Overview

overview

3

Static

static

1

uploads_17...76.eml

windows10-2004-x64

3

uploads_17...76.eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    uploads_170d6ac1-735e-4b8b-b038-6ad0ce70ce76.eml
  • Size 118KB
  • Sample260821-ryzzaawthv
  • SHA256 d6507e2f1b2b985224102f56f91c1b5f24e963a64082274df4fb52ad9a2e2dfd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • uploads_170d6ac1-735e-4b8b-b038-6ad0ce70ce76.eml
    .eml 118KB
  • email-html-2.txt
    .html 46KB
  • email-plain-1.txt
    14KB

uploads_170d6ac1-735e-4b8b-b038-6ad0ce70ce76.eml

  • SHA256 d6507e2f1b2b985224102f56f91c1b5f24e963a64082274df4fb52ad9a2e2dfd
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 20 Aug 2026 19:32:13 +0100

Subject

Behavioral Security in the Age of AI is here.

Content-Type

multipart/alternative; boundary="----=_Part_1837_427728106.1787250732867"

Received

from SA9PR09MB4733.namprd09.prod.outlook.com (2603:10b6:806:49::9) by BY5PR09MB4691.namprd09.prod.outlook.com with HTTPS; Thu, 20 Aug 2026 18:33:13 +0000

from CYXPR09CA0014.namprd09.prod.outlook.com (2603:10b6:930:d4::26) by SA9PR09MB4733.namprd09.prod.outlook.com (2603:10b6:806:49::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.10; Thu, 20 Aug 2026 18:33:11 +0000

from DS1PEPF00017E08.namprd09.prod.outlook.com (2603:10b6:930:d4:cafe::55) by CYXPR09CA0014.outlook.office365.com (2603:10b6:930:d4::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.10 via Frontend Transport; Thu, 20 Aug 2026 18:33:11 +0000

from mail.wisconsin.gov (165.189.205.20) by DS1PEPF00017E08.mail.protection.outlook.com (10.167.18.165) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.3 via Frontend Transport; Thu, 20 Aug 2026 18:33:11 +0000

from APWMAD0P6574.accounts.wistate.us (165.189.205.20) by APWMAD0P6574.accounts.wistate.us (165.189.205.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Thu, 20 Aug 2026 13:32:20 -0500

from CH1PR09CU001.outbound.protection.outlook.com (40.93.20.26) by APWMAD0P6574.accounts.wistate.us (165.189.205.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46 via Frontend Transport; Thu, 20 Aug 2026 13:32:20 -0500

from CY5PR09CA0026.namprd09.prod.outlook.com (2603:10b6:930:1::20) by DS0PR09MB11537.namprd09.prod.outlook.com (2603:10b6:8:175::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.10; Thu, 20 Aug 2026 18:32:16 +0000

from BL02EPF0001B417.namprd09.prod.outlook.com (2603:10b6:930:1:cafe::16) by CY5PR09CA0026.outlook.office365.com (2603:10b6:930:1::20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.9 via Frontend Transport; Thu, 20 Aug 2026 18:32:16 +0000

from nwamad0p5651.wi.gov (165.189.56.54) by BL02EPF0001B417.mail.protection.outlook.com (10.167.242.197) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.3 via Frontend Transport; Thu, 20 Aug 2026 18:32:15 +0000

from bd77ewy.bf02.eu1.hubspotemail.net ([143.244.82.176]) by nwamad0p5651.wi.gov with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 20 Aug 2026 13:32:14 -0500

by 172.16.155.69 with SMTP id a0b9znrox27ui25xrchl0u582xztweatky55xmmy8o0; Thu, 20 Aug 2026 18:32:13 GMT

Received-Spf

Fail (protection.outlook.com: domain of bf02.eu1.hubspotemail.net does not designate 165.189.205.20 as permitted sender) receiver=protection.outlook.com; client-ip=165.189.205.20; helo=mail.wisconsin.gov;

