Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
original.eml

Overview

General Information

Sample name:original.eml
Analysis ID:1544102
MD5:88047537979e632ec8d1e5d6dec8b72a
SHA1:3eb58a8d975b0b736922a4d0077f4723adbc74f1
SHA256:dd9e787922873fe8ee7804daeb833f46976fb8109df09234af9d1dfe2ec953f5
Infos:

Detection

HTMLPhisher
Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected BlockedWebSite
AI detected potential phishing Email
Form action URLs do not match main URL
HTML body contains low number of good links
HTML page contains hidden javascript code
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Sigma detected: Outlook Security Settings Updated - Registry
Stores files to the Windows start menu directory

Classification

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6184 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6932 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7B1442F0-55D6-4BAD-931F-DA475EE3BF95" "64333B67-ABFC-4F52-A152-DCB61019BB7F" "6184" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • OUTLOOK.EXE (PID: 6436 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\LZC2TRC0\phish_alert_iocp_v1.10.14.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJsZOR3zl3qdm-2FBOw2Zzi39U0e-2BiGHcp9UGL9bzKcpwVI7NZSH6ys9u8tBZmKDm8YMxv0SPoF7n-2FGVWBMLQZJknp7npaB4k4oWne4wM-2BwNFySIXowjwbvlImgBskjU14j81dFoTc4ehn0B3xp0Vxf4XyyOxLI9qZOhXbXTIC5Sq7vENcfxQUz5mrjHGw8ENR7CaCeUC1JQKvW0sN-2BcqYL-2BfwYC6KKR3Io9R496QjL3yZqmFqOVJ2uw-2Blr-2FEyaJV6oJuP8wilbiBCo1aMD7GSFE-2Fhng7yeOjQz3w1hpvl6jvZhuZC26XUfHMQuS-2FkyRYPZI7Rgdg4TGrD4t9MPXlD3llzaf2NunLoNPyaKC72-2BngErdKIdQ42woOxjcMlziHckC16LYGL6HKVHyd6bsi0iTV33Eu8UBvZ-2FX3ULZgW2siOjr2foW-2FkBA2cq8Sq1JX7Rvy8Oc50-2FB9Uk7242c2g2DrJ8CyONleGCMJTeaUiRmImG5c4c9s2KY3oU66uXHg7W72THESxxKRhlbXtd2zrTleHLj5TNJxQy7JrvVvzLCO-2FS5c4Xd0uGn-2Bcj44W92S1RIXTkGqMZH69Txa-2BH-2FRb3-2B7s-3DOWcG_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjx2F1ZyDWKg2x1R8YehQOiyOOoX7o4msmGj-2FfhJBNMSvYAGvW-2FpeiNryciQrAk47hDfMZRAsVqtTcLbP-2Bh0aKiTg4yXWztI5feL6E9fbXlYYo9R-2BvL-2BqoLc7ouZIjL966vz-2BTDEc-2FxDSaGSV9Bq4C7s-2F5l5YAPimsFR-2BaBm7mGcoXZXDkZIl-2FqSkJnd7mu70G-2B-2B64EZRy3-2BhKrA-2FGdyiuv5&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467060009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=3vCb3GIQZq46rWOf%2FSfuqpQiawnnTxJ6DMn7YSGXgvI%3D&reserved=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 2976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1944,i,4544462099327451466,4235742704065504099,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 7808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJuF1fzexsJJN-2FxAklcI9L-2B04nMIN9-2FO01J-2BEQaEiWrWmi-2B6zeKPc1HXcPIi3O-2F1v98PsnmLsfizgioFhlqdhVbByQS4FtjRND39BHA178u7vnlQFEDvl6xjwIGVibX4bwoyAlVrJkv6e3cIyS3grZRA-2BUOK0hwFk3OjJ7Ve3ZUiH3CfaHBLhhAHI2r-2F45rDbFUSFOn30PTeBkCiy6HPXzkdc9OhgrIXgbumAy4BVCjcKeeJRqOvWiUbZHfQQwx69FdM2cPjvB95P9VnfDOSUtfj1LWSf2cu-2FFU5ACtiHv7WXoqLF2e2-2FmMDjIOnZKjtZMaeWDXRvh-2FloCPHJtixQ53-2BhXtoao06ipfoKqc60CAS6Kmj4MP0V-2Bnqx0BiHmnt2FHd1CepThOf91Br65Xig1EPxbBHFhioIF4d76VKeh3-2B2Xs1NF0H6xF9Il-2Fl1krLNF3F6MxL3UMYWmMP3xcCDwKfkHGO-2B0pKRqYa4pCjg4YrI9x4o5QMvToL1dbY0JTWk4yiqBt3olycDj7j-2FS-2FCOtzZ0VaIlD4-2FkqimS5zSw0bv6IST1p1-2BAu-2FmB2jfxd5iQ64aKQ4DX7p46CGFeY5AAoqITpMBvtxBac8i2bHNjOZnsMJSn3hr9vwuwaFgOpggWSMPNuAS3vzfLorNjhsWia86KSBnSdw9C6c1-2FP0uE0004cYua4oV75RyYQaWru6ZxCk7YraIgBGreJMeXXXjbXNjthKnNVkBQLDwRt-2BzC2BxzyPMA-2FtcAqKzwOffXqY6zaA-3D-3D30T2_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjzOHV9Dm9j2qKN3lpmn8XoSOLUSeXmOHtdwAU5S5jKweXQcz4otjNvDP9TxClPnOU9Dnv-2BiHV6H5SwyUnQNqLdWpBXLrTgDNrrwZelHgU2zJ6g0ilzoRizpJ0eeQuM1qUCriQureMO5iOW2ZDDuKNT1VZ0Bt8miWc1z4-2FLDHuLfcUhiuZYx-2FJc1jLw-2Fs4s-2Ft5-2Bdaa3lXraJLkA9VVBrdPPN&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467115402%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=gNfchtyL0mej7HoT46SsBGya4C%2BfS8tz7Ms2VORDqFc%3D&reserved=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 7988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1888,i,11561217143075156554,16628899830142311202,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 2272 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJp-2FCsAIUvPIm7Cs0XVjeG1Yc-2BOs4KQUjD3bMJYDFibsw7h-2BhmSr1Bf4B2Ckje2taqbBkxQa3Xp-2BcdUFVZriOF3mYWEkodHuxCs5gnzuPP41MG6YOrV-2FiB3FDItQytQ8WeNua4sXWyR0zFMxQUR4EwRVy-2FDCyAUdaLpML4yXPC-2FGer4QtrlYAJuIVT4kKSYxD2aapMfWulWJLWVmftTqTUokW7aXV02yKaEzsL0JsXQinte3JD4-2BVxu3Mrh31R4c3HF6FvKYG6xP2aVO-2F-2BIVLRiw08W2t0uu7WZKVENfD9Bfe84AdMAK9Lti6iua7iVVY0vxDciVnvOPh83Ww9XpdJVyStdf8H7UbLSBP7aRZ3oqrriHUdSHOxFEl56vkFMwnltIWCKCkxq5BgV60BPmZyMF2DD-2FF3U6KLXFiGe2gQ1kqUPkFGg2q9BHb7S4-2BcbsXmMoSZsrPsHbBg2yxGiw7yLbOnRk5o0lZM383VwMIkG53XAJDmoHQ-2By7GDa16wQgHfK62Zpib1C-2FSAFAsfpR-2BnP3p2a4DysXIBiMNUazVZ7ne0W5erjZH-2BKRr-2FNk2FHuaT8oarTmiPVdnJ4V4W-2BpG-2FRgvfX9Ev0h5Xy9JAkqPq7sF-2BPAerjL8kf2dhJ0Kmh5RD9gL4qTX8B-2BlyIUA2byhvXWR3qDWcNsXn5xcs7h-2FsrR4f_LO_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjywjzsfHU0mG362E6NSldUfIKfr4t6j3xkjPjFxWV6UUZadOSVmsX8szx6X4wIQBwEtkdg6R3Uth9mEAHQ-2FUKcGMeKkSo03x91uclNmMitkWCgJDnZ0ihD-2BSum9jSXrC-2FC4tD5m1jgGPmLspGbcQlys56zA8ILxq8xzxDWUH7wztW9CYznD3NS2BxJE-2Fzvorlr0XMa5sKkJEAndNKcYZjuI&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467091929%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=f%2FtC4JIvayC1oPVO7MbbCF3dE6BMulmUAsuz3j3rXeg%3D&reserved=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 2176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1940,i,13066455562052504819,862893157539813335,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • chrome.exe (PID: 1632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzBkzp1qcpeciwBazOuWwNMNCXnilnleTA006iucL9Sy3rTM-2FY3gIcCbdRwd-2BeXdyyZJ3CfBRdq3trYR11I-2F5OBdfbQ6D4ghg3teSNhnfuGVTvjx1gYJRD06Nt13yULPF8SCNjxv1bgrcHa93RLYhNId2yvcEYk8qTl6IrekoaHGVH-2F3NhTlh7tOohhQoWdz66u-2F8xf-2FXENOIvBLwSXzGROTUwGOEIY-2Boh3NcYuDwzuA0wXloEPO6Ofr94Iv548avY2rb9z181ZPHxsLuBcTKa5A-3DRuxL_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjylAa2sMo0TgnlAsux1Fyd-2F8wkUOYTgiggQ0Qanc5qMYBOl7-2B2mfaGT-2F-2BH7mVmNX-2Fh6t9pwse1grrQrdKlR3dvyKyp8rPGRJpO95k80XyiWscU8RRH4P4nlqiau8cIBMJgdelKtu20ZzdAlvIkZWVop-2BPx-2BzONj9DTBQnzu2qJDxuzLLuWNBiRzh1hEz3dYUkAMYrVPSLb0m9O40aOglqfY&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467135875%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=q03q9s4%2Bl%2FNV6U82ZSdsWo5u6Mxm2Yyt%2Fch%2B6K%2B%2FrOk%3D&reserved=0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • chrome.exe (PID: 7732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1144 --field-trial-handle=1984,i,2771145374696718087,16413706463471607817,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
  • cleanup
SourceRuleDescriptionAuthorStrings
1.1.pages.csvJoeSecurity_BlockedWebSiteYara detected BlockedWebSiteJoe Security
    0.0.pages.csvJoeSecurity_BlockedWebSiteYara detected BlockedWebSiteJoe Security
      4.5.pages.csvJoeSecurity_BlockedWebSiteYara detected BlockedWebSiteJoe Security
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6184, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1
        Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\LZC2TRC0\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6184, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        Phishing

        barindex
        Source: Yara matchFile source: 1.1.pages.csv, type: HTML
        Source: Yara matchFile source: 0.0.pages.csv, type: HTML
        Source: Yara matchFile source: 4.5.pages.csv, type: HTML
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638657393229527508.NTQ4YzBiN2EtNGVlNy00OGNiLTkyZmItNjhkMTJmMDAxZTMxMjc5NGUxYjQtNjZjZS00ZDEwLWJjY2YtNzEyM2UzNzI3YmY0&prompt=none&nopa=2&state=CfDJ8C0ohqf0LPdLoRrMGwogAwxb2IsTBn0fjSew4QX4eMfrNLByYGFxFdg2necq3UnuD9-N5LJfN--MgzcBFI2RrY8az59tCKL4pkLYlO50_lYkk5E9XRxUOxrImKFQ5Udjl5M9QmqObNsMeAyWMozJJ7w2osQYHzX3o-jjX6oEMXfp9VdiVNlZbsEX-4FJObxeJXUZ-RDxiTBsr4HslytetufXJLlEcGkuT20VwzxouV4RT6t3R70wlFYi_qKP4Ad1Xxk7XsIv7vd1YaB8kMTclPRMGg_EuocgoTe0TUldbeGtonbcnS7lmfCSDxRVvIpCFzOFHNxZ_CZJV2v5TKYbnlk8AcPaG9msMJHW7z63C9OO&x-client-SKU=ID_NET6_0&x-client-ver=8.0.2.0&sso_reload=true microsoft microsoftonline
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: Number of links: 0
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: Base64 decoded: 548c0b7a-4ee7-48cb-92fb-68d12f001e312794e1b4-66ce-4d10-bccf-7123e3727bf4
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: Title: Redirecting does not match URL
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: No favicon
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: No favicon
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: No favicon
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: No favicon
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: No <meta name="author".. found
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: No <meta name="author".. found
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: No <meta name="copyright".. found
        Source: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9cHTTP Parser: No <meta name="copyright".. found
        Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49709 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49717 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49718 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49738 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.17:49879 version: TLS 1.2
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 4.245.163.56
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.200
        Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
        Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
        Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
        Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
        Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
        Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.13
        Source: global trafficDNS traffic detected: DNS query: can01.safelinks.protection.outlook.com
        Source: global trafficDNS traffic detected: DNS query: www.google.com
        Source: global trafficDNS traffic detected: DNS query: support.content.office.net
