hxxp://Received[:] from AS2PR05MB10846[.]eurprd05[.]prod[.]outlook[.]com (2603[:]10a6[:]20b[:]64c[::]6) by PA6PR05MB11361[.]eurprd05[.]prod[.]outlook[.]com with HTTPS; Mon, 30 Sep 2024 12[:]19[:]04 +0000 Received[:] from DUZPR01CA0049[.]eurprd01[.]prod[.]exchangelabs[.]com (2603[:]10a6[:]10[:]469[::]9) by AS2PR05MB10846[.]eurprd05[.]prod[.]outlook[.]com (2603[:]10a6[:]20b[:]64c[::]6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15[.]20[.]7982[.]32; Mon, 30 Sep 2024 12[:]15[:]52 +0000 Received[:] from DU6PEPF0000A7DD[.]eurprd02[.]prod[.]outlook[.]com (2603[:]10a6[:]10[:]469[:]cafe[::]64) by DUZPR01CA0049[.]outlook[.]office365[.]com (2603[:]10a6[:]10[:]469[::]9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15[.]20[.]8005[.]26 via Frontend Transport; Mon, 30 Sep 2024 12[:]15[:]52 +0000 Received[:] from a39-215[.]smtp-out[.]amazonses[.]com (54[.]240[.]39[.]215) by DU6PEPF0000A7DD[.]mail[.]protection[.]outlook[.]com (10[.]167[.]8[.]37) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15[.]20[.]8026[.]11 via Frontend Transport; Mon, 30 Sep 2024 12[:]15[:]50 +0000 Authentication-Results[:] spf=pass (sender IP is 54[.]240[.]39[.]215) smtp[.]mailfrom=email[.]dropbox[.]com; dkim=pass (signature was verified) header[.]d=dropbox[.]com;dmarc=pass action=none header[.]from=dropbox[.]com;compauth=pass reason=100 Received-SPF[:] Pass (protection[.]outlook[.]com[:] domain of email[.]dropbox[.]com designates 54[.]240[.]39[.]215 as permitted sender) receiver=protection[.]outlook[.]com; client-ip=54[.]240[.]39[.]215; helo=a39-215[.]smtp-out[.]amazonses[.]com; pr=C DKIM-Signature[:] v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=wmgpbkvgcpmwlqchafzz6sobpgc5dg4h; d=dropbox[.]com; t=1727698549; h=Content-Type[:]MIME-Version[:]From[:]To[:]CC[:]Subject[:]Date[:]Message-ID[:]Reply-To; bh=r4RWjJS1BHHLoxjHEv/VgOz17tubX2fJpOqh2UEfSrw=; b=CsGh85LrAOi07DjJnAgWOTvIv0ztH6lZ/e1m/9h2pcI4HPhj0lrytS6+SwN0rYcH tWQGpX9n7cmiXwyhRvvPfZ4tywTgc9JfTLwOZrsiPVSyjs9W/hHzvaEs/tFlFFHB/um 7DytG0dgrl3wKyPaur9r1pDbzkdfXUAsfktprpgY= DKIM-Signature[:] v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses[.]com; t=1727698549; h=Content-Type[:]MIME-Version[:]From[:]To[:]CC[:]Subject[:]Date[:]Message-ID[:]Reply-To[:]Feedback-ID; bh=r4RWjJS1BHHLoxjHEv/VgOz17tubX2fJpOqh2UEfSrw=; b=YnQcT3GfJynLtWUkONmB91RqLcO9KuW2INoAJlU+7CVjyi+xCflB6abziRlL3lWa 2nB/2YBfZd5dmVTURTJRfAI0K5xmXJD710BKws0oc9BNvzIbLXmj2krFnaQGHmt6Wwq cQrEUrV5VC22oEvy0gyrsfl+AB/urUAmVyAUQ0qM= Content-Type[:] multipart/alternative MIME-Version[:] 1[.]0 From[:] "Dropbox" <no-reply@dropbox[.]com> To[:] <dellaqui@unhcr[.]org> Subject[:] Salimata Thierno KAH shared "PO 20828 by Terre des hommes[.]pdf" with you Date[:] Mon, 30 Sep 2024 12[:]15[:]49 +0000 Message-ID[:] <0100019242dbb9aa-7a9f9bdb-3931-4639-91b7-25205855930a-000000@email[.]amazonses[.]com> X-Dropbox-Message-ID[:] 14060268333819016136 Reply-To[:] <no-reply@dropbox[.]com> x-cid[:] 20004268 Feedback-ID[:] 20004268[::]1[.]us-east-1[.]syWQ1+fF8Wo1tY8y/+s85ptiAKu7bILK6PHyxwpB+xo=[:]AmazonSES X-SES-Outgoing[:] 2024[.]09[.]30-54[.]240[.]39[.]215 Return-Path[:] 0100019242dbb9aa-7a9f9bdb-3931-4639-91b7-25205855930a-000000@email[.]dropbox[.]com X-MS-Exchange-Organization-ExpirationStartTime[:] 30 Sep 2024 12[:]15[:]50[.]2800 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason[:] OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval[:] 1[:]00[:]00[:]00[.]0000000 X-MS-Exchange-Organization-ExpirationIntervalReason[:] OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id[:] a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-EOPAttributedMessage[:] 0 X-EOPTenantAttributedMessage[:] e5c37981-6664-4134-8a0c-6543d2af80be[:]0 X-MS-Exchange-Organization-MessageDirectionality[:] Incoming X-MS-PublicTrafficType[:] Email X-MS-TrafficTypeDiagnostic[:] DU6PEPF0000A7DD[:]EE_|AS2PR05MB10846[:]EE_|PA6PR05MB11361[:]EE_ X-MS-Exchange-Organization-AuthSource[:] DU6PEPF0000A7DD[.]eurprd02[.]prod[.]outlook[.]com X-MS-Exchange-Organization-AuthAs[:] Anonymous X-MS-Office365-Filtering-Correlation-Id[:] a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-MS-Exchange-AtpMessageProperties[:] SA|SL X-MS-Exchange-Organization-SCL[:] 1 X-Microsoft-Antispam[:] BCL[:]0;ARA[:]13230040|13102899012|13012899012|12012899012|3072899012|2092899012|32142699015|1032899013|5082899009|69100299015|3092899012|4092899012|6062899009|5062899012; X-Forefront-Antispam-Report[:] CIP[:]54[.]240[.]39[.]215;CTRY[:]US;LANG[:]en;SCL[:]1;SRV[:];IPV[:]NLI;SFV[:]NSPM;H[:]a39-215[.]smtp-out[.]amazonses[.]com;PTR[:]a39-215[.]smtp-out[.]amazonses[.]com;CAT[:]NONE;SFS[:](13230040)(13102899012)(13012899012)(12012899012)(3072899012)(2092899012)(32142699015)(1032899013)(5082899009)(69100299015)(3092899012)(4092899012)(6062899009)(5062899012);DIR[:]INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime[:] 30 Sep 2024 12[:]15[:]50[.]0769 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id[:] a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-MS-Exchange-CrossTenant-Id[:] e5c37981-6664-4134-8a0c-6543d2af80be X-MS-Exchange-CrossTenant-AuthSource[:] DU6PEPF0000A7DD[.]eurprd02[.]prod[.]outlook[.]com X-MS-Exchange-CrossTenant-AuthAs[:] Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader[:] Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped[:] AS2PR05MB10846 