3WC5FmOKnpgcEeHjr6y9tANrn/qwVP3pu5RxPBtqTbRyYY/dqBUHn11M0zy7pohy7q/ZqMtjGPHL2zwLdP10G2QztCzdH2OO/lJRAcbG78w3cRp99KEwtzaEvguH9g= X-Mailgun-Sending-Ip: 159.135.225.165 X-Mailgun-Sid: WyI4MDZjNCIsIm1hcmsuaGF0ZmllbGRAc2VjY2wudGVjaCIsIjU1NjNiNCJd Received: from <unknown> (<unknown> []) by 040b6f744457 with HTTP id 65950dff05a232c0eb08d172; Wed, 03 Jan 2024 07:34:23 GMT Sender: [email protected] Date: Wed, 03 Jan 2024 07:34:23 +0000 Mime-Version: 1.0 Content-Type: text/plain Subject: Here's Your Free eBook: The 7 Qualities of Highly Effective BDD Scenarios From: John Ferguson Smart <[email protected]> To: [email protected] X-Mailgun-Tag: com_lcsPwMCbJCzJ6uyUNLuK X-Mailgun-Tag: et_workflow X-Mailgun-Tag: loc_wt7nksXs8SWGAr2Wz1VA Reply-To: [email protected] mailing_list_unsubscribe_url: https://services.msgsndr.com/emails/builder/unsubscribe-view/wt7nksXs8SWGAr2Wz1VA/NP7sB8xqZqTg79EDYbs6 List-Unsubscribe: https://services.msgsndr.com/emails/builder/unsubscribe-view/wt7nksXs8SWGAr2Wz1VA/NP7sB8xqZqTg79EDYbs6 X-Mailgun-Variables: {"c_id": "lcsPwMCbJCzJ6uyUNLuK", "email_type": "workflow", "email_type_id": "805b428a-179a-412b-b7e5-7c1149ff4888", "email_type_step_id": "4ca2d5d3-3eb3-4f5f-9658-9f187dff565d", "loc_id": "wt7nksXs8SWGAr2Wz1VA", "method": "api", "source": "email-isv-worker"} Message-Id: <[email protected]> Return-Path: bounce+[email protected] X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 5a646832-b859-46c6-8647-92679ed1ad96:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU6PEPF0000B621:EE_|AS8PR02MB9627:EE_ X-MS-Office365-Filtering-Correlation-Id: bd5f1b05-8218-4e3b-2997-08dc0c2e6939 X-MS-Exchange-AtpMessageProperties: SA|SL X-Forefront-Antispam-Report: CIP:159.135.225.165;CTRY:US;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:m225-165.mailgun.net;PTR:m225-165.mailgun.net;CAT:SPOOF;SFTY:9.25;SFS:(13230031)(4636009)(230273577357003)(230173577357003)(1690799017)(451199024)(22186003)(83380400001)(66899024)(356005)(83170400001)(5660300002)(166002)(7636003)(7596003)(8676002)(336012)(26005)(1096003)(42882007)(426003)(9686003)(1076003)(6916009)(33964004)(7846003)(58800400005)(76236004)(76899018)(1406899027)(5006899006)(84240200001)(93036002);DIR:INB; X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: =?utf-8?B?RUVqbTFkbHd5OHFRbzZJUU10MXpCQ1NxbmprUm96QTFaY3l2cWlTa29wWFpG?