        Source: global trafficDNS traffic detected: DNS query: c.s-microsoft.com
        Source: global trafficDNS traffic detected: DNS query: js.monitor.azure.com
        Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
        Source: global trafficDNS traffic detected: DNS query: mem.gfx.ms
        Source: global trafficDNS traffic detected: DNS query: login.microsoftonline.com
        Source: global trafficDNS traffic detected: DNS query: logincdn.msftauth.net
        Source: global trafficDNS traffic detected: DNS query: acctcdn.msftauth.net
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
        Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
        Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
        Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
        Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
        Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
        Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
        Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49691
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49690
        Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
        Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
        Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
        Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
        Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
        Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
        Source: unknownNetwork traffic detected: HTTP traffic on port 49680 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
        Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
        Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
        Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
        Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
        Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
        Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
        Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
        Source: unknownNetwork traffic detected: HTTP traffic on port 49691 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
        Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
        Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
        Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
        Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
        Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
        Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
        Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
        Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
        Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
        Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
        Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
        Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
        Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49690 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
        Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
        Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
        Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
        Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
        Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
        Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49709 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49717 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49718 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.17:49738 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.17:49879 version: TLS 1.2
        Source: classification engineClassification label: mal52.phis.winEML@43/13@34/283
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241028T1507550230-6184.etl
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
        Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7B1442F0-55D6-4BAD-931F-DA475EE3BF95" "64333B67-ABFC-4F52-A152-DCB61019BB7F" "6184" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\LZC2TRC0\phish_alert_iocp_v1.10.14.eml"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJsZOR3zl3qdm-2FBOw2Zzi39U0e-2BiGHcp9UGL9bzKcpwVI7NZSH6ys9u8tBZmKDm8YMxv0SPoF7n-2FGVWBMLQZJknp7npaB4k4oWne4wM-2BwNFySIXowjwbvlImgBskjU14j81dFoTc4ehn0B3xp0Vxf4XyyOxLI9qZOhXbXTIC5Sq7vENcfxQUz5mrjHGw8ENR7CaCeUC1JQKvW0sN-2BcqYL-2BfwYC6KKR3Io9R496QjL3yZqmFqOVJ2uw-2Blr-2FEyaJV6oJuP8wilbiBCo1aMD7GSFE-2Fhng7yeOjQz3w1hpvl6jvZhuZC26XUfHMQuS-2FkyRYPZI7Rgdg4TGrD4t9MPXlD3llzaf2NunLoNPyaKC72-2BngErdKIdQ42woOxjcMlziHckC16LYGL6HKVHyd6bsi0iTV33Eu8UBvZ-2FX3ULZgW2siOjr2foW-2FkBA2cq8Sq1JX7Rvy8Oc50-2FB9Uk7242c2g2DrJ8CyONleGCMJTeaUiRmImG5c4c9s2KY3oU66uXHg7W72THESxxKRhlbXtd2zrTleHLj5TNJxQy7JrvVvzLCO-2FS5c4Xd0uGn-2Bcj44W92S1RIXTkGqMZH69Txa-2BH-2FRb3-2B7s-3DOWcG_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjx2F1ZyDWKg2x1R8YehQOiyOOoX7o4msmGj-2FfhJBNMSvYAGvW-2FpeiNryciQrAk47hDfMZRAsVqtTcLbP-2Bh0aKiTg4yXWztI5feL6E9fbXlYYo9R-2BvL-2BqoLc7ouZIjL966vz-2BTDEc-2FxDSaGSV9Bq4C7s-2F5l5YAPimsFR-2BaBm7mGcoXZXDkZIl-2FqSkJnd7mu70G-2B-2B64EZRy3-2BhKrA-2FGdyiuv5&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467060009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=3vCb3GIQZq46rWOf%2FSfuqpQiawnnTxJ6DMn7YSGXgvI%3D&reserved=0
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1944,i,4544462099327451466,4235742704065504099,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJuF1fzexsJJN-2FxAklcI9L-2B04nMIN9-2FO01J-2BEQaEiWrWmi-2B6zeKPc1HXcPIi3O-2F1v98PsnmLsfizgioFhlqdhVbByQS4FtjRND39BHA178u7vnlQFEDvl6xjwIGVibX4bwoyAlVrJkv6e3cIyS3grZRA-2BUOK0hwFk3OjJ7Ve3ZUiH3CfaHBLhhAHI2r-2F45rDbFUSFOn30PTeBkCiy6HPXzkdc9OhgrIXgbumAy4BVCjcKeeJRqOvWiUbZHfQQwx69FdM2cPjvB95P9VnfDOSUtfj1LWSf2cu-2FFU5ACtiHv7WXoqLF2e2-2FmMDjIOnZKjtZMaeWDXRvh-2FloCPHJtixQ53-2BhXtoao06ipfoKqc60CAS6Kmj4MP0V-2Bnqx0BiHmnt2FHd1CepThOf91Br65Xig1EPxbBHFhioIF4d76VKeh3-2B2Xs1NF0H6xF9Il-2Fl1krLNF3F6MxL3UMYWmMP3xcCDwKfkHGO-2B0pKRqYa4pCjg4YrI9x4o5QMvToL1dbY0JTWk4yiqBt3olycDj7j-2FS-2FCOtzZ0VaIlD4-2FkqimS5zSw0bv6IST1p1-2BAu-2FmB2jfxd5iQ64aKQ4DX7p46CGFeY5AAoqITpMBvtxBac8i2bHNjOZnsMJSn3hr9vwuwaFgOpggWSMPNuAS3vzfLorNjhsWia86KSBnSdw9C6c1-2FP0uE0004cYua4oV75RyYQaWru6ZxCk7YraIgBGreJMeXXXjbXNjthKnNVkBQLDwRt-2BzC2BxzyPMA-2FtcAqKzwOffXqY6zaA-3D-3D30T2_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjzOHV9Dm9j2qKN3lpmn8XoSOLUSeXmOHtdwAU5S5jKweXQcz4otjNvDP9TxClPnOU9Dnv-2BiHV6H5SwyUnQNqLdWpBXLrTgDNrrwZelHgU2zJ6g0ilzoRizpJ0eeQuM1qUCriQureMO5iOW2ZDDuKNT1VZ0Bt8miWc1z4-2FLDHuLfcUhiuZYx-2FJc1jLw-2Fs4s-2Ft5-2Bdaa3lXraJLkA9VVBrdPPN&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467115402%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=gNfchtyL0mej7HoT46SsBGya4C%2BfS8tz7Ms2VORDqFc%3D&reserved=0
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1888,i,11561217143075156554,16628899830142311202,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "7B1442F0-55D6-4BAD-931F-DA475EE3BF95" "64333B67-ABFC-4F52-A152-DCB61019BB7F" "6184" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\LZC2TRC0\phish_alert_iocp_v1.10.14.eml"
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJsZOR3zl3qdm-2FBOw2Zzi39U0e-2BiGHcp9UGL9bzKcpwVI7NZSH6ys9u8tBZmKDm8YMxv0SPoF7n-2FGVWBMLQZJknp7npaB4k4oWne4wM-2BwNFySIXowjwbvlImgBskjU14j81dFoTc4ehn0B3xp0Vxf4XyyOxLI9qZOhXbXTIC5Sq7vENcfxQUz5mrjHGw8ENR7CaCeUC1JQKvW0sN-2BcqYL-2BfwYC6KKR3Io9R496QjL3yZqmFqOVJ2uw-2Blr-2FEyaJV6oJuP8wilbiBCo1aMD7GSFE-2Fhng7yeOjQz3w1hpvl6jvZhuZC26XUfHMQuS-2FkyRYPZI7Rgdg4TGrD4t9MPXlD3llzaf2NunLoNPyaKC72-2BngErdKIdQ42woOxjcMlziHckC16LYGL6HKVHyd6bsi0iTV33Eu8UBvZ-2FX3ULZgW2siOjr2foW-2FkBA2cq8Sq1JX7Rvy8Oc50-2FB9Uk7242c2g2DrJ8CyONleGCMJTeaUiRmImG5c4c9s2KY3oU66uXHg7W72THESxxKRhlbXtd2zrTleHLj5TNJxQy7JrvVvzLCO-2FS5c4Xd0uGn-2Bcj44W92S1RIXTkGqMZH69Txa-2BH-2FRb3-2B7s-3DOWcG_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjx2F1ZyDWKg2x1R8YehQOiyOOoX7o4msmGj-2FfhJBNMSvYAGvW-2FpeiNryciQrAk47hDfMZRAsVqtTcLbP-2Bh0aKiTg4yXWztI5feL6E9fbXlYYo9R-2BvL-2BqoLc7ouZIjL966vz-2BTDEc-2FxDSaGSV9Bq4C7s-2F5l5YAPimsFR-2BaBm7mGcoXZXDkZIl-2FqSkJnd7mu70G-2B-2B64EZRy3-2BhKrA-2FGdyiuv5&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467060009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=3vCb3GIQZq46rWOf%2FSfuqpQiawnnTxJ6DMn7YSGXgvI%3D&reserved=0
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1944,i,4544462099327451466,4235742704065504099,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJuF1fzexsJJN-2FxAklcI9L-2B04nMIN9-2FO01J-2BEQaEiWrWmi-2B6zeKPc1HXcPIi3O-2F1v98PsnmLsfizgioFhlqdhVbByQS4FtjRND39BHA178u7vnlQFEDvl6xjwIGVibX4bwoyAlVrJkv6e3cIyS3grZRA-2BUOK0hwFk3OjJ7Ve3ZUiH3CfaHBLhhAHI2r-2F45rDbFUSFOn30PTeBkCiy6HPXzkdc9OhgrIXgbumAy4BVCjcKeeJRqOvWiUbZHfQQwx69FdM2cPjvB95P9VnfDOSUtfj1LWSf2cu-2FFU5ACtiHv7WXoqLF2e2-2FmMDjIOnZKjtZMaeWDXRvh-2FloCPHJtixQ53-2BhXtoao06ipfoKqc60CAS6Kmj4MP0V-2Bnqx0BiHmnt2FHd1CepThOf91Br65Xig1EPxbBHFhioIF4d76VKeh3-2B2Xs1NF0H6xF9Il-2Fl1krLNF3F6MxL3UMYWmMP3xcCDwKfkHGO-2B0pKRqYa4pCjg4YrI9x4o5QMvToL1dbY0JTWk4yiqBt3olycDj7j-2FS-2FCOtzZ0VaIlD4-2FkqimS5zSw0bv6IST1p1-2BAu-2FmB2jfxd5iQ64aKQ4DX7p46CGFeY5AAoqITpMBvtxBac8i2bHNjOZnsMJSn3hr9vwuwaFgOpggWSMPNuAS3vzfLorNjhsWia86KSBnSdw9C6c1-2FP0uE0004cYua4oV75RyYQaWru6ZxCk7YraIgBGreJMeXXXjbXNjthKnNVkBQLDwRt-2BzC2BxzyPMA-2FtcAqKzwOffXqY6zaA-3D-3D30T2_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjzOHV9Dm9j2qKN3lpmn8XoSOLUSeXmOHtdwAU5S5jKweXQcz4otjNvDP9TxClPnOU9Dnv-2BiHV6H5SwyUnQNqLdWpBXLrTgDNrrwZelHgU2zJ6g0ilzoRizpJ0eeQuM1qUCriQureMO5iOW2ZDDuKNT1VZ0Bt8miWc1z4-2FLDHuLfcUhiuZYx-2FJc1jLw-2Fs4s-2Ft5-2Bdaa3lXraJLkA9VVBrdPPN&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467115402%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=gNfchtyL0mej7HoT46SsBGya4C%2BfS8tz7Ms2VORDqFc%3D&reserved=0