X-MS-Exchange-Transport-EndToEndLatency[:] 00[:]03[:]14[.]4918669 X-MS-Exchange-Processed-By-BccFoldering[:] 15[.]20[.]7982[.]022 X-Microsoft-Antispam-Mailbox-Delivery[:] ucf[:]0;jmr[:]0;auth[:]0;dest[:]I;ENG[:](910001)(944506478)(944626604)(920097)(930097)(140003)(1420198); X-Microsoft-Antispam-Message-Info[:] BgVl8nqrTdJyny17Os+qohotWhIYKP/QUN60t56TNnT6Gw7Mrns7Bxopa3v0G5+pGa39qIe+H0hujv3Ba1SBSe/YPZy0Xxgwmy/bDGAyKTw109v77Iyyn6GEPzkByIlj3DQs9l5sDJVmXI9yVE4/VSdonVNNRWnqljMXNrSHiNsI6nJZnS0OQaTi+wNufzrOzk+9Pynmkb8SFmjEvc3U8Bh6dVBB0s4C8DeVCqsAGch6ZQc/w6B03sYLEFGRr1VX7fZ8IcxdeaKNx07/NhbzInO9EVp+POc7xxhoYQItIVDsdfCvNBxMOarGA09qCccIp4P+QJmyilAEifAm2Z1EwY7JHhya9vzkAaLeB7JfmLxPEgA+KOoFNq/SXInc560VIGUcTMuCApqi0gic4xjrbmOBWusy4HE5kDO1y+sbJyvzp1ZbWqTEEDJThtH3wksgdd1ptnU96/fcpm+x3aRHB3bniUKlxB/uVHUrkiBSw3Do6kUJ4c7Og08bbY7/eTWMQ4yjyLBPWGC/AIGeUsHoPzMdp4+zTjU3yNlMcNkpef0kqe5zbflBGJ/06dObvkdn3i6S9L4tRO1adC96I8S0kxrRXjE9nDF+KsVDYxELxPAQzxNe4bGh6LC5izLtVMTi9XInW314ttngv5yzlNCGZgLXWrMKMp3FfJIK12lRKswc+sqolIaP/lgKQRU9XugA5nzetQykLEt2dfNkrZtxUUQ55gjOoXv3KM8VOEgKptVDoOfvjkQp1M17wMhPS8kzzcZuKDRGkUNp3c0OGRKf0fdUi3doE9ls4QnX7y+UfxfkT71YfS3bOwXPSxI1M55dWusOCjZLvnyeUJH29p71rGjTVC4eXSu31lBQPZLG1RnSI6W+ZeNq7gOYHE1RYJNU4glChSI6wu7LgiUUTZP1GQZ72ivVVCIdA3IbbHEQzX1ScLiGDQ/HiIa03xIGq0RhXHlxVRI82wLhUs0QfdnkiYw/Gsc8OpO2v0DtdU0glyf98Nys/PdOdJRNdk6jNm5lPgAEOvNpMOtrwOrl1xZFD6ccyFu/wXFuyTXEUwTTb/WH7vZ4t7b87TytuLdOJGvDBR9fkIlaJa0HIlvI8hWcqo9l8NTCmMaQb+r461OwcSNqdC3YcuMRD7gNFPaSOP6SRYCq8mygDbwF2xsqwQji3UNBBYc+lm73bW+JUTdYNEVfGQomzrgWqPYTjJ99K6nrRSRQXO/2McvVvtTlnrDUEKmVuxhKjzQFQBM+s0dz0HGxYRrkQPaYqSt2/DfQVgYTf5og8GBO6BzHi30hlpfdZ3Nct8E7QHu89wcnWSIQ3PR/TtQebSn8agLNj+80MZXakXeI+DiWBfqae/43VL8JKGlvOgvx30MlYjFU53nKOW1jgbnpopAwwD0XXVLsU1LdOCva4WJc6FQxCpO9q70LWPMCdbeHrwTl6sdiuYS3vdBuFq5uKYG79YPMZ1VvMWF0DzeEu+2BJhYMfiUWdty+C5XvdNd09iDkwVGRrC7vVP6+Vf3kIRxLgCb+wOInQ3vGlkHwrs4uUSzbf5Zds80NHfV/ouDoVOJNKcM61IoH8EP3MSkTCej2H+KRuA2RKiHsj4ZliJ0xcMPzsfHJCxf8g6fbk3Gj5DPfa4powO8SGjTKJIEmQ13+FNSENfrlWReCdCneHpnDp68nlU6oFhe9+x2ovRwQDqgH+v8xNQiuUHjyF2n/x+kmYysOgHGptzzTj0jtdcUt8zTOVSM2w7+LDIY/sdmOJ+P0KuPQ3NbSBawJAkef4fY6g9lZqBqfTyKRL951+nbCvJaZYM07buwTZDkLb3rr0DEHoB99/OhKe4UrmTldxf9okl4Vo6GOZjT6Om8wnjd+Ja4bIkXtM9YNhXQ7rRkVkvpXZPtc9FJEySHu76E6BIWyrb5TIdW5gGFjZFCVuvIJlDJrCzAutnEjwIpomHblCfDHqgCP96xjMkfJS3echAekkFBrmh3+t+gjn+xqc8JAQ32kScT2qToA23Ll8D+5FYScmH50sKMAUCWQJRjv35XdZbfKWInCYZjNgqze8XPPQji5DTS+VQstQ7m8PbNlTAtc8Ke7efFIL4OZvhUKeEAy8JpmviUkWH+fEfvZh5Zu/+rxAOHo6rFJ4x1xk0i3UoVRv813SjfF5odJam8tIFVT95IHN4XU6tFLLZ1i2WRraCPjWj4tDECViBRbXoe6OccABTdh82kB8PfseBiP6FwPSXCFePH2b9gNpPKmNyDJND2LjSy9207/NKpDuYxH+xDESCidalfNJhc=