Fail (protection.outlook.com: domain of bf02.eu1.hubspotemail.net does not designate 165.189.56.54 as permitted sender) receiver=protection.outlook.com; client-ip=165.189.56.54; helo=nwamad0p5651.wi.gov;

Pass (nwamad0p5651.wi.gov: domain of [email protected] designates 143.244.82.176 as permitted sender) identity=mailfrom; client-ip=143.244.82.176; receiver=nwamad0p5651.wi.gov; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:143.244.81.76/30 ip4:143.244.82.176 ip4:143.244.82.178/31 ip4:143.244.82.182 ip4:143.244.83.64/29 ip4:143.244.83.72/31 ip4:143.244.84.16/29 -all"

None (nwamad0p5651.wi.gov: no sender authenticity information available from domain of [email protected]) identity=helo; client-ip=143.244.82.176; receiver=nwamad0p5651.wi.gov; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only

Message-Id

<1787250730831.04bb2acb-75c9-46b6-b063-6cd4b712da3e@bf02.eu1.hubspotemail.net>

Extracted URLs

  • file https://secure-web.cisco.com/11OgWDL3NdQi_7UX2Sqvz3oEhzZscweCcJDGC13igfCHB-tib4T7YPUfDhY18lUeINvZBEUbAZOmK8eEfFneNgthhvee7U2QTWqjNd_RYa98VW0qFq3e-RDhH7jiR5wDQCccfSZ9YxNDstToKa9eavkKi6WEEgyBKMiXmlpA4gE597YD6YUB1g-TGkII6t_eFr5I0ACmUg3KlI07A6_jSBsrTiCnJ7ra0kY90aLWwSumZYVxUrv6NL1pfAgc47d01pSs8qJpA5MVu6hTOLX0s7vJ6rikbOwPS2VTkly32Nc9q9ya-Cmcd0IdfdrxUplRpPvA2FEfn20-pOnUSfD8QOw/https:/links.darktrace.com/e3t/Ctc/W+113/d304s404/VVp4qg7rrYpsW6HsSVT7NK1dTW2gkVcw5SYXLNN2VVBzK57vV2W69t95C6lZ3l_W2MSbmN3QP7CLW66nrVC3sKP96W409pZx6Jcf4hW4RJcCG2_Gz1FVK7qzj3SfMMnW2Vby648Gx9MpW5gGd2Z3XQctqW1rm8Pj1XXf82W7XlcsT7mntKQMKLBBtyNLR4W81sYy831jcDZW5PqGzZ2Tk-tKN8xmXGMJvYGyN2wklnMhz-BXVQh1pQ8TD6GvVTQyr92RLgjWVmsVD615zXtGW7JClvR7Bk9Q3W8GhmWJ1H-2vCW7w-0J22rCCRPVQTp0Z8l06w3TbbpN1Dz6xQW59kgYM7F4d-BW1-xykG2s8wScW4cgjGZ1LLLtSN3jnct8SmqfcW1vGM4d3lRcBXW10dbqn2y2JSNW66HdtY8NVTFhW7tv73H4n9BsMW10mHQ73m2k2PW7Nb-qN5vgG8RW7WDDJR4CmSh_W64SmFS6X3CYwW6Yn-fW96gpc1W8ZcRwJ87M66lf7QnLBb04

  • file https://secure-web.cisco.com/175qKLaIIcWvHKRcdPUa0X-IGfkWW7Z9e79mkZLC64JmzMlL79U1-qF5yDE-_6jfxm8rDI0dn3C1LCsdKN0Vw01QCQ60wEndWS4BFvvfgBJB-Qg8avDhg5i_-CSlgZroArgMTEuauMnBTb18WYtILVFNW3s26lsBGQur1QVyxWgnLxL4b6ZDu7400em4dcI8b-nJhRxlGIQS0ozsfSFbnH3Fkq-N7TXmQNKvUlI789zuyZMaSL74YLfxwel3Fo9EP_xvyIhiZJjnryct78WqVplTKC4dftNv_sAjVUCiPEJsBlpYhspvK1ztu60n5SdFjXj3TC8vMmfB_6ud0BqzMGw/