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1888,i,11561217143075156554,16628899830142311202,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJp-2FCsAIUvPIm7Cs0XVjeG1Yc-2BOs4KQUjD3bMJYDFibsw7h-2BhmSr1Bf4B2Ckje2taqbBkxQa3Xp-2BcdUFVZriOF3mYWEkodHuxCs5gnzuPP41MG6YOrV-2FiB3FDItQytQ8WeNua4sXWyR0zFMxQUR4EwRVy-2FDCyAUdaLpML4yXPC-2FGer4QtrlYAJuIVT4kKSYxD2aapMfWulWJLWVmftTqTUokW7aXV02yKaEzsL0JsXQinte3JD4-2BVxu3Mrh31R4c3HF6FvKYG6xP2aVO-2F-2BIVLRiw08W2t0uu7WZKVENfD9Bfe84AdMAK9Lti6iua7iVVY0vxDciVnvOPh83Ww9XpdJVyStdf8H7UbLSBP7aRZ3oqrriHUdSHOxFEl56vkFMwnltIWCKCkxq5BgV60BPmZyMF2DD-2FF3U6KLXFiGe2gQ1kqUPkFGg2q9BHb7S4-2BcbsXmMoSZsrPsHbBg2yxGiw7yLbOnRk5o0lZM383VwMIkG53XAJDmoHQ-2By7GDa16wQgHfK62Zpib1C-2FSAFAsfpR-2BnP3p2a4DysXIBiMNUazVZ7ne0W5erjZH-2BKRr-2FNk2FHuaT8oarTmiPVdnJ4V4W-2BpG-2FRgvfX9Ev0h5Xy9JAkqPq7sF-2BPAerjL8kf2dhJ0Kmh5RD9gL4qTX8B-2BlyIUA2byhvXWR3qDWcNsXn5xcs7h-2FsrR4f_LO_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjywjzsfHU0mG362E6NSldUfIKfr4t6j3xkjPjFxWV6UUZadOSVmsX8szx6X4wIQBwEtkdg6R3Uth9mEAHQ-2FUKcGMeKkSo03x91uclNmMitkWCgJDnZ0ihD-2BSum9jSXrC-2FC4tD5m1jgGPmLspGbcQlys56zA8ILxq8xzxDWUH7wztW9CYznD3NS2BxJE-2Fzvorlr0XMa5sKkJEAndNKcYZjuI&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467091929%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=f%2FtC4JIvayC1oPVO7MbbCF3dE6BMulmUAsuz3j3rXeg%3D&reserved=0
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1940,i,13066455562052504819,862893157539813335,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJp-2FCsAIUvPIm7Cs0XVjeG1Yc-2BOs4KQUjD3bMJYDFibsw7h-2BhmSr1Bf4B2Ckje2taqbBkxQa3Xp-2BcdUFVZriOF3mYWEkodHuxCs5gnzuPP41MG6YOrV-2FiB3FDItQytQ8WeNua4sXWyR0zFMxQUR4EwRVy-2FDCyAUdaLpML4yXPC-2FGer4QtrlYAJuIVT4kKSYxD2aapMfWulWJLWVmftTqTUokW7aXV02yKaEzsL0JsXQinte3JD4-2BVxu3Mrh31R4c3HF6FvKYG6xP2aVO-2F-2BIVLRiw08W2t0uu7WZKVENfD9Bfe84AdMAK9Lti6iua7iVVY0vxDciVnvOPh83Ww9XpdJVyStdf8H7UbLSBP7aRZ3oqrriHUdSHOxFEl56vkFMwnltIWCKCkxq5BgV60BPmZyMF2DD-2FF3U6KLXFiGe2gQ1kqUPkFGg2q9BHb7S4-2BcbsXmMoSZsrPsHbBg2yxGiw7yLbOnRk5o0lZM383VwMIkG53XAJDmoHQ-2By7GDa16wQgHfK62Zpib1C-2FSAFAsfpR-2BnP3p2a4DysXIBiMNUazVZ7ne0W5erjZH-2BKRr-2FNk2FHuaT8oarTmiPVdnJ4V4W-2BpG-2FRgvfX9Ev0h5Xy9JAkqPq7sF-2BPAerjL8kf2dhJ0Kmh5RD9gL4qTX8B-2BlyIUA2byhvXWR3qDWcNsXn5xcs7h-2FsrR4f_LO_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjywjzsfHU0mG362E6NSldUfIKfr4t6j3xkjPjFxWV6UUZadOSVmsX8szx6X4wIQBwEtkdg6R3Uth9mEAHQ-2FUKcGMeKkSo03x91uclNmMitkWCgJDnZ0ihD-2BSum9jSXrC-2FC4tD5m1jgGPmLspGbcQlys56zA8ILxq8xzxDWUH7wztW9CYznD3NS2BxJE-2Fzvorlr0XMa5sKkJEAndNKcYZjuI&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467091929%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=f%2FtC4JIvayC1oPVO7MbbCF3dE6BMulmUAsuz3j3rXeg%3D&reserved=0
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1940,i,13066455562052504819,862893157539813335,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzBkzp1qcpeciwBazOuWwNMNCXnilnleTA006iucL9Sy3rTM-2FY3gIcCbdRwd-2BeXdyyZJ3CfBRdq3trYR11I-2F5OBdfbQ6D4ghg3teSNhnfuGVTvjx1gYJRD06Nt13yULPF8SCNjxv1bgrcHa93RLYhNId2yvcEYk8qTl6IrekoaHGVH-2F3NhTlh7tOohhQoWdz66u-2F8xf-2FXENOIvBLwSXzGROTUwGOEIY-2Boh3NcYuDwzuA0wXloEPO6Ofr94Iv548avY2rb9z181ZPHxsLuBcTKa5A-3DRuxL_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjylAa2sMo0TgnlAsux1Fyd-2F8wkUOYTgiggQ0Qanc5qMYBOl7-2B2mfaGT-2F-2BH7mVmNX-2Fh6t9pwse1grrQrdKlR3dvyKyp8rPGRJpO95k80XyiWscU8RRH4P4nlqiau8cIBMJgdelKtu20ZzdAlvIkZWVop-2BPx-2BzONj9DTBQnzu2qJDxuzLLuWNBiRzh1hEz3dYUkAMYrVPSLb0m9O40aOglqfY&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467135875%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=q03q9s4%2Bl%2FNV6U82ZSdsWo5u6Mxm2Yyt%2Fch%2B6K%2B%2FrOk%3D&reserved=0
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1144 --field-trial-handle=1984,i,2771145374696718087,16413706463471607817,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzBkzp1qcpeciwBazOuWwNMNCXnilnleTA006iucL9Sy3rTM-2FY3gIcCbdRwd-2BeXdyyZJ3CfBRdq3trYR11I-2F5OBdfbQ6D4ghg3teSNhnfuGVTvjx1gYJRD06Nt13yULPF8SCNjxv1bgrcHa93RLYhNId2yvcEYk8qTl6IrekoaHGVH-2F3NhTlh7tOohhQoWdz66u-2F8xf-2FXENOIvBLwSXzGROTUwGOEIY-2Boh3NcYuDwzuA0wXloEPO6Ofr94Iv548avY2rb9z181ZPHxsLuBcTKa5A-3DRuxL_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjylAa2sMo0TgnlAsux1Fyd-2F8wkUOYTgiggQ0Qanc5qMYBOl7-2B2mfaGT-2F-2BH7mVmNX-2Fh6t9pwse1grrQrdKlR3dvyKyp8rPGRJpO95k80XyiWscU8RRH4P4nlqiau8cIBMJgdelKtu20ZzdAlvIkZWVop-2BPx-2BzONj9DTBQnzu2qJDxuzLLuWNBiRzh1hEz3dYUkAMYrVPSLb0m9O40aOglqfY&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467135875%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=q03q9s4%2Bl%2FNV6U82ZSdsWo5u6Mxm2Yyt%2Fch%2B6K%2B%2FrOk%3D&reserved=0
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1144 --field-trial-handle=1984,i,2771145374696718087,16413706463471607817,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

        Persistence and Installation Behavior

        barindex
        Source: EmailLLM: Detected potential phishing email: The email contains suspicious long tracking URLs with multiple redirects and encoded parameters
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
        Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
        Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire Infrastructure1
        Drive-by Compromise
        Windows Management Instrumentation1
        Browser Extensions
        1
        Process Injection
        1
        Masquerading
        OS Credential Dumping1
        Process Discovery
        Remote ServicesData from Local System2
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        DLL Side-Loading
        1
        DLL Side-Loading
        1
        Process Injection
        LSASS Memory1
        File and Directory Discovery
        Remote Desktop ProtocolData from Removable Media1
        Non-Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt1
        Registry Run Keys / Startup Folder
        1
        Registry Run Keys / Startup Folder
        1
        DLL Side-Loading
        Security Account Manager13
        System Information Discovery
        SMB/Windows Admin SharesData from Network Shared Drive2
        Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches
        NameIPActiveMaliciousAntivirus DetectionReputation
        can01.safelinks.eop-tm2.outlook.com
        52.102.11.124
        truefalse
          unknown
          s-part-0023.t-0009.t-msedge.net
          13.107.246.51
          truefalse
            unknown
            sni1gl.wpc.alphacdn.net
            152.199.21.175
            truefalse
              unknown
              s-part-0015.t-0009.t-msedge.net
              13.107.246.43
              truefalse
                unknown
                s-part-0017.t-0009.t-msedge.net
                13.107.246.45
                truefalse
                  unknown
                  sni1gl.wpc.omegacdn.net
                  152.199.21.175
                  truefalse
                    unknown
                    www.google.com
                    142.250.185.100
                    truefalse
                      unknown
                      s-part-0039.t-0009.t-msedge.net
                      13.107.246.67
                      truefalse
                        unknown
                        s-part-0032.t-0009.t-msedge.net
                        13.107.246.60
                        truefalse
                          unknown
                          js.monitor.azure.com
                          unknown
                          unknownfalse
                            unknown
                            can01.safelinks.protection.outlook.com
                            unknown
                            unknownfalse
                              unknown
                              c.s-microsoft.com
                              unknown
                              unknownfalse
                                unknown
                                support.content.office.net
                                unknown
                                unknownfalse
                                  unknown
                                  aadcdn.msftauth.net
                                  unknown
                                  unknownfalse
                                    unknown
                                    logincdn.msftauth.net
                                    unknown
                                    unknownfalse
                                      unknown
                                      login.microsoftonline.com
                                      unknown
                                      unknownfalse
                                        unknown
                                        acctcdn.msftauth.net
                                        unknown
                                        unknownfalse
                                          unknown
                                          mem.gfx.ms
                                          unknown
                                          unknownfalse
                                            unknown
                                            NameMaliciousAntivirus DetectionReputation
                                            https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzBkzp1qcpeciwBazOuWwNMNCXnilnleTA006iucL9Sy3rTM-2FY3gIcCbdRwd-2BeXdyyZJ3CfBRdq3trYR11I-2F5OBdfbQ6D4ghg3teSNhnfuGVTvjx1gYJRD06Nt13yULPF8SCNjxv1bgrcHa93RLYhNId2yvcEYk8qTl6IrekoaHGVH-2F3NhTlh7tOohhQoWdz66u-2F8xf-2FXENOIvBLwSXzGROTUwGOEIY-2Boh3NcYuDwzuA0wXloEPO6Ofr94Iv548avY2rb9z181ZPHxsLuBcTKa5A-3DRuxL_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjylAa2sMo0TgnlAsux1Fyd-2F8wkUOYTgiggQ0Qanc5qMYBOl7-2B2mfaGT-2F-2BH7mVmNX-2Fh6t9pwse1grrQrdKlR3dvyKyp8rPGRJpO95k80XyiWscU8RRH4P4nlqiau8cIBMJgdelKtu20ZzdAlvIkZWVop-2BPx-2BzONj9DTBQnzu2qJDxuzLLuWNBiRzh1hEz3dYUkAMYrVPSLb0m9O40aOglqfY&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467135875%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=q03q9s4%2Bl%2FNV6U82ZSdsWo5u6Mxm2Yyt%2Fch%2B6K%2B%2FrOk%3D&reserved=0false
                                              unknown