= =?utf-8?B?bWttR2ZKY05iSlNVUUlKZWxremxQL0ZwalNrRS9LRHhSa1NPL3pFQXVvVUUz?= =?utf-8?B?T2k0TGRpWnVSUmlBWGRvd0g3cU41VFphQlRTcFRyNEh4NFJwVnZJcGZ5WGNL?= =?utf-8?B?Yk01UjZyVE1GaldISWlTNEdoZUtpZEIydFJoekN5b0JNMDNUeXE0REgvZlQr?= =?utf-8?B?T1NUakNRcDJjclJWUmRRaVZGaHh1MGpHTm9UWHJVenJyaHRCc2dFZmZFd3Zy?= =?utf-8?B?RnVRYUc1YVo0bDZIallMaWNjUkxSYXZUZVpPc1JHVE1kMmRCT3dRemtVYmNs?= =?utf-8?B?Mmo5YW1xUldpWFQwalFoMDRIT1I4NGhnL0hsT1F5ODNUa0FnVVZkMG51Tm55?= =?utf-8?B?dzkyUHUzWForYmxUcTMxWlVUVXNndUIwTzdNN3NXSCtSZHZSeUdrSmVrMU8w?= =?utf-8?B?Z2dpaEoyL0RUNWJZTktwemxkYXA2T3FTbEdvK2N6VGRVNGNrdmZNclpVMHY2?= =?utf-8?B?UUxtME1PSWNVY2pzaDhUY2sxcWxZY2hGTUs5UnVYMzAwOHRPT1gvM0c5NGI1?= =?utf-8?B?cXFTRFBDUjMrOGRKdTlOY0JrbGhXcjAvU3hqVTk1OFNqR2NJRFZEb2htQ3hq?= =?utf-8?B?V0R4VFBHcHpCbndPWEV3SHo0VHhiclhmYXlPdGFLeUNxR3N0aEdORi9Ndy9k?= =?utf-8?B?NnN5eFBhT1FxS01BZHpwdDZQMTF0U3JFSG1lRjNpaW1iUFVDNThxYnRncFFJ?= =?utf-8?B?WS9ZbVR4OWllaTdEZ0ZZaGVQQnZtamp5ZGJZV3JlSFltMTJTbDhIL3RZLzZW?= =?utf-8?B?bEdFbTVLd0NTdWR1NHVwOEFPOHk4ckRJWjVsTlBrR25UeUx0S2ZkUlpJeUVL?= =?utf-8?B?SmRmKy9iditBWWFUU1kxVjU5anI2RU9vNkhPOUR6VVFzV0JhTWZkb0hXamF2?= =?utf-8?B?K2FrQTBoVkJLWWR4WkhJYXB6Z1ViRXFOV1pxQUVkWEJjZC83SWswakxNMEZu?= =?utf-8?B?VFBtVmVSanVNRUo3RkNib0F4NE9yVERSd2UrRjBkZFNBT3NWN1B1S1dvYzhs?= =?utf-8?B?dytKcGg3RFJuUnFZc2hPOTVKd0h1ajhPODNVS25TN3RJNkt5d0I0b0VmM01K?= =?utf-8?B?TzNzSUN0TkJSck56VzY5eFRqWjRQNmxYaHRLRktXWmREZ3IzMUY5b1YzK0xV?= =?utf-8?B?Q2NhOU1DcGtmeWpFbFV3ZUhyQ3ZYWDl5bDN0WCtSSGdJSGt5MHZUWHpEM2lT?= =?utf-8?B?ekxTTnZoN0I1cjNwUU9qYWU4UlBqTFFsRXZWdmYvZUN3Sm1mWmg3emVvd3NZ?= =?utf-8?B?a2RQdGxRZW9Zd0ZXUis2OVlINDYvNU9IbWZ0VXpoc0pNcmxSeSt2ZkxYdmtR?= =?utf-8?B?UVdqd1B5T21JUVVKRXpnTzJaMlJPc2JzSVpkVjN2dVVTbVB4MjVWOHhHcXBy?= =?utf-8?B?NTd0ZFJSYXZsajZRYUw0RkIrdEV2V0tNUjFwM2gvVVhBMzd5dFJOdVdveTlK?= =?utf-8?B?ajJ3L0JhWHF0OFhuK2VRekVoY0J4dXNnUGo5MW53UXNlSVNJMS9DOWI3cVBD?= =?utf-8?B?SERIeXFmaTk0ZDJLbVMyeDVQUHMvT2MxYk05RjZxRGFoZ0IvOXBpbGRpcEdH?= =?utf-8?B?MHprTXo2VnpRTUtnRjE5V0pLdlJyTmxGVU9FeUhQOEc2MytPblBRRTExMlgx?= =?utf-8?B?OWZ4ck54WDBFTGs2blN6c1pSZUZjQ1ptVzM1OXU4MGVnRUFWMzlEVzMvZU5p?