Play interactive tourEdit tour

Windows Analysis Report
https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=FMANSOUR%40ORANGECOUNTYSCU.ORG&senderemailaddress=RetirementServices%40rsli.com&senderorganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6

Overview

General Information

Sample URL:	https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=FMANSOUR%40ORANGECOUNTYSCU.ORG&senderemailaddress=RetirementServices%40rsli.com&senderorganization=AwF8AAAAAngAAAADAQAAAIzs
Analysis ID:	1314068
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML body contains low number of good links

Found iframes

HTML title does not match URL

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Phishing

HTML body contains low number of good links

Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=5f634ea7-4576-42f8-b8e1-deed1443a259%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=0144	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/savedusers?appid=ee272b19-4411-433f-8f28-5c13cb6fd407&wreply=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&uaid=279d3678-a44f-4cf7-aa30-fa070a2c59cd&partnerId=smcconvergence&idpflag=proxy	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=860fe910-1054-4683-8a5c-0e6c8363da40%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=4750	HTTP Parser: Number of links: 0

Found iframes

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true

HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

HTML title does not match URL

Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=5f634ea7-4576-42f8-b8e1-deed1443a259%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=0144	HTTP Parser: Title: Encrypted Message OTP Sign in does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/savedusers?appid=ee272b19-4411-433f-8f28-5c13cb6fd407&wreply=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&uaid=279d3678-a44f-4cf7-aa30-fa070a2c59cd&partnerId=smcconvergence&idpflag=proxy	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: Title: Redirecting does not match URL
Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=860fe910-1054-4683-8a5c-0e6c8363da40%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=4750	HTTP Parser: Title: Encrypted Message OTP Sign in does not match URL

META author tag missing

Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=5f634ea7-4576-42f8-b8e1-deed1443a259%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=0144	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/savedusers?appid=ee272b19-4411-433f-8f28-5c13cb6fd407&wreply=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&uaid=279d3678-a44f-4cf7-aa30-fa070a2c59cd&partnerId=smcconvergence&idpflag=proxy	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=860fe910-1054-4683-8a5c-0e6c8363da40%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=4750	HTTP Parser: No <meta name="author".. found

HTML page is missing a favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/savedusers?appid=ee272b19-4411-433f-8f28-5c13cb6fd407&wreply=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&uaid=279d3678-a44f-4cf7-aa30-fa070a2c59cd&partnerId=smcconvergence&idpflag=proxy	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-gb/silentsigninhandler	HTTP Parser: No favicon

META copyright tag missing

Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=5f634ea7-4576-42f8-b8e1-deed1443a259%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=0144	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/savedusers?appid=ee272b19-4411-433f-8f28-5c13cb6fd407&wreply=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&uaid=279d3678-a44f-4cf7-aa30-fa070a2c59cd&partnerId=smcconvergence&idpflag=proxy	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638312578560130873.NmVhMzMyMmQtNjYxOC00ZTA3LTk1MWEtNTNhNmIyMWVjMjg4NjRmMTNkZjItZmQ0YS00ZjA5LWJjNDgtZThlNGU3ZmJlMzMz&prompt=none&nopa=2&state=CfDJ8Kiuy_B5JgFMo7PeP95NLhp0ZOFqbQYN-tH1h2JLG0B5YRdsWM2yQ5RtdHwW8VQyfUaz4XuCJtm34Hcql1IOUMToCLuml_LxTzii0i2YDq1XExjPDELB4oH9WUY1GdyrtuEQWeAi0t36yy0JKCFVbfdW_nRdq74kdjaQkBCLqWai-W12z3wIC-x9Paw-B87cJH9UAH5bGe1VZNYyVbK_xNrR85S0IL0EjWjouQkDohdixFWX3cw_9wDj-d8AqoSiuYVMPQ5aPGRl4JYroIy28SZushfyP-h0TcsxvBv5PNPlPg_In46CF9XQUBNLj84le8rgXaOYXMSxKAOibeygo8MVwKF6h8Vokaay-G44-Irm&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=860fe910-1054-4683-8a5c-0e6c8363da40%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=4750	HTTP Parser: No <meta name="copyright".. found

Compliance

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\chrome_BITS_2796_1882985736