                                              https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJuF1fzexsJJN-2FxAklcI9L-2B04nMIN9-2FO01J-2BEQaEiWrWmi-2B6zeKPc1HXcPIi3O-2F1v98PsnmLsfizgioFhlqdhVbByQS4FtjRND39BHA178u7vnlQFEDvl6xjwIGVibX4bwoyAlVrJkv6e3cIyS3grZRA-2BUOK0hwFk3OjJ7Ve3ZUiH3CfaHBLhhAHI2r-2F45rDbFUSFOn30PTeBkCiy6HPXzkdc9OhgrIXgbumAy4BVCjcKeeJRqOvWiUbZHfQQwx69FdM2cPjvB95P9VnfDOSUtfj1LWSf2cu-2FFU5ACtiHv7WXoqLF2e2-2FmMDjIOnZKjtZMaeWDXRvh-2FloCPHJtixQ53-2BhXtoao06ipfoKqc60CAS6Kmj4MP0V-2Bnqx0BiHmnt2FHd1CepThOf91Br65Xig1EPxbBHFhioIF4d76VKeh3-2B2Xs1NF0H6xF9Il-2Fl1krLNF3F6MxL3UMYWmMP3xcCDwKfkHGO-2B0pKRqYa4pCjg4YrI9x4o5QMvToL1dbY0JTWk4yiqBt3olycDj7j-2FS-2FCOtzZ0VaIlD4-2FkqimS5zSw0bv6IST1p1-2BAu-2FmB2jfxd5iQ64aKQ4DX7p46CGFeY5AAoqITpMBvtxBac8i2bHNjOZnsMJSn3hr9vwuwaFgOpggWSMPNuAS3vzfLorNjhsWia86KSBnSdw9C6c1-2FP0uE0004cYua4oV75RyYQaWru6ZxCk7YraIgBGreJMeXXXjbXNjthKnNVkBQLDwRt-2BzC2BxzyPMA-2FtcAqKzwOffXqY6zaA-3D-3D30T2_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjzOHV9Dm9j2qKN3lpmn8XoSOLUSeXmOHtdwAU5S5jKweXQcz4otjNvDP9TxClPnOU9Dnv-2BiHV6H5SwyUnQNqLdWpBXLrTgDNrrwZelHgU2zJ6g0ilzoRizpJ0eeQuM1qUCriQureMO5iOW2ZDDuKNT1VZ0Bt8miWc1z4-2FLDHuLfcUhiuZYx-2FJc1jLw-2Fs4s-2Ft5-2Bdaa3lXraJLkA9VVBrdPPN&data=05%7C02%7Cjimmy.levasseur%40metalus.qc.ca%7C6c9b625cccc44e2e77ab08dcf76e55b0%7C4f85cc14eaa84e0b829193aab6969f78%7C0%7C0%7C638657300467115402%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=gNfchtyL0mej7HoT46SsBGya4C%2BfS8tz7Ms2VORDqFc%3D&reserved=0false
                                                unknown
                                                • No. of IPs < 25%
                                                • 25% < No. of IPs < 50%
                                                • 50% < No. of IPs < 75%
                                                • 75% < No. of IPs
                                                IPDomainCountryFlagASNASN NameMalicious
                                                13.107.246.43
                                                s-part-0015.t-0009.t-msedge.netUnited States
                                                8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                142.250.74.202
                                                unknownUnited States
                                                15169GOOGLEUSfalse
                                                20.223.36.55
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                20.189.173.6
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                13.107.246.45
                                                s-part-0017.t-0009.t-msedge.netUnited States
                                                8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                13.107.246.67
                                                s-part-0039.t-0009.t-msedge.netUnited States
                                                8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                20.223.35.26
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                52.109.89.119
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                142.250.185.100
                                                www.google.comUnited States
                                                15169GOOGLEUSfalse
                                                13.107.246.60
                                                s-part-0032.t-0009.t-msedge.netUnited States
                                                8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                52.182.141.63
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                142.251.168.84
                                                unknownUnited States
                                                15169GOOGLEUSfalse
                                                184.28.89.233
                                                unknownUnited States
                                                16625AKAMAI-ASUSfalse
                                                20.190.160.14
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                52.109.32.97
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                52.168.112.66
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                142.250.184.206
                                                unknownUnited States
                                                15169GOOGLEUSfalse
                                                172.217.18.110
                                                unknownUnited States
                                                15169GOOGLEUSfalse
                                                2.19.97.192
                                                unknownEuropean Union
                                                20940AKAMAI-ASN1EUfalse
                                                52.113.194.132
                                                unknownUnited States
                                                8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                104.102.52.100
                                                unknownUnited States
                                                16625AKAMAI-ASUSfalse
                                                1.1.1.1
                                                unknownAustralia
                                                13335CLOUDFLARENETUSfalse
                                                142.250.186.163
                                                unknownUnited States
                                                15169GOOGLEUSfalse
                                                184.28.89.167
                                                unknownUnited States
                                                16625AKAMAI-ASUSfalse
                                                88.221.169.152
                                                unknownEuropean Union
                                                16625AKAMAI-ASUSfalse
                                                239.255.255.250
                                                unknownReserved
                                                unknownunknownfalse
                                                20.190.159.2
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                104.47.75.220
                                                unknownUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                152.199.21.175
                                                sni1gl.wpc.alphacdn.netUnited States
                                                15133EDGECASTUSfalse
                                                104.124.11.201
                                                unknownUnited States
                                                20940AKAMAI-ASN1EUfalse
                                                52.102.11.124
                                                can01.safelinks.eop-tm2.outlook.comUnited States
                                                8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                172.217.16.195
                                                unknownUnited States
                                                15169GOOGLEUSfalse
                                                IP
                                                192.168.2.17
                                                Joe Sandbox version:41.0.0 Charoite
                                                Analysis ID:1544102
                                                Start date and time:2024-10-28 20:07:17 +01:00
                                                Joe Sandbox product:CloudBasic
                                                Overall analysis duration:
                                                Hypervisor based Inspection enabled:false
                                                Report type:full
                                                Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                Number of analysed new started processes analysed:29
                                                Number of new started drivers analysed:0
                                                Number of existing processes analysed:0
                                                Number of existing drivers analysed:0
                                                Number of injected processes analysed:0
                                                Technologies:
                                                • EGA enabled
                                                Analysis Mode:stream
                                                Analysis stop reason:Timeout
                                                Sample name:original.eml
                                                Detection:MAL
                                                Classification:mal52.phis.winEML@43/13@34/283
                                                Cookbook Comments:
                                                • Found application associated with file extension: .eml
                                                • Exclude process from analysis (whitelisted): dllhost.exe
                                                • Excluded IPs from analysis (whitelisted): 52.109.32.97, 192.229.221.95, 52.113.194.132, 52.109.89.119, 20.189.173.6, 142.250.186.163, 172.217.18.110, 142.251.168.84, 34.104.35.123
                                                • Excluded domains from analysis (whitelisted): odc.officeapps.live.com, slscr.update.microsoft.com, europe.odcsm1.live.com.akadns.net, clientservices.googleapis.com, mobile.events.data.microsoft.com, ecs-office.s-0005.s-msedge.net, osiprod-weu-bronze-azsc-000.westeurope.cloudapp.azure.com, clients2.google.com, ocsp.digicert.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, ecs.office.com, fs.microsoft.com, accounts.google.com, prod.configsvc1.live.com.akadns.net, weu-azsc-000.odc.officeapps.live.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, config.officeapps.live.com, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live.com.akadns.net, prod.odcsm1.live.com.akadns.net, mobile.events.data.trafficmanager.net, onedscolprdwus05.westus.cloudapp.azure.com
                                                • Not all processes where analyzed, report is missing behavior information
                                                • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                • Report size getting too big, too many NtSetValueKey calls found.