Sharing

Behavioral task

behavioral1

Sample

http://Received: from AS2PR05MB10846.eurprd05.prod.outlook.com (2603:10a6:20b:64c::6) by PA6PR05MB11361.eurprd05.prod.outlook.com with HTTPS; Mon, 30 Sep 2024 12:19:04 +0000 Received: from DUZPR01CA0049.eurprd01.prod.exchangelabs.com (2603:10a6:10:469::9) by AS2PR05MB10846.eurprd05.prod.outlook.com (2603:10a6:20b:64c::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7982.32; Mon, 30 Sep 2024 12:15:52 +0000 Received: from DU6PEPF0000A7DD.eurprd02.prod.outlook.com (2603:10a6:10:469:cafe::64) by DUZPR01CA0049.outlook.office365.com (2603:10a6:10:469::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8005.26 via Frontend Transport; Mon, 30 Sep 2024 12:15:52 +0000 Received: from a39-215.smtp-out.amazonses.com (54.240.39.215) by DU6PEPF0000A7DD.mail.protection.outlook.com (10.167.8.37) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8026.11 via Frontend Transport; Mon, 30 Sep 2024 12:15:50 +0000 Authentication-Results: spf=pass (sender IP is 54.240.39.215) smtp.mailfrom=email.dropbox.com; dkim=pass (signature was verified) header.d=dropbox.com;dmarc=pass action=none header.from=dropbox.com;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of email.dropbox.com designates 54.240.39.215 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.39.215; helo=a39-215.smtp-out.amazonses.com; pr=C DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=wmgpbkvgcpmwlqchafzz6sobpgc5dg4h; d=dropbox.com; t=1727698549; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To; bh=r4RWjJS1BHHLoxjHEv/VgOz17tubX2fJpOqh2UEfSrw=; b=CsGh85LrAOi07DjJnAgWOTvIv0ztH6lZ/e1m/9h2pcI4HPhj0lrytS6+SwN0rYcH tWQGpX9n7cmiXwyhRvvPfZ4tywTgc9JfTLwOZrsiPVSyjs9W/hHzvaEs/tFlFFHB/um 7DytG0dgrl3wKyPaur9r1pDbzkdfXUAsfktprpgY= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1727698549; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To:Feedback-ID; bh=r4RWjJS1BHHLoxjHEv/VgOz17tubX2fJpOqh2UEfSrw=; b=YnQcT3GfJynLtWUkONmB91RqLcO9KuW2INoAJlU+7CVjyi+xCflB6abziRlL3lWa 2nB/2YBfZd5dmVTURTJRfAI0K5xmXJD710BKws0oc9BNvzIbLXmj2krFnaQGHmt6Wwq cQrEUrV5VC22oEvy0gyrsfl+AB/urUAmVyAUQ0qM= Content-Type: multipart/alternative MIME-Version: 1.0 From: "Dropbox" <[email protected]> To: <[email protected]> Subject: Salimata Thierno KAH shared "PO 20828 by Terre des hommes.pdf" with you Date: Mon, 30 Sep 2024 12:15:49 +0000 Message-ID: <0100019242dbb9aa-7a9f9bdb-3931-4639-91b7-25205855930a-000000@email.amazonses.com> X-Dropbox-Message-ID: 14060268333819016136 Reply-To: <[email protected]> x-cid: 20004268 Feedback-ID: 20004268::1.us-east-1.syWQ1+fF8Wo1tY8y/+s85ptiAKu7bILK6PHyxwpB+xo=:AmazonSES X-SES-Outgoing: 2024.09.30-54.240.39.215 Return-Path: 0100019242dbb9aa-7a9f9bdb-3931-4639-91b7-25205855930a-000000@email.dropbox.com X-MS-Exchange-Organization-ExpirationStartTime: 30 Sep 2024 12:15:50.2800 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: e5c37981-6664-4134-8a0c-6543d2af80be:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU6PEPF0000A7DD:EE_|AS2PR05MB10846:EE_|PA6PR05MB11361:EE_ X-MS-Exchange-Organization-AuthSource: DU6PEPF0000A7DD.eurprd02.