= =?utf-8?B?MDFRUWNialQzSWx1WEtkaHZ5VlNYT2tsdldYbjNCcG9mVGgzQjN6Z1ZQN1B3?= =?utf-8?B?Ukd1ZkExNG01N2RLOWNmN2MxZytHMUlCZnRPNGhLTHhDNGtMcTM2ZTB6ekFs?= =?utf-8?B?NnF0QUdyb01tUUtwQ0hMWDkzQTNpNkRZQkw3MCsxMGhxUVpYUWtNSnVSd3Js?= =?utf-8?B?SGg4NlFZeE9IaFUyTWUxRzhLd1ZaSE11dmVCY2owZlBWMitBM0JJWW5Kellu?= =?utf-8?B?UFZhVTVuOUNqYWVWOTl2MDdlbXJZZ2NudFpjeVQ5b09tb1c5NEJadGo1ZENL?= =?utf-8?B?WjNnQUJCUHRrTWFWMUZwU2I3L3k3SFVrRmxaSkhGT3FXMkpaSlVPbGdqSm4r?= =?utf-8?B?eXZmZ1dDTU9sYW12L24yK0kyeUhkYnBtVGNCa3NEWE1VQmxEbjNTUFJEYnhO?= =?utf-8?B?ZnFmNXFJR3Y2MGkwdWlqZlZIREVJTWM1THlOYUdNQ0RBWUdrWUo1Y04xVFgv?= =?utf-8?B?OG5XMERXUzMxUStYVDVIMGJhVjkrUHRNWjhuSmJZYXNleTg5US9SY1A2MlU4?= =?utf-8?B?Qys1VjIrMUluWXZsaUh4NUtlTWMyek5SaTdWa1J2RmRlbDlRdGJYOGkyam1V?= =?utf-8?B?MTBtWlBJSVJqK0xrSldFb0dONGJKcDA4NW1NYzZjdm5iQVBxSkx3YVFxN1VM?= =?utf-8?B?SWY2dlBWbTFUbFJJZnRMenI5YUY2NkFFUWY5eGhCTjRMQXZQSFJFdWoyUFRj?= =?utf-8?B?YTRKd1pwL1B2TkJnY2RKZHMybm52eUxKZENWMFc3ejRPRTZwNmRDZFF0ekJG?= =?utf-8?B?aFV0Q0pRajlsZlhWUFowc1ZueHhxN2tXWjl3SC9MVEIxRU9rbFdTU1JDRjZR?= =?utf-8?B?dEZwVDdUZTlWSGwxT3gvZ01CR2RZOXFQSnBYc3hNNFpsOXhkcFplV0pkVEtX?= =?utf-8?B?ejB0d25FYVIyZ0F0cDhhVVcySXliOXRxMXQ2SDNJSit2bU85OWd5NDlJQjMw?= =?utf-8?B?YTE3Z2Rjampwd0M4QTBMUXYzeHpBTmRzR0dVRWpIc3V1dXVjYlNnQXo4MU5v?= =?utf-8?B?OUwwd1g0dEdUWHlVblloMWk5dFBwWFhsSTRQOUJzZ2lzWDhlQUkzM3VqRXJ3?= =?utf-8?B?czNDdzR3OEFOZGJTNGRKUklxSUMrMU5pWkdPSjE3RnJoWmVUNzdXQ3hGZmg1?= =?utf-8?B?SFhLZlRKTytnM095em5BZTN2eFJnOFNQN3FFaDlHT1duUHl2UDBJQkhxUjFJ?= =?utf-8?B?UFZBdVVFVXR2TUhrZ3dLVVBzWU1ZZ3JOTmY4ZGRmWlN2Z2JmNGt1czQyQ3hM?= =?utf-8?B?dE9JeGpsbElpWUI3RnQvU3RyUWF6N0diVnhadUV2bXE2V3luUWhPT2hUN3Rj?= =?utf-8?B?NnNHMlFsVXhQb1NNeXk1U055RDJUOE01c215MVNqUnhoclpDam1zNG1OV1gx?= =?utf-8?B?K0VBd1RkNTc1ZUxDckVKZTU2RldvZFQ5K21VTFdYMHkyZVJaVitIYThkR2Nz?= =?utf-8?B?cGdtaFNDQlVPS0RQSk5DWi9wUnhWbFp5YkRQdzNZUW5rZTBhUlBrSHIrNTVh?= =?utf-8?B?YVVwY09sbTNSRmx3b1kzbnhkbFVlanVBeWYzdDVxSXFER1IzRyt1NlZuZkNI?= =?utf-8?B?QXpEVzI3aTVvYnUxWENmQzRUbFZKODQzL2FmSTF4YmZWWW40bE5BL2MzMmtR?= =?utf-8?B?L0JZZk4vN2dLZUlrZTRqTVdneCtzKzl4Ly9scXZIS2ZSOUU4N2l0anJoVFF3?= =?utf-8?B?Tjd6MnhDeVd5U0tTNllkN3dDY2JNUk1VbkxnZFkwRjM4VmVLSEZybTl6ZWdu?= =?utf-8?B?RlErc2FBV1JzRlByRSt4Vi9BdTljMUJ3dDdpSzBaTm5KcmxIWHZMYld4Mktw?= =?utf-8?Q?SERW5ZAyi4TUXwQ4eS0zajNTsYEXoIDhJ?=