                                                • VT rate limit hit for: original.eml
                                                InputOutput
                                                URL: Model: claude-3-5-sonnet-latest
                                                {
                                                    "explanation": [
                                                        "The email contains suspicious long tracking URLs with multiple redirects and encoded parameters",
                                                        "The sender domain (metalus.qc.ca) doesn't match the claimed sender (pizzasalvatore.com)",
                                                        "The recipient address contains 'phisher.knowbe4.com' which indicates this is a phishing simulation"
                                                    ],
                                                    "phishing": true,
                                                    "confidence": 9
                                                }
                                                Is this email content a phishing attempt? Please respond only in valid JSON format:
                                                    Email content converted to JSON:
                                                {
                                                    "date": "Mon, 28 Oct 2024 16:41:42 +0000", 
                                                    "subject": " [Phish Alert] 7 Nouveaux Coupons Ajouts  Votre Compte !", 
                                                    "communications": [
                                                        "Vous n'obtenez pas souvent d'e-mail  partir de noreply@pizzasalvatore.com. Pourquoi c'est important<https://aka.ms/LearnAboutSenderIdentification>\n\nAvertissement: Ce courriel provient d'un expditeur externe. Ne cliquez sur aucun lien et n'ouvrez pas de pice jointe, sauf si vous connaissez l'expditeur et si le contenu est fiable\n\nJimmy Levasseur,\n\nNous sommes heureux de vous annoncer que 7 NOUVEAUX coupons viennent d'tre ajouts  votre compte ! Chaque offre a t soigneusement conue pour vous, avec beaucoup d'amour.\n\nNous esprons que vous apprcierez ces offres autant que nous vous apprcions.\n\nPour en profiter, suivez ces tapes simples :\n\n  1.  Rendez-vous sur notre site<https://u1109938.ct.sendgrid.net/ls/click?upn=u001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJsZOR3zl3qdm-2FBOw2Zzi39U0e-2BiGHcp9UGL9bzKcpwVI7NZSH6ys9u8tBZmKDm8YMxv0SPoF7n-2FGVWBMLQZJknp7npaB4k4oWne4wM-2BwNFySIXowjwbvlImgBskjU14j81dFoTc4ehn0B3xp0Vxf4XyyOxLI9qZOhXbXTIC5Sq7vENcfxQUz5mrjHGw8ENR7CaCeUC1JQKvW0sN-2BcqYL-2BfwYC6KKR3Io9R496QjL3yZqmFqOVJ2uw-2Blr-2FEyaJV6oJuP8wilbiBCo1aMD7GSFE-2Fhng7yeOjQz3w1hpvl6jvZhuZC26XUfHMQuS-2FkyRYPZI7Rgdg4TGrD4t9MPXlD3llzaf2NunLoNPyaKC72-2BngErdKIdQ42woOxjcMlziHckC16LYGL6HKVHyd6bsi0iTV33Eu8UBvZ-2FX3ULZgW2siOjr2foW-2FkBA2cq8Sq1JX7Rvy8Oc50-2FB9Uk7242c2g2DrJ8CyONleGCMJTeaUiRmImG5c4c9s2KY3oU66uXHg7W72THESxxKRhlbXtd2zrTleHLj5TNJxQy7JrvVvzLCO-2FS5c4Xd0uGn-2Bcj44W92S1RIXTkGqMZH69Txa-2BH-2FRb3-2B7s-3DOWcG_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjx2F1ZyDWKg2x1R8YehQOiyOOoX7o4msmGj-2FfhJBNMSvYAGvW-2FpeiNryciQrAk47hDfMZRAsVqtTcLbP-2Bh0aKiTg4yXWztI5feL6E9fbXlYYo9R-2BvL-2BqoLc7ouZIjL966vz-2BTDEc-2FxDSaGSV9Bq4C7s-2F5l5YAPimsFR-2BaBm7mGcoXZXDkZIl-2FqSkJnd7mu70G-2B-2B64EZRy3-2BhKrA-2FGdyiuv5> ou sur notre application mobile (Apple <https://u1109938.ct.sendgrid.net/ls/click?upn=u001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJp-2FCsAIUvPIm7Cs0XVjeG1Yc-2BOs4KQUjD3bMJYDFibsw7h-2BhmSr1Bf4B2Ckje2taqbBkxQa3Xp-2BcdUFVZriOF3mYWEkodHuxCs5gnzuPP41MG6YOrV-2FiB3FDItQytQ8WeNua4sXWyR0zFMxQUR4EwRVy-2FDCyAUdaLpML4yXPC-2FGer4QtrlYAJuIVT4kKSYxD2aapMfWulWJLWVmftTqTUokW7aXV02yKaEzsL0JsXQinte3JD4-2BVxu3Mrh31R4c3HF6FvKYG6xP2aVO-2F-2BIVLRiw08W2t0uu7WZKVENfD9Bfe84AdMAK9Lti6iua7iVVY0vxDciVnvOPh83Ww9XpdJVyStdf8H7UbLSBP7aRZ3oqrriHUdSHOxFEl56vkFMwnltIWCKCkxq5BgV60BPmZyMF2DD-2FF3U6KLXFiGe2gQ1kqUPkFGg2q9BHb7S4-2BcbsXmMoSZsrPsHbBg2yxGiw7yLbOnRk5o0lZM383VwMIkG53XAJDmoHQ-2By7GDa16wQgHfK62Zpib1C-2FSAFAsfpR-2BnP3p2a4DysXIBiMNUazVZ7ne0W5erjZH-2BKRr-2FNk2FHuaT8oarTmiPVdnJ4V4W-2BpG-2FRgvfX9Ev0h5Xy9JAkqPq7sF-2BPAerjL8kf2dhJ0Kmh5RD9gL4qTX8B-2BlyIUA2byhvXWR3qDWcNsXn5xcs7h-2FsrR4f_LO_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjywjzsfHU0mG362E6NSldUfIKfr4t6j3xkjPjFxWV6UUZadOSVmsX8szx6X4wIQBwEtkdg6R3Uth9mEAHQ-2FUKcGMeKkSo03x91uclNmMitkWCgJDnZ0ihD-2BSum9jSXrC-2FC4tD5m1jgGPmLspGbcQlys56zA8ILxq8xzxDWUH7wztW9CYznD3NS2BxJE-2Fzvorlr0XMa5sKkJEAndNKcYZjuI> / Android<https://u1109938.ct.sendgrid.net/ls/click?upn=u001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJuF1fzexsJJN-2FxAklcI9L-2B04nMIN9-2FO01J-2BEQaEiWrWmi-2B6zeKPc1HXcPIi3O-2F1v98PsnmLsfizgioFhlqdhVbByQS4FtjRND39BHA178u7vnlQFEDvl6xjwIGVibX4bwoyAlVrJkv6e3cIyS3grZRA-2BUOK0hwFk3OjJ7Ve3ZUiH3CfaHBLhhAHI2r-2F45rDbFUSFOn30PTeBkCiy6HPXzkdc9OhgrIXgbumAy4BVCjcKeeJRqOvWiUbZHfQQwx69FdM2cPjvB95P9VnfDOSUtfj1LWSf2cu-2FFU5ACtiHv7WXoqLF2e2-2FmMDjIOnZKjtZMaeWDXRvh-2FloCPHJtixQ53-2BhXtoao06ipfoKqc60CAS6Kmj4MP0V-2Bnqx0BiHmnt2FHd1CepThOf91Br65Xig1EPxbBHFhioIF4d76VKeh3-2B2Xs1NF0H6xF9Il-2Fl1krLNF3F6MxL3UMYWmMP3xcCDwKfkHGO-2B0pKRqYa4pCjg4YrI9x4o5QMvToL1dbY0JTWk4yiqBt3olycDj7j-2FS-2FCOtzZ0VaIlD4-2FkqimS5zSw0bv6IST1p1-2BAu-2FmB2jfxd5iQ64aKQ4DX7p46CGFeY5AAoqITpMBvtxBac8i2bHNjOZnsMJSn3hr9vwuwaFgOpggWSMPNuAS3vzfLorNjhsWia86KSBnSdw9C6c1-2FP0uE0004cYua4oV75RyYQaWru6ZxCk7YraIgBGreJMeXXXjbXNjthKnNVkBQLDwRt-2BzC2BxzyPMA-2FtcAqKzwOffXqY6zaA-3D-3D30T2_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjzOHV9Dm9j2qKN3lpmn8XoSOLUSeXmOHtdwAU5S5jKweXQcz4otjNvDP9TxClPnOU9Dnv-2BiHV6H5SwyUnQNqLdWpBXLrTgDNrrwZelHgU2zJ6g0ilzoRizpJ0eeQuM1qUCriQureMO5iOW2ZDDuKNT1VZ0Bt8miWc1z4-2FLDHuLfcUhiuZYx-2FJc1jLw-2Fs4s-2Ft5-2Bdaa3lXraJLkA9VVBrdPPN>).\n  2.  Connectez-vous  votre compte avec vos identifiants.\n  3.  Choisissez le type de commande et la pizzeria de votre choix.\n  4.  Accdez  la section ''Mes Coupons'' pour profiter de vos rcompenses.\n\nCes coupons sont valables jusqu'au 30 novembre, alors ne manquez pas l'occasion de les utiliser avant qu'il ne soit trop tard !\n\nMerci de faire partie de la grande famille Pizza Salvator.\n\n\nNous avons hte de vous servir  nouveau !\n\nLa 3e gnration,\n\n[https://lh7-rt.googleusercontent.com/docsz/AD_4nXeESaTGMzfdlJNnhLmy4EVxe_acODuFdk8e9W9UYFC_SMUUh-iEPvcMXSneLYTOUsUgrLj8QvEarNAhD0a9_cBnUfb61-jWXAlxlgNjGqkSM1UXad5kvF52rplZrZVGWGTWWUVyGebKYXWFjxKVh2ol69A?key=FuCOGUESIfR2u1OsCf62eQ]\n\nSbastien, Katarina, Guillaume Jr., lisabeth et Frdric\n\n\nMe dsabonner<https://u1109938.ct.sendgrid.net/ls/click?upn=u001.IdUpeluz2aslhKdrxa6HzBkzp1qcpeciwBazOuWwNMNCXnilnleTA006iucL9Sy3rTM-2FY3gIcCbdRwd-2BeXdyyZJ3CfBRdq3trYR11I-2F5OBdfbQ6D4ghg3teSNhnfuGVTvjx1gYJRD06Nt13yULPF8SCNjxv1bgrcHa93RLYhNId2yvcEYk8qTl6IrekoaHGVH-2F3NhTlh7tOohhQoWdz66u-2F8xf-2FXENOIvBLwSXzGROTUwGOEIY-2Boh3NcYuDwzuA0wXloEPO6Ofr94Iv548avY2rb9z181ZPHxsLuBcTKa5A-3DRuxL_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjylAa2sMo0TgnlAsux1Fyd-2F8wkUOYTgiggQ0Qanc5qMYBOl7-2B2mfaGT-2F-2BH7mVmNX-2Fh6t9pwse1grrQrdKlR3dvyKyp8rPGRJpO95k80XyiWscU8RRH4P4nlqiau8cIBMJgdelKtu20ZzdAlvIkZWVop-2BPx-2BzONj9DTBQnzu2qJDxuzLLuWNBiRzh1hEz3dYUkAMYrVPSLb0m9O40aOglqfY>\n\n\n\nJimmy Levasseur\n\nDessinateur / programmeur\n819-475-3114 #327\n\nVictoriaville, QC\n\n[https://raw.githubusercontent.com/Metalus-Inc/signature/main/logocarteMetalusBleuWhiteSmall.png]\n[https://raw.githubusercontent.com/Metalus-Inc/signature/main/logofacebooksmall.png]<https://www.facebook.com/MetalusInc/>      [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logolinkedsmall.png] <https://ca.linkedin.com/company/m-talus>    [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logoinstasmall.png] <https://www.instagram.com/metalusinc/>\n"
                                                    ], 
                                                    "from": "Jimmy Levasseur <jimmy.levasseur@metalus.qc.ca>", 
                                                    "to": "\"c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com\" <c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com>"
                                                }
                                                URL: Email Model: claude-3-haiku-20240307
                                                ```json
                                                {
                                                  "contains_trigger_text": true,
                                                  "trigger_text": "Rendez-vous sur notre site ou sur notre application mobile (Apple / Android). Connectez-vous  votre compte avec vos identifiants. Choisissez le type de commande et la pizzeria de votre choix. Accdez  la section \"Mes Coupons\" pour profiter de vos rcompenses.",
                                                  "prominent_button_name": "unknown",
                                                  "text_input_field_labels": [
                                                    "Rendez-vous sur notre site ou sur notre application mobile (Apple / Android)",
                                                    "Connectez-vous  votre compte avec vos identifiants",
                                                    "Choisissez le type de commande et la pizzeria de votre choix",
                                                    "Accdez  la section \"Mes Coupons\" pour profiter de vos rcompenses"
                                                  ],
                                                  "pdf_icon_visible": false,
                                                  "has_visible_captcha": false,
                                                  "has_urgent_text": true,
                                                  "has_visible_qrcode": false
                                                }
                                                URL: Email Model: claude-3-haiku-20240307
                                                ```json
                                                {
                                                  "brands": [
                                                    "Pizza Salvatore"
                                                  ]
                                                }
                                                URL: https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJsZOR3zl3qdm-2FBOw2Zzi39U0e-2BiGHcp9UGL9bzKcpwVI7NZSH6 Model: claude-3-haiku-20240307
                                                ```json
                                                {
                                                  "contains_trigger_text": true,
                                                  "trigger_text": "Opening this website might not be safe.",
                                                  "prominent_button_name": "unknown",
                                                  "text_input_field_labels": "unknown",
                                                  "pdf_icon_visible": false,
                                                  "has_visible_captcha": false,
                                                  "has_urgent_text": true,
                                                  "has_visible_qrcode": false
                                                }
                                                URL: Model: claude-3-5-sonnet-latest
                                                {
                                                    "typosquatting": false,
                                                    "unusual_query_string": false,
                                                    "suspicious_tld": false,
                                                    "ip_in_url": false,
                                                    "long_subdomain": true,
                                                    "malicious_keywords": false,
                                                    "encoded_characters": false,
                                                    "redirection": true,
                                                    "contains_email_address": false,
                                                    "known_domain": true,
                                                    "brand_spoofing_attempt": false,
                                                    "third_party_hosting": false
                                                }
                                                URL: URL: https://can01.safelinks.protection.outlook.com
                                                URL: https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu1109938.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Du001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJsZOR3zl3qdm-2FBOw2Zzi39U0e-2BiGHcp9UGL9bzKcpwVI7NZSH6 Model: claude-3-haiku-20240307