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id: a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-MS-Exchange-AtpMessageProperties: SA|SL X-MS-Exchange-Organization-SCL: 1 X-Microsoft-Antispam: BCL:0;ARA:13230040|13102899012|13012899012|12012899012|3072899012|2092899012|32142699015|1032899013|5082899009|69100299015|3092899012|4092899012|6062899009|5062899012; X-Forefront-Antispam-Report: CIP:54.240.39.215;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:a39-215.smtp-out.amazonses.com;PTR:a39-215.smtp-out.amazonses.com;CAT:NONE;SFS:(13230040)(13102899012)(13012899012)(12012899012)(3072899012)(2092899012)(32142699015)(1032899013)(5082899009)(69100299015)(3092899012)(4092899012)(6062899009)(5062899012);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Sep 2024 12:15:50.0769 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-MS-Exchange-CrossTenant-Id: e5c37981-6664-4134-8a0c-6543d2af80be X-MS-Exchange-CrossTenant-AuthSource: DU6PEPF0000A7DD.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2PR05MB10846 X-MS-Exchange-Transport-EndToEndLatency: 00:03:14.4918669 X-MS-Exchange-Processed-By-BccFoldering: 15.20.7982.022 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198); X-Microsoft-Antispam-Message-Info: BgVl8nqrTdJyny17Os+qohotWhIYKP/QUN60t56TNnT6Gw7Mrns7Bxopa3v0G5+pGa39qIe+H0hujv3Ba1SBSe/YPZy0Xxgwmy/bDGAyKTw109v77Iyyn6GEPzkByIlj3DQs9l5sDJVmXI9yVE4/VSdonVNNRWnqljMXNrSHiNsI6nJZnS0OQaTi+wNufzrOzk+9Pynmkb8SFmjEvc3U8Bh6dVBB0s4C8DeVCqsAGch6ZQc/w6B03sYLEFGRr1VX7fZ8IcxdeaKNx07/NhbzInO9EVp+POc7xxhoYQItIVDsdfCvNBxMOarGA09qCccIp4P+QJmyilAEifAm2Z1EwY7JHhya9vzkAaLeB7JfmLxPEgA+KOoFNq/SXInc560VIGUcTMuCApqi0gic4xjrbmOBWusy4HE5kDO1y+sbJyvzp1ZbWqTEEDJThtH3wksgdd1ptnU96/fcpm+x3aRHB3bniUKlxB/uVHUrkiBSw3Do6kUJ4c7Og08bbY7/eTWMQ4yjyLBPWGC/AIGeUsHoPzMdp4+zTjU3yNlMcNkpef0kqe5zbflBGJ/06dObvkdn3i6S9L4tRO1adC96I8S0kxrRXjE9nDF+KsVDYxELxPAQzxNe4bGh6LC5izLtVMTi9XInW314ttngv5yzlNCGZgLXWrMKMp3FfJIK12lRKswc+sqolIaP/lgKQRU9XugA5nzetQykLEt2dfNkrZtxUUQ55gjOoXv3KM8VOEgKptVDoOfvjkQp1M17wMhPS8kzzcZuKDRGkUNp3c0OGRKf0fdUi3doE9ls4QnX7y+UfxfkT71YfS3bOwXPSxI1M55dWusOCjZLvnyeUJH29p71rGjTVC4eXSu31lBQPZLG1RnSI6W+ZeNq7gOYHE1RYJNU4glChSI6wu7LgiUUTZP1GQZ72ivVVCIdA3IbbHEQzX1ScLiGDQ/HiIa03xIGq0RhXHlxVRI82wLhUs0QfdnkiYw/Gsc8OpO2v0DtdU0glyf98Nys/PdOdJRNdk6jNm5lPgAEOvNpMOtrwOrl1xZFD6ccyFu/wXFuyTXEUwTTb/WH7vZ4t7b87TytuLdOJGvDBR9fkIlaJa0HIlvI8hWcqo9l8NTCmMaQb+r461OwcSNqdC3YcuMRD7gNFPaSOP6SRYCq8mygDbwF2xsqwQji3UNBBYc+lm73bW+JUTdYNEVfGQomzrgWqPYTjJ99K6nrRSRQXO/2McvVvtTlnrDUEKmVuxhKjzQFQBM+s0dz0HGxYRrkQPaYqSt2/DfQVgYTf5og8GBO6BzHi30hlpfdZ3Nct8E7QHu89wcnWSIQ3PR/TtQebSn8agLNj+80MZXakXeI+DiWBfqae/43VL8JKGlvOgvx30MlYjFU53nKOW1jgbnpopAwwD0XXVLsU1LdOCva4WJc6FQxCpO9q70LWPMCdbeHrwTl6sdiuYS3vdBuFq5uKYG79YPMZ1VvMWF0DzeEu+2BJhYMfiUWdty+C5XvdNd09iDkwVGRrC7vVP6+Vf3kIRxLgCb+wOInQ3vGlkHwrs4uUSzbf5Zds80NHfV/ouDoVOJNKcM61IoH8EP3MSkTCej2H+KRuA2RKiHsj4ZliJ0xcMPzsfHJCxf8g6fbk3Gj5DPfa4powO8SGjTKJIEmQ13+FNSENfrlWReCdCneHpnDp68nlU6oFhe9+x2ovRwQDqgH+v8xNQiuUHjyF2n/x+kmYysOgHGptzzTj0jtdcUt8zTOVSM2w7+LDIY/sdmOJ+P0KuPQ3NbSBawJAkef4fY6g9lZqBqfTyKRL951+nbCvJaZYM07buwTZDkLb3rr0DEHoB99/OhKe4UrmTldxf9okl4Vo6GOZjT6Om8wnjd+Ja4bIkXtM9YNhXQ7rRkVkvpXZPtc9FJEySHu76E6BIWyrb5TIdW5gGFjZFCVuvIJlDJrCzAutnEjwIpomHblCfDHqgCP96xjMkfJS3echAekkFBrmh3+t+gjn+xqc8JAQ32kScT2qToA23Ll8D+5FYScmH50sKMAUCWQJRjv35XdZbfKWInCYZjNgqze8XPPQji5DTS+VQstQ7m8PbNlTAtc8Ke7efFIL4OZvhUKeEAy8JpmviUkWH+fEfvZh5Zu/+rxAOHo6rFJ4x1xk0i3UoVRv813SjfF5odJam8tIFVT95IHN4XU6tFLLZ1i2WRraCPjWj4tDECViBRbXoe6OccABTdh82kB8PfseBiP6FwPSXCFePH2b9gNpPKmNyDJND2LjSy9207/NKpDuYxH+xDESCidalfNJhc=