Resource

win7-20231215-en

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

Resource

win10v2004-20231222-en

windows10-2004-x64

2 signatures

150 seconds

General

Target

http://Received: from DU7PR01CA0037.eurprd01.prod.exchangelabs.com (2603:10a6:10:50e::27) by AS8PR02MB9627.eurprd02.prod.outlook.com (2603:10a6:20b:5aa::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.38; Wed, 3 Jan 2024 07:34:25 +0000 Received: from DU6PEPF0000B621.eurprd02.prod.outlook.com (2603:10a6:10:50e:cafe::bb) by DU7PR01CA0037.outlook.office365.com (2603:10a6:10:50e::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7135.25 via Frontend Transport; Wed, 3 Jan 2024 07:34:25 +0000 Authentication-Results: spf=pass (sender IP is 159.135.225.165) smtp.mailfrom=lc.serenitydojo.academy; dkim=pass (signature was verified) header.d=lc.serenitydojo.academy;dmarc=none action=none header.from=serenity-dojo.com;compauth=fail reason=001 Received-SPF: Pass (protection.outlook.com: domain of lc.serenitydojo.academy designates 159.135.225.165 as permitted sender) receiver=protection.outlook.com; client-ip=159.135.225.165; helo=m225-165.mailgun.net; pr=C Received: from m225-165.mailgun.net (159.135.225.165) by DU6PEPF0000B621.mail.protection.outlook.com (10.167.8.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7159.9 via Frontend Transport; Wed, 3 Jan 2024 07:34:24 +0000 DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=lc.serenitydojo.academy; q=dns/txt; s=mailo; t=1704267263; x=1704274463; h=Message-Id: List-Unsubscribe: Reply-To: To: To: From: From: Subject: Subject: Content-Type: Mime-Version: Date: Sender: Sender; bh=XpRwX/zC1l9D0s2MyMVGw13k17S7pXm06JreD663UYo=; b=Jl+NV1KImYk99LB5B2iJldI1SsZSmywLTFxDlj9f6B9fO3WC5FmOKnpgcEeHjr6y9tANrn/qwVP3pu5RxPBtqTbRyYY/dqBUHn11M0zy7pohy7q/ZqMtjGPHL2zwLdP10G2QztCzdH2OO/lJRAcbG78w3cRp99KEwtzaEvguH9g= X-Mailgun-Sending-Ip: 159.135.225.165 X-Mailgun-Sid: WyI4MDZjNCIsIm1hcmsuaGF0ZmllbGRAc2VjY2wudGVjaCIsIjU1NjNiNCJd Received: from <unknown> (<unknown> []) by 040b6f744457 with HTTP id 65950dff05a232c0eb08d172; Wed, 03 Jan 2024 07:34:23 GMT