Jump to behavior

Networking

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-GB&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Encryption/retrieve.ashx?recipientemailaddress=FMANSOUR%40ORANGECOUNTYSCU.ORG&senderemailaddress=RetirementServices%40rsli.com&senderorganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B&messageid=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com&consumerEncryption=false&senderorgid=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43&urldecoded=1&e4e_sdata=XtQtMkyl8d7WhORyKw%2fuxkdZoesMj5tQhFYiwcQ%2fQXhlKGmeiIk7Q7MbJ8g%2fzGVyuc5ri22BHfGyVvc%2bcyRHrYk9GgdSbvRcoc8bEMnsYgdnmI2qfnHWrHBfEDcXUg4h%2bQyVs%2bw0NMqld7Wyu%2fMlqmRM4cr3M0VQ4jMji7oGuquzk6SKu9VdeU8BpNdZy9NZSAGiGLyU%2fnL1Ijls9cRcuRFxli9bWVNVPdcvBdKl49kHfkh7IbyeON45EIIgfV%2bKPSQZ4qNvZBgD0ZsO%2fTk%2bB%2fyoNvjyHxuJlTwmpO2S4itUIep57YFFQCKA%2bfv41OfFyVGo9m1vxe2kh80Ej1R4Jg%3d%3d HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Encryption/default.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43
Source: global traffic	HTTP traffic detected: GET /Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&e4e_sdata=sacMoaOXCu8ZKB%2blAzd3ieJaFnLCqdO56Yflb1u8M1n8E6MbMagnKJXJzoknH09F5W0OScyMg0uLKp9yUNhifaLbn1L9otZY2OZX9ZdhGMT9NC%2bwPCkS%2fgw2GNDvfnB7x5hThofA0Wh8UXodPaoFCNfq1vbDpRnP2nqMljc3OfU6LovjQqqCE%2bxNwb9wv0XHauipFDwOrP%2fx9hBBPrxPhAaULZx%2fD%2fiYvkwbPrmOYh6nc48dM3SCiSuCr9IsOiXnSCqoDwWLLtDv6hHLRRExahtkMO%2f%2bHApAs5Rg7IAtiF6iQz7cTuMTdjp3waLTC4e%2bPM4IK9dbeEK%2b07ou8YIwQQ%3d%3d HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43
Source: global traffic	HTTP traffic detected: GET /Encryption/authentication.css HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&e4e_sdata=sacMoaOXCu8ZKB%2blAzd3ieJaFnLCqdO56Yflb1u8M1n8E6MbMagnKJXJzoknH09F5W0OScyMg0uLKp9yUNhifaLbn1L9otZY2OZX9ZdhGMT9NC%2bwPCkS%2fgw2GNDvfnB7x5hThofA0Wh8UXodPaoFCNfq1vbDpRnP2nqMljc3OfU6LovjQqqCE%2bxNwb9wv0XHauipFDwOrP%2fx9hBBPrxPhAaULZx%2fD%2fiYvkwbPrmOYh6nc48dM3SCiSuCr9IsOiXnSCqoDwWLLtDv6hHLRRExahtkMO%2f%2bHApAs5Rg7IAtiF6iQz7cTuMTdjp3waLTC4e%2bPM4IK9dbeEK%2b07ou8YIwQQ%3d%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/lock.png HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&e4e_sdata=sacMoaOXCu8ZKB%2blAzd3ieJaFnLCqdO56Yflb1u8M1n8E6MbMagnKJXJzoknH09F5W0OScyMg0uLKp9yUNhifaLbn1L9otZY2OZX9ZdhGMT9NC%2bwPCkS%2fgw2GNDvfnB7x5hThofA0Wh8UXodPaoFCNfq1vbDpRnP2nqMljc3OfU6LovjQqqCE%2bxNwb9wv0XHauipFDwOrP%2fx9hBBPrxPhAaULZx%2fD%2fiYvkwbPrmOYh6nc48dM3SCiSuCr9IsOiXnSCqoDwWLLtDv6hHLRRExahtkMO%2f%2bHApAs5Rg7IAtiF6iQz7cTuMTdjp3waLTC4e%2bPM4IK9dbeEK%2b07ou8YIwQQ%3d%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/liveid.png HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&e4e_sdata=sacMoaOXCu8ZKB%2blAzd3ieJaFnLCqdO56Yflb1u8M1n8E6MbMagnKJXJzoknH09F5W0OScyMg0uLKp9yUNhifaLbn1L9otZY2OZX9ZdhGMT9NC%2bwPCkS%2fgw2GNDvfnB7x5hThofA0Wh8UXodPaoFCNfq1vbDpRnP2nqMljc3OfU6LovjQqqCE%2bxNwb9wv0XHauipFDwOrP%2fx9hBBPrxPhAaULZx%2fD%2fiYvkwbPrmOYh6nc48dM3SCiSuCr9IsOiXnSCqoDwWLLtDv6hHLRRExahtkMO%2f%2bHApAs5Rg7IAtiF6iQz7cTuMTdjp3waLTC4e%2bPM4IK9dbeEK%2b07ou8YIwQQ%3d%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/lock.png HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/liveid.png HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/OTPSend.ashx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPRef=SigninPage HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=5f634ea7-4576-42f8-b8e1-deed1443a259%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=0144 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/base.css HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=5f634ea7-4576-42f8-b8e1-deed1443a259%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=0144Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/help.png HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=5f634ea7-4576-42f8-b8e1-deed1443a259%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=0144Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/arrow.png HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=5f634ea7-4576-42f8-b8e1-deed1443a259%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=0144Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/help.png HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/arrow.png HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.analytics-web-3.2.7.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: MC1=GUID=762ed1c63ceb49b49cb46dba465abf5d&HASH=762e&LV=202308&V=4&LU=1691663513605; ak_bmsc=2CD1F0809B2745CE92A04644F73ECAC7~000000000000000000000000000000~YAAQBsHOFyelNI+KAQAAPSJGzRU6i7WZnWF/dHk48ffb1n5a5x4Goia2FOeeLXs4G9oi0hHTQOJ+Dko8yUHJ+ZlHC5NMncbQWmVb7idjIv/vAhO6bKCjYhHQPgul1fqOhO7cmltStssflKiP5ZwcKPgs/IMb2pfKPrEqJhA2bksmRV2oIgFk6XwaGsb4/fm6QuRDki9tD/u+eAXRq4HK1cku3Sp7FSfnrn5V0YX2hEWL1Xhk4TqGje4AXI3xuHOoqk4AUQ1K2SHAJUPAtGGVmoNJ1uEisUimrW1oC/ktTTGD97TQXojdW+OWBvbUsCVqf+XHq0UVjPRANS5MHBcNyB1hhi3Xqij/w/X6zSI6h8zTYXTLJ8mNU2maHlsTIVDL
Source: global traffic	HTTP traffic detected: GET /meversion?partner=SMCConvergence&market=en-gb&uhf=1 HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.2.7.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23212.1/en-GB/meBoot.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_nun_Nob0yT2WjCUfgBCTog2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /scripts/me/MeControl/10.23212.1/en-GB/meCore.min.js HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://support.microsoft.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_pOO34JFwD1EVcxt413xLZg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/FetchSessions_Core_MFlyI4bSaXT-d8J13gRcrQ2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /16.000/content/js/MeControl_umBmqzyz4SjjjpHQlEPqaA2.js HTTP/1.1Host: logincdn.msftauth.netConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"Origin: https://login.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /me/mecache?partner=smcconvergence&wreply=https%3A%2F%2Fsupport.microsoft.com HTTP/1.1Host: mem.gfx.msConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://support.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /Encryption/OTPSend.ashx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPRef=OTPSigninPage HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/OTPSigninPage.aspx?itemID=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1&OTPMessageId=860fe910-1054-4683-8a5c-0e6c8363da40%40BN8PR20MB2561.namprd20.prod.outlook.com&OTPReferenceId=4750 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: X-E4E-CorrelationId=dc6b8564-7ba8-4575-9c2a-41b4c24fd98e; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6}@rslic.onmicrosoft.com; X-RecipientEmailAddress=FMANSOUR@ORANGECOUNTYSCU.ORG|dh%2fStNJqkuXG2s9m8Vlt6NiEip2VEYvGzjSFBARQ0B5u5GhvKjlIEyIYOQ3oe7tbfWJxZO7H7JxASsb7gDiQ%2ftc8anya%2fMfRA1cVHBsuU3wtbR8mMhunOMqAhDuolJpp3JIzI2fzqr9M0Yvu%2fuwa1ZfYYfwtW9RJ%2bxqqTMxsYamqMcslOxfbh09GukZWiUpcZZWDGxcdSowrxe6NTph%2fiDGuIphx%2fgiScs6nXbco2F2KTSJJACnCQj3AqPZAiftD8%2fUvUfZ7PsEC9Wc3%2bv2llfT9vSKiJ7UJ0tcRRIx7gNEOQ9Q%2bY%2bhMUQQ1RoP59%2bKJaV8j8gevEBpJ02TKxnkU2g%3d%3d; X-SenderEmailAddress=RetirementServices@rsli.com; X-SenderOrganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B; X-MessageId=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1=BN8PR20MB2561; X-OTPItemId=E4E_M_3e22b8c4-71c2-4cf2-9a94-1143a5a71ef1; X-SenderExternalOrganizationId=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43; X-AnonResource=true