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

10 signatures

150 seconds

General

Target

http://Received: from AS2PR05MB10846.eurprd05.prod.outlook.com (2603:10a6:20b:64c::6) by PA6PR05MB11361.eurprd05.prod.outlook.com with HTTPS; Mon, 30 Sep 2024 12:19:04 +0000 Received: from DUZPR01CA0049.eurprd01.prod.exchangelabs.com (2603:10a6:10:469::9) by AS2PR05MB10846.eurprd05.prod.outlook.com (2603:10a6:20b:64c::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7982.32; Mon, 30 Sep 2024 12:15:52 +0000 Received: from DU6PEPF0000A7DD.eurprd02.prod.outlook.com (2603:10a6:10:469:cafe::64) by DUZPR01CA0049.outlook.office365.com (2603:10a6:10:469::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8005.26 via Frontend Transport; Mon, 30 Sep 2024 12:15:52 +0000 Received: from a39-215.smtp-out.amazonses.com (54.240.39.215) by DU6PEPF0000A7DD.mail.protection.outlook.com (10.167.8.37) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8026.11 via Frontend Transport; Mon, 30 Sep 2024 12:15:50 +0000 Authentication-Results: spf=pass (sender IP is 54.240.39.215) smtp.mailfrom=email.dropbox.com; dkim=pass (signature was verified) header.d=dropbox.com;dmarc=pass action=none header.from=dropbox.com;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of email.dropbox.com designates 54.240.39.215 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.39.215; helo=a39-215.smtp-out.amazonses.com; pr=C DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=wmgpbkvgcpmwlqchafzz6sobpgc5dg4h; d=dropbox.com; t=1727698549; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To; bh=r4RWjJS1BHHLoxjHEv/VgOz17tubX2fJpOqh2UEfSrw=; b=CsGh85LrAOi07DjJnAgWOTvIv0ztH6lZ/e1m/9h2pcI4HPhj0lrytS6+SwN0rYcH tWQGpX9n7cmiXwyhRvvPfZ4tywTgc9JfTLwOZrsiPVSyjs9W/hHzvaEs/tFlFFHB/um 7DytG0dgrl3wKyPaur9r1pDbzkdfXUAsfktprpgY= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1727698549; h=Content-Type:MIME-Version:From:To:CC:Subject:Date:Message-ID:Reply-To:Feedback-ID; bh=r4RWjJS1BHHLoxjHEv/VgOz17tubX2fJpOqh2UEfSrw=; b=YnQcT3GfJynLtWUkONmB91RqLcO9KuW2INoAJlU+7CVjyi+xCflB6abziRlL3lWa 2nB/2YBfZd5dmVTURTJRfAI0K5xmXJD710BKws0oc9BNvzIbLXmj2krFnaQGHmt6Wwq cQrEUrV5VC22oEvy0gyrsfl+AB/urUAmVyAUQ0qM= Content-Type: multipart/alternative MIME-Version: 1.0 From: "Dropbox" <[email