Sender: [email protected] Date: Wed, 03 Jan 2024 07:34:23 +0000 Mime-Version: 1.0 Content-Type: text/plain Subject: Here's Your Free eBook: The 7 Qualities of Highly Effective BDD Scenarios From: John Ferguson Smart <[email protected]> To: [email protected] X-Mailgun-Tag: com_lcsPwMCbJCzJ6uyUNLuK X-Mailgun-Tag: et_workflow X-Mailgun-Tag: loc_wt7nksXs8SWGAr2Wz1VA Reply-To: [email protected] mailing_list_unsubscribe_url: https://services.msgsndr.com/emails/builder/unsubscribe-view/wt7nksXs8SWGAr2Wz1VA/NP7sB8xqZqTg79EDYbs6 List-Unsubscribe: https://services.msgsndr.com/emails/builder/unsubscribe-view/wt7nksXs8SWGAr2Wz1VA/NP7sB8xqZqTg79EDYbs6 X-Mailgun-Variables: {"c_id": "lcsPwMCbJCzJ6uyUNLuK", "email_type": "workflow", "email_type_id": "805b428a-179a-412b-b7e5-7c1149ff4888", "email_type_step_id": "4ca2d5d3-3eb3-4f5f-9658-9f187dff565d", "loc_id": "wt7nksXs8SWGAr2Wz1VA", "method": "api", "source": "email-isv-worker"} Message-Id: <[email protected]> Return-Path: bounce+[email protected] X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 5a646832-b859-46c6-8647-92679ed1ad96:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU6PEPF0000B621:EE_|AS8PR02MB9627:EE_ X-MS-Office365-Filtering-Correlation-Id: bd5f1b05-8218-4e3b-2997-08dc0c2e6939 X-MS-Exchange-AtpMessageProperties: SA|SL X-Forefront-Antispam-Report: CIP:159.135.225.165;CTRY:US;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:m225-165.mailgun.net;PTR:m225-165.mailgun.net;CAT:SPOOF;SFTY:9.25;SFS:(13230031)(4636009)(230273577357003)(230173577357003)(1690799017)(451199024)(22186003)(83380400001)(66899024)(356005)(83170400001)(5660300002)(166002)(7636003)(7596003)(8676002)(336012)(26005)(1096003)(42882007)(426003)(9686003)(1076003)(6916009)(33964004)(7846003)(58800400005)(76236004)(76899018)(1406899027)(5006899006)(84240200001)(93036002);DIR:INB; X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: =?utf-8?B?RUVqbTFkbHd5OHFRbzZJUU10MXpCQ1NxbmprUm96QTFaY3l2cWlTa29wWFpG?= =?utf-8?B?bWttR2ZKY05iSlNVUUlKZWxremxQL0ZwalNrRS9LRHhSa1NPL3pFQXVvVUUz?= =?utf-8?B?T2k0TGRpWnVSUmlBWGRvd0g3cU41VFphQlRTcFRyNEh4NFJwVnZJcGZ5WGNL?