                                                ```json
                                                {
                                                  "brands": [
                                                    "Microsoft Defender for Office 365"
                                                  ]
                                                }
                                                URL: Model: claude-3-5-sonnet-latest
                                                {
                                                    "typosquatting": false,
                                                    "unusual_query_string": false,
                                                    "suspicious_tld": false,
                                                    "ip_in_url": false,
                                                    "long_subdomain": false,
                                                    "malicious_keywords": false,
                                                    "encoded_characters": false,
                                                    "redirection": false,
                                                    "contains_email_address": false,
                                                    "known_domain": true,
                                                    "brand_spoofing_attempt": false,
                                                    "third_party_hosting": false
                                                }
                                                URL: URL: https://support.microsoft.com
                                                URL: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9c Model: claude-3-haiku-20240307
                                                ```json
                                                {
                                                  "contains_trigger_text": true,
                                                  "trigger_text": "contact your organization's IT administrator or help desk and ask them to update their policy to allow this site",
                                                  "prominent_button_name": "unknown",
                                                  "text_input_field_labels": "unknown",
                                                  "pdf_icon_visible": false,
                                                  "has_visible_captcha": false,
                                                  "has_urgent_text": false,
                                                  "has_visible_qrcode": false
                                                }
                                                URL: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9c Model: claude-3-haiku-20240307
                                                ```json
                                                {
                                                  "contains_trigger_text": true,
                                                  "trigger_text": "If you believe that the site you were trying to connect to is safe, you should contact your organization's IT administrator or help desk and ask them to update their policy to allow this site.",
                                                  "prominent_button_name": "unknown",
                                                  "text_input_field_labels": "unknown",
                                                  "pdf_icon_visible": false,
                                                  "has_visible_captcha": false,
                                                  "has_urgent_text": false,
                                                  "has_visible_qrcode": false
                                                }
                                                URL: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9c Model: claude-3-haiku-20240307
                                                ```json
                                                {
                                                  "brands": [
                                                    "Microsoft"
                                                  ]
                                                }
                                                URL: https://support.microsoft.com/en-us/topic/what-to-do-when-you-are-blocked-from-a-site-and-believe-the-result-is-mistaken-6f41d3fd-55d3-467e-a5a4-49da4132bb9c Model: claude-3-haiku-20240307
                                                ```json
                                                {
                                                  "brands": [
                                                    "Microsoft"
                                                  ]
                                                }
                                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                File Type:data
                                                Category:modified
                                                Size (bytes):231348
                                                Entropy (8bit):4.377096780668095
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:F10B02421B3A30782E41B89377AEA566
                                                SHA1:05DCA3B264355A3772C7E7BA78BE1AB41E0A3014
                                                SHA-256:40DD6346AF29D88AEAB3C35A328483B8F28CB6552E25F37066DBE65F744E8F67
                                                SHA-512:34F2456B22510CA745255504A59569114043BA511C90D98D1A0720BBA4240D09E6141F8F13010D886FBC343A05CA24D509245933B2AD1EC5ED6E20B691B384FC
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:TH02...... ....l)......SM01X...,....J..l)..........IPM.Activity...........h...............h............H..h.........Y ....h............H..h\tor ...AppD...h.-..0...`......h.A.............h........_`.k...h.@..@...I.+w...h....H...8..k...0....T...............d.........2h...............k..............!h.............. h.o.I....x.....#h....8.........$h........8....."h..............'h..............1h.A..<.........0h....4.....k../h....h......kH..h ...p.........-h .............+hiA................. ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..
                                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):180288
                                                Entropy (8bit):5.291023136099554
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:0919533A6E2822C700EEC8B56A3F1FA6
                                                SHA1:6E77158964E31B23524C250CC7D9A7970C95EE1F
                                                SHA-256:40949F4F1B9BC56F5D2E4330D36C585246ACDB5518F81D6D62D72864B565167F
                                                SHA-512:EEC32208B721BCBC3B646F9992AF633F30525890D9527A7FD3A4A063F5410493ABF3BD1B15B280F93F6E89B611A617DB0B527072179018EB64167F4EC18033F4
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-10-28T19:07:58">.. Build: 16.0.18222.40125-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[
                                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                File Type:RFC 822 mail, Unicode text, UTF-8 text, with very long lines (5103), with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):0
                                                Entropy (8bit):0.0
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:3AB40243F7D0EC2B45F6E7D7BBEA94CA
                                                SHA1:B9B1189F22D17E11B795268B068A29FF772F95EB
                                                SHA-256:84EA887FCA259110B790854405AD8C57B4290C4AD045B0CEC09B9921999C0630
                                                SHA-512:4E54C4431A40109F51BD5D284E3B349F951290ED2147B35B3723137883A66CA444FCD55B3A32356167D0E8FF9D2EBE855DE7CC41DD006E53242D60DAB848DC9F
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:Received: from YT3PR01MB8657.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:9e::7).. by YT3PR01MB9802.CANPRD01.PROD.OUTLOOK.COM with HTTPS; Mon, 28 Oct 2024.. 16:34:06 +0000..Received: from YT4PR01CA0106.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:d7::12).. by YT3PR01MB8657.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:9e::7) with.. Microsoft SMTP Server (version=TLS1_2,.. cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8093.27; Mon, 28 Oct.. 2024 16:34:03 +0000..Received: from YT2PEPF000001CC.CANPRD01.PROD.OUTLOOK.COM.. (2603:10b6:b01:d7:cafe::28) by YT4PR01CA0106.outlook.office365.com.. (2603:10b6:b01:d7::12) with Microsoft SMTP Server (version=TLS1_2,.. cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8093.26 via Frontend.. Transport; Mon, 28 Oct 2024 16:34:03 +0000..Authentication-Results: spf=pass (sender IP is 50.31.41.69).. smtp.mailfrom=em4392.pizzasalvatore.com; dkim=pass (signature was verified).. header.d=pizzasalvatore.com;dmarc=pass action=none.. header.from=pizzasalvatore.
                                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                File Type:RFC 822 mail, Unicode text, UTF-8 text, with very long lines (5103), with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):44699
                                                Entropy (8bit):5.983832395102426
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:3AB40243F7D0EC2B45F6E7D7BBEA94CA
                                                SHA1:B9B1189F22D17E11B795268B068A29FF772F95EB
                                                SHA-256:84EA887FCA259110B790854405AD8C57B4290C4AD045B0CEC09B9921999C0630
                                                SHA-512:4E54C4431A40109F51BD5D284E3B349F951290ED2147B35B3723137883A66CA444FCD55B3A32356167D0E8FF9D2EBE855DE7CC41DD006E53242D60DAB848DC9F
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:Received: from YT3PR01MB8657.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:9e::7).. by YT3PR01MB9802.CANPRD01.PROD.OUTLOOK.COM with HTTPS; Mon, 28 Oct 2024.. 16:34:06 +0000..Received: from YT4PR01CA0106.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:d7::12).. by YT3PR01MB8657.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:9e::7) with.. Microsoft SMTP Server (version=TLS1_2,.. cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8093.27; Mon, 28 Oct.. 2024 16:34:03 +0000..Received: from YT2PEPF000001CC.CANPRD01.PROD.OUTLOOK.COM.. (2603:10b6:b01:d7:cafe::28) by YT4PR01CA0106.outlook.office365.com.. (2603:10b6:b01:d7::12) with Microsoft SMTP Server (version=TLS1_2,.. cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8093.26 via Frontend.. Transport; Mon, 28 Oct 2024 16:34:03 +0000..Authentication-Results: spf=pass (sender IP is 50.31.41.69).. smtp.mailfrom=em4392.pizzasalvatore.com; dkim=pass (signature was verified).. header.d=pizzasalvatore.com;dmarc=pass action=none.. header.from=pizzasalvatore.
                                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                File Type:ASCII text, with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):26
                                                Entropy (8bit):3.95006375643621
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
                                                SHA1:D59FC84CDD5217C6CF74785703655F78DA6B582B
                                                SHA-256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
                                                SHA-512:AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:[ZoneTransfer]..ZoneId=3..
                                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):3.570566460817452
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:030A14D3554B6F14BCBB54A38E30843F
                                                SHA1:9A43E9C6ED0EA6BBBEDA2D8BB408EDCA02F2591E
                                                SHA-256:1625EAB301343387AF64E56D4E2B20C196489B6B2B3CB77CD31F9459C5E6BF4A
                                                SHA-512:41D35BC6E5487A5987437DE80E68BBC9DD6896FB87CFE3B37A6EC876FE98E972D48922F789370BE8185B0E0B176D2A53F253C609B305EBD80F782B544C92A865
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:............................................................................d...,...$...dxQ.l)..................eJ......O<[.l)..Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0g.,.Y..........dxQ.l)..........v.2._.O.U.T.L.O.O.K.:.1.9.2.4.:.b.7.5.d.e.e.e.6.2.b.1.1.4.d.5.b.a.7.7.0.4.e.5.8.e.b.2.9.5.8.1.b...C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.0.2.8.T.1.5.0.8.0.4.0.6.3.3.-.6.4.3.6...e.t.l...........P.P.,...$...dxQ.l)..................................................................................................................................................................................................................................................................................................