  • file https://secure-web.cisco.com/1BxIQUTsLPmDymIb6wL3i4oUP64974M0Ceqr1iaiKDG56D5BQmyPyGy4_cOCP7D989mujtAZ5TO2XSlWfVxyu-AUVFH96x3EZP42win5FblZwgUs0iIFWODmcvqj2Ht0vrXawht1lkwoTSYRa-KHi6sXDhsp7xEYHsMOn52Gdfd9Wdkh32wiZFZEWUt0GaHSyMxLAVisjusijSjo4me-jlclfe3Tf59J1YZv5HDDCvIcFyn8Kh1RQuPPl08bjMp-90JPjKTn23Wq1U9unr_qUuKbIZNNEgYpI3Sgn7XDs0HDaNpOsD3KwqvaVErdsmzhVJM6qCFgq1qs0AQPt6UjPgA/https:/links.darktrace.com/e3t/Ctc/W+113/d304s404/VVp4qg7rrYpsW6HsSVT7NK1dTW2gkVcw5SYXLNN2VVBz67mmznW50l5tj6lZ3mcW86VFYy3-9sSPW4NsJFF82xJSxW5rwCCT7gqCCKV-7x6j5L_QfYW2Plp501WbdX8W8h38r_8lxmPmW5c-Qrb2dKpw6W3KHtMn6Yj10ZN9l6G8BfKPHwW3GWqQP58FK1rVrs6ML8y0FQxW3vtFLQ5JG4PYN8h7ZCwyl1RnW3-6-G46b9RXwW70DwYL50kBLRW1lfZQ66VzhYzW27t5jd823yFSW52l1_X7y7VDSW95V-SX4g6zzxW19dzXp2gPSP_W6F2RBk8kTTqhN4Tyjm1B5mR_W55ZwM453yy-BW8tgrVt8QQPLfN3ZCmZ-5gYCnW5Qmvf42YfyMqW1WplN17JbrC5W7ZyKBr6jZS7mMTFMRCXK2P4W14xlJ-4-Lxf6W27K0SW8lt9lbMyxN_bzXXQRW54cLp21DD9HtN49Q2s9wPdMTW5LxZSs5yGqzRW25NV--1klJy8W2tN-MW5ltg8zW4Mq5Mv3hgZ2tW55bZ7c4LpFKXW4rhCXn6TRDxBVXJ75Q8K356rW30R6Y12Rxr8pW1hWF2y2S1hT_W3-vd-f57LLrdW5ffXTW4r16cjW1nDJCf1nmVrCVDNM-66ln_YPW6bzK9W8bZ-hHf6cFVpq04

  • file https://secure-web.cisco.com/1C6m0dLp1MN_qt__iRfjhS_59hFWgdbHu1Xc6fhs-sdPqiMfFRh_ysKJnziy8OK-TVoBEk3lD2msPoVqg-JduSDxytbHOdT-o5dIfG9A4UqD7WmnrEwLkUxckf_TACqaocHt9pXWwrOdF_HG6Z4YZlA2q0-Sm_GfX0znxrMqQkH3dQ7LkAj8APYWUFbRCOCDtgH7dWn0u0BsFPA6kOgz-Z4QDbKZY1gXPVYERXGc_kJ0i39C6yOlxkk9JCwmxTf0fpzTRLp8jAdOv0Y4smmKF8ZLBdZzwtKDuvW9GzhsJ4ay5ot6chMa8ifa4jRq5pqPZ2_LeHZQWNsmwlyEtXU9-5g/