protected]> To: <[email protected]> Subject: Salimata Thierno KAH shared "PO 20828 by Terre des hommes.pdf" with you Date: Mon, 30 Sep 2024 12:15:49 +0000 Message-ID: <0100019242dbb9aa-7a9f9bdb-3931-4639-91b7-25205855930a-000000@email.amazonses.com> X-Dropbox-Message-ID: 14060268333819016136 Reply-To: <[email protected]> x-cid: 20004268 Feedback-ID: 20004268::1.us-east-1.syWQ1+fF8Wo1tY8y/+s85ptiAKu7bILK6PHyxwpB+xo=:AmazonSES X-SES-Outgoing: 2024.09.30-54.240.39.215 Return-Path: 0100019242dbb9aa-7a9f9bdb-3931-4639-91b7-25205855930a-000000@email.dropbox.com X-MS-Exchange-Organization-ExpirationStartTime: 30 Sep 2024 12:15:50.2800 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: e5c37981-6664-4134-8a0c-6543d2af80be:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU6PEPF0000A7DD:EE_|AS2PR05MB10846:EE_|PA6PR05MB11361:EE_ X-MS-Exchange-Organization-AuthSource: DU6PEPF0000A7DD.eurprd02.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id: a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-MS-Exchange-AtpMessageProperties: SA|SL X-MS-Exchange-Organization-SCL: 1 X-Microsoft-Antispam: BCL:0;ARA:13230040|13102899012|13012899012|12012899012|3072899012|2092899012|32142699015|1032899013|5082899009|69100299015|3092899012|4092899012|6062899009|5062899012; X-Forefront-Antispam-Report: CIP:54.240.39.215;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:a39-215.smtp-out.amazonses.com;PTR:a39-215.smtp-out.amazonses.com;CAT:NONE;SFS:(13230040)(13102899012)(13012899012)(12012899012)(3072899012)(2092899012)(32142699015)(1032899013)(5082899009)(69100299015)(3092899012)(4092899012)(6062899009)(5062899012);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Sep 2024 12:15:50.0769 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a662dda3-eeb4-4b40-9ba5-08dce1499f64 X-MS-Exchange-CrossTenant-Id: e5c37981-6664-4134-8a0c-6543d2af80be X-MS-Exchange-CrossTenant-AuthSource: DU6PEPF0000A7DD.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS2PR05MB10846 X-MS-Exchange-Transport-EndToEndLatency: 00:03:14.4918669 X-MS-Exchange-Processed-By-BccFoldering: 15.20.7982.022 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198); X-Microsoft-Antispam-Message-Info: BgVl8nqrTdJyny17Os+qohotWhIYKP/QUN60t56TNnT6Gw7Mrns7Bxopa3v0G5+pGa39qIe+H0hujv3Ba1SBSe/YPZy0Xxgwmy/bDGAyKTw109v77Iyyn6GEPzkByIlj3DQs9l5sDJVmXI9yVE4/VSdonVNNRWnqljMXNrSHiNsI6nJZnS0OQaTi+wNufzrOzk+9Pynmkb8SFmjEvc3U8Bh6dVBB0s4C8DeVCqsAGch6ZQc/w6B03sYLEFGRr1VX7fZ8IcxdeaKNx07/NhbzInO9EVp+POc7xxhoYQItIVDsdfCvNBxMOarGA09qCccIp4P+QJmyilAEifAm2Z1EwY7JHhya9vzkAaLeB7JfmLxPEgA+KOoFNq/SXInc560VIGUcTMuCApqi0gic4xjrbmOBWusy4HE5kDO1y+sbJyvzp1ZbWqTEEDJThtH3wksgdd1ptnU96/fcpm+x3aRHB3bniUKlxB/uVHUrkiBSw3Do6kUJ4c7Og08bbY7/eTWMQ4yjyLBPWGC/AIGeUsHoPzMdp4+zTjU3yNlMcNkpef0kqe5zbflBGJ/06dObvkdn3i6S9L4tRO1adC96I8S0kxrRXjE9nDF+KsVDYxELxPAQzxNe4bGh6LC5izLtVMTi9XInW314ttngv5yzlNCGZgLXWrMKMp3FfJIK12lRKswc+sqolIaP/lgKQRU9XugA5nzetQykLEt2dfNkrZtxUUQ55gjOoXv3KM8VOEgKptVDoOfvjkQp1M17wMhPS8kzzcZuKDRGkUNp3c0OGRKf0fdUi3doE9ls4QnX7y+UfxfkT71YfS3bOwXPSxI1M55dWusOCjZLvnyeUJH29p71rGjTVC4eXSu31lBQPZLG1RnSI6W+ZeNq7gOYHE1RYJNU4glChSI6wu7LgiUUTZP1GQZ72ivVVCIdA3IbbHEQzX1ScLiGDQ/HiIa03xIGq0RhXHlxVRI82wLhUs0QfdnkiYw/Gsc8OpO2v0DtdU0glyf98Nys/PdOdJRNdk6jNm5lPgAEOvNpMOtrwOrl1xZFD6ccyFu/wXFuyTXEUwTTb/WH7vZ4t7b87TytuLdOJGvDBR9fkIlaJa0HIlvI8hWcqo9l8NTCmMaQb+r461OwcSNqdC3YcuMRD7gNFPaSOP6SRYCq8mygDbwF2xsqwQji3UNBBYc+lm73bW+JUTdYNEVfGQomzrgWqPYTjJ99K6nrRSRQXO/2McvVvtTlnrDUEKmVuxhKjzQFQBM+s0dz0HGxYRrkQPaYqSt2/DfQVgYTf5og8GBO6BzHi30hlpfdZ3Nct8E7QHu89wcnWSIQ3PR/TtQebSn8agLNj+80MZXakXeI+DiWBfqae/43VL8JKGlvOgvx30MlYjFU53nKOW1jgbnpopAwwD0XXVLsU1LdOCva4WJc6FQxCpO9q70LWPMCdbeHrwTl6sdiuYS3vdBuFq5uKYG79YPMZ1VvMWF0DzeEu+2BJhYMfiUWdty+C5XvdNd09iDkwVGRrC7vVP6+Vf3kIRxLgCb+wOInQ3vGlkHwrs4uUSzbf5Zds80NHfV/ouDoVOJNKcM61IoH8EP3MSkTCej2H+KRuA2RKiHsj4ZliJ0xcMPzsfHJCxf8g6fbk3Gj5DPfa4powO8SGjTKJIEmQ13+FNSENfrlWReCdCneHpnDp68nlU6oFhe9+x2ovRwQDqgH+v8xNQiuUHjyF2n/x+kmYysOgHGptzzTj0jtdcUt8zTOVSM2w7+LDIY/sdmOJ+P0KuPQ3NbSBawJAkef4fY6g9lZqBqfTyKRL951+nbCvJaZYM07buwTZDkLb3rr0DEHoB99/OhKe4UrmTldxf9okl4Vo6GOZjT6Om8wnjd+Ja4bIkXtM9YNhXQ7rRkVkvpXZPtc9FJEySHu76E6BIWyrb5TIdW5gGFjZFCVuvIJlDJrCzAutnEjwIpomHblCfDHqgCP96xjMkfJS3echAekkFBrmh3+t+gjn+xqc8JAQ32kScT2qToA23Ll8D+5FYScmH50sKMAUCWQJRjv35XdZbfKWInCYZjNgqze8XPPQji5DTS+VQstQ7m8PbNlTAtc8Ke7efFIL4OZvhUKeEAy8JpmviUkWH+fEfvZh5Zu/+rxAOHo6rFJ4x1xk0i3UoVRv813SjfF5odJam8tIFVT95IHN4XU6tFLLZ1i2WRraCPjWj4tDECViBRbXoe6OccABTdh82kB8PfseBiP6FwPSXCFePH2b9gNpPKmNyDJND2LjSy9207/NKpDuYxH+xDESCidalfNJhc=

Sharing

General

Malware Config

Signatures

Files