= =?utf-8?B?Yk01UjZyVE1GaldISWlTNEdoZUtpZEIydFJoekN5b0JNMDNUeXE0REgvZlQr?= =?utf-8?B?T1NUakNRcDJjclJWUmRRaVZGaHh1MGpHTm9UWHJVenJyaHRCc2dFZmZFd3Zy?= =?utf-8?B?RnVRYUc1YVo0bDZIallMaWNjUkxSYXZUZVpPc1JHVE1kMmRCT3dRemtVYmNs?= =?utf-8?B?Mmo5YW1xUldpWFQwalFoMDRIT1I4NGhnL0hsT1F5ODNUa0FnVVZkMG51Tm55?= =?utf-8?B?dzkyUHUzWForYmxUcTMxWlVUVXNndUIwTzdNN3NXSCtSZHZSeUdrSmVrMU8w?= =?utf-8?B?Z2dpaEoyL0RUNWJZTktwemxkYXA2T3FTbEdvK2N6VGRVNGNrdmZNclpVMHY2?= =?utf-8?B?UUxtME1PSWNVY2pzaDhUY2sxcWxZY2hGTUs5UnVYMzAwOHRPT1gvM0c5NGI1?= =?utf-8?B?cXFTRFBDUjMrOGRKdTlOY0JrbGhXcjAvU3hqVTk1OFNqR2NJRFZEb2htQ3hq?= =?utf-8?B?V0R4VFBHcHpCbndPWEV3SHo0VHhiclhmYXlPdGFLeUNxR3N0aEdORi9Ndy9k?= =?utf-8?B?NnN5eFBhT1FxS01BZHpwdDZQMTF0U3JFSG1lRjNpaW1iUFVDNThxYnRncFFJ?= =?utf-8?B?WS9ZbVR4OWllaTdEZ0ZZaGVQQnZtamp5ZGJZV3JlSFltMTJTbDhIL3RZLzZW?= =?utf-8?B?bEdFbTVLd0NTdWR1NHVwOEFPOHk4ckRJWjVsTlBrR25UeUx0S2ZkUlpJeUVL?= =?utf-8?B?SmRmKy9iditBWWFUU1kxVjU5anI2RU9vNkhPOUR6VVFzV0JhTWZkb0hXamF2?= =?utf-8?B?K2FrQTBoVkJLWWR4WkhJYXB6Z1ViRXFOV1pxQUVkWEJjZC83SWswakxNMEZu?= =?utf-8?B?VFBtVmVSanVNRUo3RkNib0F4NE9yVERSd2UrRjBkZFNBT3NWN1B1S1dvYzhs?= =?utf-8?B?dytKcGg3RFJuUnFZc2hPOTVKd0h1ajhPODNVS25TN3RJNkt5d0I0b0VmM01K?= =?utf-8?B?TzNzSUN0TkJSck56VzY5eFRqWjRQNmxYaHRLRktXWmREZ3IzMUY5b1YzK0xV?= =?utf-8?B?Q2NhOU1DcGtmeWpFbFV3ZUhyQ3ZYWDl5bDN0WCtSSGdJSGt5MHZUWHpEM2lT?= =?utf-8?B?ekxTTnZoN0I1cjNwUU9qYWU4UlBqTFFsRXZWdmYvZUN3Sm1mWmg3emVvd3NZ?= =?utf-8?B?a2RQdGxRZW9Zd0ZXUis2OVlINDYvNU9IbWZ0VXpoc0pNcmxSeSt2ZkxYdmtR?= =?utf-8?B?UVdqd1B5T21JUVVKRXpnTzJaMlJPc2JzSVpkVjN2dVVTbVB4MjVWOHhHcXBy?= =?utf-8?B?NTd0ZFJSYXZsajZRYUw0RkIrdEV2V0tNUjFwM2gvVVhBMzd5dFJOdVdveTlK?= =?utf-8?B?ajJ3L0JhWHF0OFhuK2VRekVoY0J4dXNnUGo5MW53UXNlSVNJMS9DOWI3cVBD?= =?utf-8?B?SERIeXFmaTk0ZDJLbVMyeDVQUHMvT2MxYk05RjZxRGFoZ0IvOXBpbGRpcEdH?= =?utf-8?B?MHprTXo2VnpRTUtnRjE5V0pLdlJyTmxGVU9FeUhQOEc2MytPblBRRTExMlgx?= =?utf-8?B?OWZ4ck54WDBFTGs2blN6c1pSZUZjQ1ptVzM1OXU4MGVnRUFWMzlEVzMvZU5p?= =?utf-8?B?MDFRUWNialQzSWx1WEtkaHZ5VlNYT2tsdldYbjNCcG9mVGgzQjN6Z1ZQN1B3?= =?utf-8?B?Ukd1ZkExNG01N2RLOWNmN2MxZytHMUlCZnRPNGhLTHhDNGtMcTM2ZTB6ekFs?= =?utf-8?B?NnF0QUdyb01tUUtwQ0hMWDkzQTNpNkRZQkw3MCsxMGhxUVpYUWtNSnVSd3Js?