  • file https://secure-web.cisco.com/1CFjUoMPhSmjMRtdv1HZb4tjjW7Q9gxxnZABPYMRu9Giydckg7HttzM3srWm8sKB5jtcZYhiMuuglGm-CoSSJIptKmfewFr0jhwJbeV3eHRt294rrkxZMs4UaxyaqsehRAHa_owtmxF42L0SdR4VtodMdunhVRytmi9c3GqMhO1kOKP7csORPALCXHI4hLejdQ_2lP-1SlYPzEclhvoLtMSazCs_F6F3FiVVtcK-aGD40XVFXByuL_RMI1LxL9JP-_1gQJJaaOOnUCv1jpkyU15FrJ-cFP1jDf4JDmZCJzB2JJAggCz7PgoIlQeHC0D9jHMKkKtGgDNEPHgcepynk6w/

  • file https://secure-web.cisco.com/1FnB6dv2ewtbLaIusP5GFyHxZ2YVcVfIolqjP51HNL5XlY3rG2_HCsnIiNY1PlS4DJtselvx8tf1ZxyAj83eEeiR-AoPe8cR7LyZGHpJ2o5cidNLu70gBqXUXpLE0VhqVTQJS3xavuqC9eYsmeb76T3mgLPNkbqMRKcs8c3c-4PYr6THb6GI4w6TrKLRiYt-7ktywMb9srHwNijpK1PV5Br5dy_xY5AuwG8ScrBa12s88e2cuwVZ_DFApzZAZvbDTT-TUApnGVfkS9OGSH0E2EH3OW7cY-rcXPAnBYSmZygY0QRMGb0sdKsr_cC-9Hw6KYRHQ65M_2D5QYo5TYUUGew/https:/links.darktrace.com/e3t/Ctc/W+113/d304s404/VVp4qg7rrYpsW6HsSVT7NK1dTW2gkVcw5SYXLNN2VVBzq5nR3bW5BWr2F6lZ3mTW8HMj853sSxZ1W5Gzzs48Ythb9W7jKjsn382p9PW6l5SW34_3Q_8W744Yfm4nFj9-N7JDrZ9sfmDXW1FlmRw7ZxytTW8BdxZG7_TM_wW9gcn4P7V50PBW84Xss090rWQDW1ShSTP8gPWYqVYcfC-76cj1GMPNbV0Cg3BRW32kyyw7ck3F_W767XZt7j3xQGW5L-KWP95R7jlVRK9CV1k-SPLW62bBXl1wLlkpW1Drvx713Gm6gW4xWFHw2p1Mt9Vtn2Mw3SdJM9W4g-Chm5WkL5KW1NV1Ry7bn5qgW5mtHxN45x74lW6W-4Br3vy5mxW7-XkBY6PHNcQW5KmmYL6XZKFkW8GH9n483SQXDW69mV3T3zFFcgW5zK7VB4QtNZKW4Rl-lN9dx9xvW8HMqsj5HhwYWW2HZvvS19Ly8WW1bk3cX3_Hv2pf6Pp6fl04