Found strings which match to known social media urls

Source: chromecache_190.1.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/Microsoft","https://twitter.com/microsoft","https://www.linkedin.com/company/microsoft"] equals www.facebook.com (Facebook)
Source: chromecache_190.1.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/Microsoft","https://twitter.com/microsoft","https://www.linkedin.com/company/microsoft"] equals www.linkedin.com (Linkedin)
Source: chromecache_190.1.dr	String found in binary or memory: "sameAs":["https://www.facebook.com/Microsoft","https://twitter.com/microsoft","https://www.linkedin.com/company/microsoft"] equals www.twitter.com (Twitter)
Source: chromecache_190.1.dr	String found in binary or memory: <a class="d-inline-block" href="https://www.facebook.com/Microsoft" target="_blank" aria-label="Follow Microsoft on Facebook, opens in a new tab" data-bi-ecn="Facebook" data-bi-bhvr="126" data-bi-cn="Facebook" data-bi-socchn="Facebook" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.facebook.com (Facebook)
Source: chromecache_190.1.dr	String found in binary or memory: <a class="d-inline-block" href="https://www.linkedin.com/company/microsoft" target="_blank" aria-label="Follow Microsoft on Linkedin, opens in a new tab" data-bi-ecn="LinkedIn" data-bi-bhvr="126" data-bi-cn="LinkedIn" data-bi-socchn="LinkedIn" data-bi-ct="Social Button" data-bi-pa="body" data-bi-compnm="Social Follow - horizontal"> equals www.linkedin.com (Linkedin)

URLs found in memory or binary data

Source: chromecache_181.1.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_231.1.dr, chromecache_232.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_190.1.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_231.1.dr, chromecache_232.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_190.1.dr	String found in binary or memory: https://accdn.lpsnmedia.net
Source: chromecache_207.1.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.4.min.js
Source: chromecache_190.1.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_190.1.dr	String found in binary or memory: https://analytics.tiktok.com
Source: chromecache_190.1.dr	String found in binary or memory: https://cdnssl.clicktale.net
Source: chromecache_190.1.dr	String found in binary or memory: https://cdnssl.clicktale.net/www32/ptc/05d32363-d534-4d93-9b65-cde674775e71.js
Source: chromecache_190.1.dr	String found in binary or memory: https://d.impactradius-event.com
Source: chromecache_188.1.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chromecache_231.1.dr, chromecache_232.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_190.1.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net
Source: chromecache_190.1.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_279.1.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_279.1.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_279.1.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_190.1.dr	String found in binary or memory: https://js.monitor.azure.com
Source: chromecache_190.1.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0
Source: chromecache_189.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_207.1.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=3a9ddf38-83f3-4ea1-a33a-ecf
Source: chromecache_189.1.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_190.1.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net
Source: chromecache_190.1.dr	String found in binary or memory: https://lptag.liveperson.net
Source: chromecache_254.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Source: chromecache_190.1.dr	String found in binary or memory: https://mem.gfx.ms
Source: chromecache_254.1.dr	String found in binary or memory: https://o365exchange.visualstudio.com/IP%20Engineering/_queries/edit/1648312
Source: chromecache_190.1.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_190.1.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_190.1.dr	String found in binary or memory: https://publisher.liveperson.net
Source: chromecache_207.1.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6813.28/resources/images/0/favicon.ico
Source: chromecache_190.1.dr	String found in binary or memory: https://schema.org
Source: chromecache_279.1.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_190.1.dr	String found in binary or memory: https://twitter.com/microsoft
Source: chromecache_190.1.dr	String found in binary or memory: https://www.clarity.ms
Source: chromecache_190.1.dr	String found in binary or memory: https://www.linkedin.com/company/microsoft
Source: chromecache_190.1.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_190.1.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_190.1.dr	String found in binary or memory: https://www.xbox.com/
Source: chromecache_190.1.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/pc-game-pass/cfq7ttc0kgq8?icid=CNavAllPCGamePass
Source: chromecache_190.1.dr	String found in binary or memory: https://www.xbox.com/en-us/games/store/xbox-game-pass-ultimate/cfq7ttc0khs0?icid=CNavAllXboxGamePass