= =?utf-8?B?SGg4NlFZeE9IaFUyTWUxRzhLd1ZaSE11dmVCY2owZlBWMitBM0JJWW5Kellu?= =?utf-8?B?UFZhVTVuOUNqYWVWOTl2MDdlbXJZZ2NudFpjeVQ5b09tb1c5NEJadGo1ZENL?= =?utf-8?B?WjNnQUJCUHRrTWFWMUZwU2I3L3k3SFVrRmxaSkhGT3FXMkpaSlVPbGdqSm4r?= =?utf-8?B?eXZmZ1dDTU9sYW12L24yK0kyeUhkYnBtVGNCa3NEWE1VQmxEbjNTUFJEYnhO?= =?utf-8?B?ZnFmNXFJR3Y2MGkwdWlqZlZIREVJTWM1THlOYUdNQ0RBWUdrWUo1Y04xVFgv?= =?utf-8?B?OG5XMERXUzMxUStYVDVIMGJhVjkrUHRNWjhuSmJZYXNleTg5US9SY1A2MlU4?= =?utf-8?B?Qys1VjIrMUluWXZsaUh4NUtlTWMyek5SaTdWa1J2RmRlbDlRdGJYOGkyam1V?= =?utf-8?B?MTBtWlBJSVJqK0xrSldFb0dONGJKcDA4NW1NYzZjdm5iQVBxSkx3YVFxN1VM?= =?utf-8?B?SWY2dlBWbTFUbFJJZnRMenI5YUY2NkFFUWY5eGhCTjRMQXZQSFJFdWoyUFRj?= =?utf-8?B?YTRKd1pwL1B2TkJnY2RKZHMybm52eUxKZENWMFc3ejRPRTZwNmRDZFF0ekJG?= =?utf-8?B?aFV0Q0pRajlsZlhWUFowc1ZueHhxN2tXWjl3SC9MVEIxRU9rbFdTU1JDRjZR?= =?utf-8?B?dEZwVDdUZTlWSGwxT3gvZ01CR2RZOXFQSnBYc3hNNFpsOXhkcFplV0pkVEtX?= =?utf-8?B?ejB0d25FYVIyZ0F0cDhhVVcySXliOXRxMXQ2SDNJSit2bU85OWd5NDlJQjMw?= =?utf-8?B?YTE3Z2Rjampwd0M4QTBMUXYzeHpBTmRzR0dVRWpIc3V1dXVjYlNnQXo4MU5v?= =?utf-8?B?OUwwd1g0dEdUWHlVblloMWk5dFBwWFhsSTRQOUJzZ2lzWDhlQUkzM3VqRXJ3?= =?utf-8?B?czNDdzR3OEFOZGJTNGRKUklxSUMrMU5pWkdPSjE3RnJoWmVUNzdXQ3hGZmg1?= =?utf-8?B?SFhLZlRKTytnM095em5BZTN2eFJnOFNQN3FFaDlHT1duUHl2UDBJQkhxUjFJ?= =?utf-8?B?UFZBdVVFVXR2TUhrZ3dLVVBzWU1ZZ3JOTmY4ZGRmWlN2Z2JmNGt1czQyQ3hM?= =?utf-8?B?dE9JeGpsbElpWUI3RnQvU3RyUWF6N0diVnhadUV2bXE2V3luUWhPT2hUN3Rj?= =?utf-8?B?NnNHMlFsVXhQb1NNeXk1U055RDJUOE01c215MVNqUnhoclpDam1zNG1OV1gx?= =?utf-8?B?K0VBd1RkNTc1ZUxDckVKZTU2RldvZFQ5K21VTFdYMHkyZVJaVitIYThkR2Nz?= =?utf-8?B?cGdtaFNDQlVPS0RQSk5DWi9wUnhWbFp5YkRQdzNZUW5rZTBhUlBrSHIrNTVh?= =?utf-8?B?YVVwY09sbTNSRmx3b1kzbnhkbFVlanVBeWYzdDVxSXFER1IzRyt1NlZuZkNI?= =?utf-8?B?QXpEVzI3aTVvYnUxWENmQzRUbFZKODQzL2FmSTF4YmZWWW40bE5BL2MzMmtR?= =?utf-8?B?L0JZZk4vN2dLZUlrZTRqTVdneCtzKzl4Ly9scXZIS2ZSOUU4N2l0anJoVFF3?= =?utf-8?B?Tjd6MnhDeVd5U0tTNllkN3dDY2JNUk1VbkxnZFkwRjM4VmVLSEZybTl6ZWdu?= =?utf-8?B?RlErc2FBV1JzRlByRSt4Vi9BdTljMUJ3dDdpSzBaTm5KcmxIWHZMYld4Mktw?= =?utf-8?Q?SERW5ZAyi4TUXwQ4eS0zajNTsYEXoIDhJ?=

Sharing

General

Malware Config

Signatures

Files