  • file https://secure-web.cisco.com/1GR41sQiEqCtxBvZDzIHYJuHTQM3MtwFVhZWVEywULmabmfzJlapABtnR-JgFdokYM9SBMXPQGDW2K-gFGmtuVJhjIIeKAnW43vDQo7jSqWrQXTq2SHxqoG-7d7ZDqjuCECIjnWkg7JcVgMuHy5MzAqjQ3QXXAZMJtatiJLNX9X2uzR9r19B27Qpaa3XGMNHU9WbY2kPZQMwOHahE5SuEVmoyJsPu0WSJ0iD-SiHOZDSUkURTGN0dDhI0V0uSlCdFur1QRJyAhlKOVhKoGKSfaDzvR0i0Yp9k7USHg6xElQuuAMyNQLXVn7l7Y6vbL4YcJN9_7ipct_3J1ALaaBYbQA/https:/links.darktrace.com/e3t/Ctc/W+113/d304s404/VVp4qg7rrYpsW6HsSVT7NK1dTW2gkVcw5SYXLNN2VVBzK57vV2W69t95C6lZ3mWW2KJ7zl7wp_xyW8YHYFP8xvZjBVg46PH62DrLzW4WZP8L5nPF04N3T5H8zM27MJW2_WdRW1L-mFKW6Y8RtR1v6_jMW7YMX1X1rq3btW4m-36t95SYsgW4FCTpn1Hz1M6W5KJz1M684v6vW5wPV4b1xxDtfW3xNPPp5zwB2_W78LJ7T8mccjrW6T0pf71XGbSfW1cDSXJ8dh7STW101my519MVRgN5XqK9dQdHzjW8fsC5R6mVmTjW4GMX3M6j9PBhW70jG9V97SgzxW3Rk7BS2mKbq2W2TZX1H1KjJbHW4c6ZC24yy_BwW8X2d7-5f1hptW4m9BXV4Wk0NhN89L5z1dVWH6W8ggY218VmCCfW1Gltvj55cKbMW8RzdKt9bvv1kF5WznrKHYt3W1KmbxJ12c8vyW6dVLR_95t8zCW1ZvkSK3-1W21VV_54s3l1K9tN4LNKnYB9MYcf73xtwv04

  • file https://secure-web.cisco.com/1PHWTIEluL879iTjkz8QljD0bASi24f1kRmOkvreFRpK7v97llO39FHrvmCpeAN1se7gOlGuiH7EAChysoNex7_COSozEiko-7chJkZ_43U4Ra6b0J219HZUdxcjbm2vH1zk2XjMtqTVUPUXuMV__qIzZslLK8CqnpRFdbZjn2vbXEDVJLe_AVEKbibgpFqXPHJgXdeZ4X98BnlVIlZQTnVPwPMLHHa0tbNZJTsU3vVbCnd6NVD9Rn-ndfAoh02qLy0YD_kf0M9aZk05y3-3Lp1nS7GWUHw38e-eM9zA7Q-glVvS9G6a-K0df_phs9BaWWeB4HhihCzNHAgKtw4Db4Q/https:/links.darktrace.com/e3t/Ctc/W+113/d304s404/VVp4qg7rrYpsW6HsSVT7NK1dTW2gkVcw5SYXLNN2VVBzK3lYHdW69sMD-6lZ3mcW2VmsQH8gnbSZW72jr6l4rPR2GW3LLxP56XmWp3W3n6ckX5YNtZDW4vBfJ65JP7NDW2tQFTJ3_jtSFW2ZKzrg5TxfbHVYgH4b1-X7n3W38RGn33xgpJkW1XKhcg8h_5b7W1JLZwk4LQ63gW64sqRz5cXlPYW5HHYLs5G4LFhW6y53jt5Zj5rpW4ktMnV8HBTXTW88rQ6B89HRWwVvl1jk29J3F5Vr136F1svKLLW2dRBRw1fBZ8tW97SDPN8S0PhQd5_1tg04

  • file https://secure-web.cisco.com/1U4dr_L3kZu1en6MlPjR-FQxEQleWMTyHkjSY9w9ajhXEWowxCp2vHAV_HOaFURCsqpyaA9nTsSHJT56h-w66MuK2Cz5imq5akk6WgRiVERjeTRvvrWnnj5L_2wtHiuSv3EQTyegJQppgodumFbRDNnKUdEC3-F6-6w8q7eBI8FQDo_qUi74BaMOgqGwk1jE_kGkReupkkt7MO5kCBQ6uYpZu542mboOGK_PW6hML7tNkcogpv3UaJzr1x8XXx-gvoCqw_empcSKk6j6SrXNwHBBj9UNw_A9xxd6yeLFy7npIq1-m6y-GU9ldxCD_K-JwO94tHLh4o14txu8qjtGrzA/

  • Show all