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: AEC=Ad49MVEVy5CxtQLtYrblzXz4DifLm5q80KxkAsZM0tGClBBQswyzDRIjhA; CONSENT=PENDING+494; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDMtMF9SQzIaAmVuIAEaBgiA0dCmBg; __Secure-ENID=14.SE=FEqwE5eimu_CzO8QanixDxMiVRDl1S74wJwxQG4kibYxHFlarNLstM6_FtN3tkTBDN7NI-PM3BH3uafw_juj7Kua5Sxw58UIqMyDvhq3JStE-0GsITWS9X0QrbjvmkA5MVBf-Eb4RLTTefnPk1F_g7MJo2hXw4TzaSRHE_HtskdpjjbT9g; 1P_JAR=2023-09-25-09; NID=511=SzLVLHQSmPvgkoqmP-MsqjETq9dQ36QVm_qf2IzzhOCW0fFPsDTYGrt2nIMcjA4Ms9EAqvkswXpgrdTrGbklWuF9VUuI4kQoyRxzZJXmXGR4c2GB7bEOL6aT4Siga3gbRX-33znuEESDzU4kk1UQHyGVPHjVG8C7MD74EeDyBWQ

System Summary

Classification label

Source: classification engine

Classification label: clean1.win@25/105@64/15

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1668,i,8296362934526227198,6261186685228719480,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=FMANSOUR%40ORANGECOUNTYSCU.ORG&senderemailaddress=RetirementServices%40rsli.com&senderorganization=AwF8AAAAAngAAAADAQAAAIzsnvU1tppDoQIiRsDUvP1PVT1yc2xpYy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT02i3gHLl2ckTaWxN0qWnpwxQ049Q29uZmlndXJhdGlvbixDTj1yc2xpYy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVBSMjBBMDA0LERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B&messageid=%3cPH7PR20MB5897B1388812EB2F08F0829DF5FCA%40PH7PR20MB5897.namprd20.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40rslic.onmicrosoft.com&consumerEncryption=false&senderorgid=a12760ca-cea2-4c03-9ac6-6aa5ecb49e43&urldecoded=1&e4e_sdata=XtQtMkyl8d7WhORyKw%2fuxkdZoesMj5tQhFYiwcQ%2fQXhlKGmeiIk7Q7MbJ8g%2fzGVyuc5ri22BHfGyVvc%2bcyRHrYk9GgdSbvRcoc8bEMnsYgdnmI2qfnHWrHBfEDcXUg4h%2bQyVs%2bw0NMqld7Wyu%2fMlqmRM4cr3M0VQ4jMji7oGuquzk6SKu9VdeU8BpNdZy9NZSAGiGLyU%2fnL1Ijls9cRcuRFxli9bWVNVPdcvBdKl49kHfkh7IbyeON45EIIgfV%2bKPSQZ4qNvZBgD0ZsO%2fTk%2bB%2fyoNvjyHxuJlTwmpO2S4itUIep57YFFQCKA%2bfv41OfFyVGo9m1vxe2kh80Ej1R4Jg%3d%3d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1668,i,8296362934526227198,6261186685228719480,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\chrome_BITS_2796_1882985736

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\chrome_BITS_2796_1882985736

Jump to behavior