                                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                File Type:GIF image data, version 89a, 15 x 15
                                                Category:dropped
                                                Size (bytes):663
                                                Entropy (8bit):5.949125862393289
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:ED3C1C40B68BA4F40DB15529D5443DEC
                                                SHA1:831AF99BB64A04617E0A42EA898756F9E0E0BCCA
                                                SHA-256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
                                                SHA-512:C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,*.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()*+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;
                                                Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):30
                                                Entropy (8bit):1.2389205950315936
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:CE47C436D8F1EC97C0D751C700644683
                                                SHA1:CC19D194EF3D696678EFAA14A3945DE9965FC176
                                                SHA-256:FC2BD15750DE01FA64C5CEA4B9A356FEDC717018E7742FE8062D1E944D77ABA9
                                                SHA-512:F95E17374D8781047C2779F0BB971812F114DB63E8E409ABC1A428EFD59F58CA3776E99F6B6C0BFE4A9980769A170704C80B81921F6633CF229FC824AB905352
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:..............................
                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 18:08:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                Category:dropped
                                                Size (bytes):2677
                                                Entropy (8bit):3.9875429408645844
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:C72D23C1CFBB0C46B7D33F1B3CC995D1
                                                SHA1:28C0D7BFC17470097D886A39593E7DCE9F330B57
                                                SHA-256:5058FFF6967284A71BCBD30C5FD36BE22C5CA2E2DBD76B21D9994563D2C9CECA
                                                SHA-512:99650FBE20241CFBFCE8A7AA63E4FDC01034787C162040FE3B760D7E2CD919815499AA14FE5966EAA21AFFCADB2DD592135E1104AE5BC3D67EA0743681D6C041
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:L..................F.@.. ...$+.,......H.l)......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 18:08:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                Category:dropped
                                                Size (bytes):2679
                                                Entropy (8bit):4.005137250615156
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:90B0BED0BA167E32CA98D8FDB9AE3706
                                                SHA1:4D5D70C9173CA6CAD711550C9A6B52397B5E97F4
                                                SHA-256:FEB0DD7ABE4D7F57793FE067F8DD0EA7E74F8FEADAFF05F3F9783CC793B7A1A4
                                                SHA-512:A8990CED6A6F1ECDF1EE8E03B253FE42C15C4D161FEC8E3797923B8D9ED6C5359EBA08A539189D1CC07858E7754439E41AF8CC1590851A17F7D75FE7A6848E61
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:L..................F.@.. ...$+.,....I.8.l)......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                Category:dropped
                                                Size (bytes):2693
                                                Entropy (8bit):4.017020143861405
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:3207868228DD43F6E08FE47E05C87029
                                                SHA1:E03B39C8BC616058FCCAFB38F374A818E5811AE8
                                                SHA-256:A78B41506D5F444330557BC5829E3C4964F05E69258B3CC4E33F5C0507F8239D
                                                SHA-512:5E6AE30CA4B0BA4657CE3368AE15D67313A8CD58A84317F2A8C784793FC4136267ED36097A4B0206C626F9F6825408943367614F8A737358F5D8A8DB7E7621E0
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 18:08:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                Category:dropped
                                                Size (bytes):2681
                                                Entropy (8bit):4.00254030281644
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:3F998B3EBAAFA9E98FAE3F019FF3E6A2
                                                SHA1:B08B25AEB2EF2EE0AFF224AF6E4D7C713D45F89A
                                                SHA-256:CF9703622FC3919ADAFE886001B3A0EB3367C409ED9AA281001770BD562CAE91
                                                SHA-512:DF0B6D8AB2F7D84A77742E4422758A400F9C79EEDF5A6A9D6A36A5499794C8F426C55F5D6B41BBD81FCA2FEF0637C6C670EE31A71C86AA6797CAA91B962A1B52
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:L..................F.@.. ...$+.,....O.1.l)......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 18:08:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                Category:dropped
                                                Size (bytes):2681
                                                Entropy (8bit):3.9920862385735134
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:DDB6B0845EB8F67B820B701B00B339A7
                                                SHA1:D564D1C2BE3C5AE2ADD9971A6AD601A533D504B9
                                                SHA-256:CEE27A42F259FF596C8A69EE8223334A21CE3F48196167FBB1E6F4960CEC5BDC
                                                SHA-512:22AF6ACA8CCA9F061C5280B36155388D9F2E3B6A40064A0E96874277289CBEB51901A1B11E5499140D03031FF10CDC2FE7C0B16D11CCA5CB0F9F18AD8147BC12
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:L..................F.@.. ...$+.,......@.l)......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 18:08:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
                                                Category:dropped
                                                Size (bytes):2683
                                                Entropy (8bit):4.00484555934381
                                                Encrypted:false
                                                SSDEEP:
                                                MD5:95B694E9951B2F5D72E743FC2CD9A512
                                                SHA1:EFD17C1F24C665C74683F1E7741B7A74997B8C49
                                                SHA-256:F95D5FE0C8C409F577B9F048FDFB343437A33EC05BCACA5A7009B25BF6F4953F
                                                SHA-512:F24CA424BB9C4FF6B608365190885F3AC1DFE9CC027EAB4082D7129174AB02B00BB695D57014A0CA1C75533B2047978A0129C27F772EBFD8DE0FA7FC769943E3
                                                Malicious:false
                                                Reputation:unknown
                                                Preview:L..................F.@.. ...$+.,...."]'.l)......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I\Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V\Y......M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V\Y.............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V\Y.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........}........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                                                File type:SMTP mail, ASCII text, with very long lines (459), with CRLF line terminators
                                                Entropy (8bit):6.085733601150696
                                                TrID:
                                                • E-Mail message (Var. 1) (20512/2) 100.00%
                                                File name:original.eml
                                                File size:108'928 bytes
                                                MD5:88047537979e632ec8d1e5d6dec8b72a
                                                SHA1:3eb58a8d975b0b736922a4d0077f4723adbc74f1
                                                SHA256:dd9e787922873fe8ee7804daeb833f46976fb8109df09234af9d1dfe2ec953f5
                                                SHA512:38e4888239894ce939245997632796bb9aa0ba24b79883f4f849ea7bca01310843784de1c4cefee898606e43dc3e9487c0bd360b2cad5e4ad6991c4104f620e4
                                                SSDEEP:3072:44OB9Sn8BAXZOtSDTNswlpMzyzq80eUwjpW:44OwZCQM+Awjg
                                                TLSH:CFB36C43E3C02925CCAAC9942423333F3B785AD75EB11C7E22AABF7A4789CE5E0D5144
                                                File Content Preview:Return-Path: <jimmy.levasseur@metalus.qc.ca>..Received: from YQZPR01CU011.outbound.protection.outlook.com (mail-canadaeastazon11020086.outbound.protection.outlook.com [52.101.191.86]).. by inbound-smtp.us-east-1.amazonaws.com with SMTP id cagqq8ddt23u9l8j
                                                Subject: [Phish Alert] 7 Nouveaux Coupons Ajouts Votre Compte !
                                                From:Jimmy Levasseur <jimmy.levasseur@metalus.qc.ca>
                                                To:"c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com" <c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com>
                                                Cc:
                                                BCC:
                                                Date:Mon, 28 Oct 2024 16:41:42 +0000
                                                Communications:
                                                • Vous n'obtenez pas souvent d'e-mail partir de noreply@pizzasalvatore.com. Pourquoi c'est important<https://aka.ms/LearnAboutSenderIdentification> Avertissement: Ce courriel provient d'un expditeur externe. Ne cliquez sur aucun lien et n'ouvrez pas de pice jointe, sauf si vous connaissez l'expditeur et si le contenu est fiable Jimmy Levasseur, Nous sommes heureux de vous annoncer que 7 NOUVEAUX coupons viennent d'tre ajouts votre compte ! Chaque offre a t soigneusement conue pour vous, avec beaucoup d'amour. Nous esprons que vous apprcierez ces offres autant que nous vous apprcions. Pour en profiter, suivez ces tapes simples : 1. Rendez-vous sur notre site<https://u1109938.ct.sendgrid.net/ls/click?upn=u001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJsZOR3zl3qdm-2FBOw2Zzi39U0e-2BiGHcp9UGL9bzKcpwVI7NZSH6ys9u8tBZmKDm8YMxv0SPoF7n-2FGVWBMLQZJknp7npaB4k4oWne4wM-2BwNFySIXowjwbvlImgBskjU14j81dFoTc4ehn0B3xp0Vxf4XyyOxLI9qZOhXbXTIC5Sq7vENcfxQUz5mrjHGw8ENR7CaCeUC1JQKvW0sN-2BcqYL-2BfwYC6KKR3Io9R496QjL3yZqmFqOVJ2uw-2Blr-2FEyaJV6oJuP8wilbiBCo1aMD7GSFE-2Fhng7yeOjQz3w1hpvl6jvZhuZC26XUfHMQuS-2FkyRYPZI7Rgdg4TGrD4t9MPXlD3llzaf2NunLoNPyaKC72-2BngErdKIdQ42woOxjcMlziHckC16LYGL6HKVHyd6bsi0iTV33Eu8UBvZ-2FX3ULZgW2siOjr2foW-2FkBA2cq8Sq1JX7Rvy8Oc50-2FB9Uk7242c2g2DrJ8CyONleGCMJTeaUiRmImG5c4c9s2KY3oU66uXHg7W72THESxxKRhlbXtd2zrTleHLj5TNJxQy7JrvVvzLCO-2FS5c4Xd0uGn-2Bcj44W92S1RIXTkGqMZH69Txa-2BH-2FRb3-2B7s-3DOWcG_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjx2F1ZyDWKg2x1R8YehQOiyOOoX7o4msmGj-2FfhJBNMSvYAGvW-2FpeiNryciQrAk47hDfMZRAsVqtTcLbP-2Bh0aKiTg4yXWztI5feL6E9fbXlYYo9R-2BvL-2BqoLc7ouZIjL966vz-2BTDEc-2FxDSaGSV9Bq4C7s-2F5l5YAPimsFR-2BaBm7mGcoXZXDkZIl-2FqSkJnd7mu70G-2B-2B64EZRy3-2BhKrA-2FGdyiuv5> ou sur notre application mobile (Apple <https://u1109938.ct.sendgrid.net/ls/click?upn=u001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJp-2FCsAIUvPIm7Cs0XVjeG1Yc-2BOs4KQUjD3bMJYDFibsw7h-2BhmSr1Bf4B2Ckje2taqbBkxQa3Xp-2BcdUFVZriOF3mYWEkodHuxCs5gnzuPP41MG6YOrV-2FiB3FDItQytQ8WeNua4sXWyR0zFMxQUR4EwRVy-2FDCyAUdaLpML4yXPC-2FGer4QtrlYAJuIVT4kKSYxD2aapMfWulWJLWVmftTqTUokW7aXV02yKaEzsL0JsXQinte3JD4-2BVxu3Mrh31R4c3HF6FvKYG6xP2aVO-2F-2BIVLRiw08W2t0uu7WZKVENfD9Bfe84AdMAK9Lti6iua7iVVY0vxDciVnvOPh83Ww9XpdJVyStdf8H7UbLSBP7aRZ3oqrriHUdSHOxFEl56vkFMwnltIWCKCkxq5BgV60BPmZyMF2DD-2FF3U6KLXFiGe2gQ1kqUPkFGg2q9BHb7S4-2BcbsXmMoSZsrPsHbBg2yxGiw7yLbOnRk5o0lZM383VwMIkG53XAJDmoHQ-2By7GDa16wQgHfK62Zpib1C-2FSAFAsfpR-2BnP3p2a4DysXIBiMNUazVZ7ne0W5erjZH-2BKRr-2FNk2FHuaT8oarTmiPVdnJ4V4W-2BpG-2FRgvfX9Ev0h5Xy9JAkqPq7sF-2BPAerjL8kf2dhJ0Kmh5RD9gL4qTX8B-2BlyIUA2byhvXWR3qDWcNsXn5xcs7h-2FsrR4f_LO_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjywjzsfHU0mG362E6NSldUfIKfr4t6j3xkjPjFxWV6UUZadOSVmsX8szx6X4wIQBwEtkdg6R3Uth9mEAHQ-2FUKcGMeKkSo03x91uclNmMitkWCgJDnZ0ihD-2BSum9jSXrC-2FC4tD5m1jgGPmLspGbcQlys56zA8ILxq8xzxDWUH7wztW9CYznD3NS2BxJE-2Fzvorlr0XMa5sKkJEAndNKcYZjuI> / Android<https://u1109938.ct.sendgrid.net/ls/click?upn=u001.IdUpeluz2aslhKdrxa6HzMirFwoDQYrI31fzdf8ArvVqWprBwFhQKz9IUQmpJtHHsulYF0E0vP7UxTfdNpTAJuF1fzexsJJN-2FxAklcI9L-2B04nMIN9-2FO01J-2BEQaEiWrWmi-2B6zeKPc1HXcPIi3O-2F1v98PsnmLsfizgioFhlqdhVbByQS4FtjRND39BHA178u7vnlQFEDvl6xjwIGVibX4bwoyAlVrJkv6e3cIyS3grZRA-2BUOK0hwFk3OjJ7Ve3ZUiH3CfaHBLhhAHI2r-2F45rDbFUSFOn30PTeBkCiy6HPXzkdc9OhgrIXgbumAy4BVCjcKeeJRqOvWiUbZHfQQwx69FdM2cPjvB95P9VnfDOSUtfj1LWSf2cu-2FFU5ACtiHv7WXoqLF2e2-2FmMDjIOnZKjtZMaeWDXRvh-2FloCPHJtixQ53-2BhXtoao06ipfoKqc60CAS6Kmj4MP0V-2Bnqx0BiHmnt2FHd1CepThOf91Br65Xig1EPxbBHFhioIF4d76VKeh3-2B2Xs1NF0H6xF9Il-2Fl1krLNF3F6MxL3UMYWmMP3xcCDwKfkHGO-2B0pKRqYa4pCjg4YrI9x4o5QMvToL1dbY0JTWk4yiqBt3olycDj7j-2FS-2FCOtzZ0VaIlD4-2FkqimS5zSw0bv6IST1p1-2BAu-2FmB2jfxd5iQ64aKQ4DX7p46CGFeY5AAoqITpMBvtxBac8i2bHNjOZnsMJSn3hr9vwuwaFgOpggWSMPNuAS3vzfLorNjhsWia86KSBnSdw9C6c1-2FP0uE0004cYua4oV75RyYQaWru6ZxCk7YraIgBGreJMeXXXjbXNjthKnNVkBQLDwRt-2BzC2BxzyPMA-2FtcAqKzwOffXqY6zaA-3D-3D30T2_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjzOHV9Dm9j2qKN3lpmn8XoSOLUSeXmOHtdwAU5S5jKweXQcz4otjNvDP9TxClPnOU9Dnv-2BiHV6H5SwyUnQNqLdWpBXLrTgDNrrwZelHgU2zJ6g0ilzoRizpJ0eeQuM1qUCriQureMO5iOW2ZDDuKNT1VZ0Bt8miWc1z4-2FLDHuLfcUhiuZYx-2FJc1jLw-2Fs4s-2Ft5-2Bdaa3lXraJLkA9VVBrdPPN>). 2. Connectez-vous votre compte avec vos identifiants. 3. Choisissez le type de commande et la pizzeria de votre choix. 4. Accdez la section ''Mes Coupons'' pour profiter de vos rcompenses. Ces coupons sont valables jusqu'au 30 novembre, alors ne manquez pas l'occasion de les utiliser avant qu'il ne soit trop tard ! Merci de faire partie de la grande famille Pizza Salvator. Nous avons hte de vous servir nouveau ! La 3e gnration, [https://lh7-rt.googleusercontent.com/docsz/AD_4nXeESaTGMzfdlJNnhLmy4EVxe_acODuFdk8e9W9UYFC_SMUUh-iEPvcMXSneLYTOUsUgrLj8QvEarNAhD0a9_cBnUfb61-jWXAlxlgNjGqkSM1UXad5kvF52rplZrZVGWGTWWUVyGebKYXWFjxKVh2ol69A?key=FuCOGUESIfR2u1OsCf62eQ] Sbastien, Katarina, Guillaume Jr., lisabeth et Frdric Me dsabonner<https://u1109938.ct.sendgrid.net/ls/click?upn=u001.IdUpeluz2aslhKdrxa6HzBkzp1qcpeciwBazOuWwNMNCXnilnleTA006iucL9Sy3rTM-2FY3gIcCbdRwd-2BeXdyyZJ3CfBRdq3trYR11I-2F5OBdfbQ6D4ghg3teSNhnfuGVTvjx1gYJRD06Nt13yULPF8SCNjxv1bgrcHa93RLYhNId2yvcEYk8qTl6IrekoaHGVH-2F3NhTlh7tOohhQoWdz66u-2F8xf-2FXENOIvBLwSXzGROTUwGOEIY-2Boh3NcYuDwzuA0wXloEPO6Ofr94Iv548avY2rb9z181ZPHxsLuBcTKa5A-3DRuxL_04UVeSclHZkwqXlnLIJvsrMLK4qR-2FHb5-2Fz-2FM0XTOQ-2F2xEqq9OLDaa-2FwOEfxMfs86bwkiHQXk3gr3qF-2FHhEiEvmZZpdlVwIZAR9dEf9PzBKSqgiTHIb4VAeoxwRBE-2F1u6HrXk8rPXWIh2kvtUnIp6pZT7jYHaxDO0-2Bm-2FCmFaKHjylAa2sMo0TgnlAsux1Fyd-2F8wkUOYTgiggQ0Qanc5qMYBOl7-2B2mfaGT-2F-2BH7mVmNX-2Fh6t9pwse1grrQrdKlR3dvyKyp8rPGRJpO95k80XyiWscU8RRH4P4nlqiau8cIBMJgdelKtu20ZzdAlvIkZWVop-2BPx-2BzONj9DTBQnzu2qJDxuzLLuWNBiRzh1hEz3dYUkAMYrVPSLb0m9O40aOglqfY> Jimmy Levasseur Dessinateur / programmeur 819-475-3114 #327 Victoriaville, QC [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logocarteMetalusBleuWhiteSmall.png] [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logofacebooksmall.png]<https://www.facebook.com/MetalusInc/> [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logolinkedsmall.png] <https://ca.linkedin.com/company/m-talus> [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logoinstasmall.png] <https://www.instagram.com/metalusinc/>
                                                Attachments:
                                                • phish_alert_iocp_v1.10.14.eml
                                                Key Value
                                                Return-Path<jimmy.levasseur@metalus.qc.ca>
                                                Receivedfrom YT3PR01MB9802.CANPRD01.PROD.OUTLOOK.COM ([fe80::8570:c368:4d91:f620]) by YT3PR01MB9802.CANPRD01.PROD.OUTLOOK.COM ([fe80::8570:c368:4d91:f620%3]) with mapi id 15.20.8093.024; Mon, 28 Oct 2024 16:41:42 +0000
                                                Received-SPFpass (spfCheck: domain of metalus.qc.ca designates 52.101.191.86 as permitted sender) client-ip=52.101.191.86; envelope-from=jimmy.levasseur@metalus.qc.ca; helo=YQZPR01CU011.outbound.protection.outlook.com;
                                                Authentication-Resultsamazonses.com; spf=pass (spfCheck: domain of metalus.qc.ca designates 52.101.191.86 as permitted sender) client-ip=52.101.191.86; envelope-from=jimmy.levasseur@metalus.qc.ca; helo=YQZPR01CU011.outbound.protection.outlook.com; dkim=pass header.i=@metalusinc.onmicrosoft.com; dmarc=pass header.from=metalus.qc.ca;
                                                X-SES-RECEIPTAEFBQUFBQUFBQUFGQTFRK3c3a0RwV0hHb1IvRVRYKzRqckgzN2VxcGhwaWVBT09FenkxTXRiL05ZaW1NdHFsRnZSWGhXMFRMOTNNdVRZZjlERVVZTi9aRUEwcDVWWEhmcTZKRW1saExJR2pHWDQ1SG9ob0YrK1BpWkFRaGVNL3dWOUE3NC9ybUl0NEo4VVhnV2dMQW8rZFduQkJUR1lkREZBN0R5QXFtTGZUSlBVSVFCNzBtOHZnUml2Q3BpVEVBUDFTWGpPenZZZTVuMVFlRHJFWmQwUDgyUnlOVEhNOU9uN0xBdTlQWU5OS2l1Qk9BZGFQcHVmMEppRmtWU204VEJJT0FuZTF3NUp4WVpvNjc2enBCTkpTbGJNeWtoUjA1OUhubmNDcGp5S1QxRlBHWEtZcFE0SXdGcmhON05kL1lDYXEydFVyaDliWnM9
                                                X-SES-DKIM-SIGNATUREa=rsa-sha256; q=dns/txt; b=nqoNJd5ORJ69XQRI+7BizELr4FRZPJtpEMpfQfubToMx7E8kErh8oi4KJwL9DyAuiaXoSTiZfp9MAEoXByct4XIViHDm46SEuJsuiXxmyKdhTz7jjyMJkQkZDehBk99e1nyLtjR73295wUGFJ4y6es9PSeR/DGQFuL7ofAyOmgo=; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1730133706; v=1; bh=Rh4Uq0VdhEFSBRYosj9eS5I67tZi0MM+QVx/WRfHqKA=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT;
                                                ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qHcUefjizcidThhMTS4XTt8q4KMner24DQ5UpAqs1CYKnuSsDaG/e00P05SKUfedh3O3RiMLEUvAXeDcnkB7p9yLmoyegn72W8TC7ddw+UE4rtJgcYGAzFahio+S1VWrh7xgtDoS5bZ0zYov+P/5B/LlaPjzE9/oHjGg964ZcLjvKV9OUHSyZwVSs/DkQOSoeiHHDgb7ve5tIs0Z9+EouZj4CL6sqW92Q7m1XMWbocTOXz4EQD78AmTFqgCfMdTWW6qHBjO89mo3qwwGdVPgOEaq2MQerm3iw4paLzsX3MLQzXyMAHzyR9tQGhc+lSapDp5uDLcSaCugWUxISiOe3Q==
                                                ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WZ9FpLPrUGcjzR6Jtato8RMM+vs6NkutA4nXthAUNIM=; b=d8fUku5nn8RTvGnuV1H+oMeA9LEpy3iDTCT3pEnUByA4TpAbHKG3Mv5GPFTdCFz6z0h4aodCWkmvW+AIOCWHJTjy01D5i9yJf30VHhA/fDm5o90EWJ7BiGeI3l3PGNwu7HuvQxUCPZzltpwvdhHgx0qAXbUqBJOUv/3GGT/tdR12ErQ4GegIWMT9qPZrLlw7w0S3HsajoKR4otwstoC0VrVmCaex4o6To6w6n0lq83KZS0eOOsH4+gsnUipwNykRd9dXCDRzsIMeWNKvIQNT7iIdtRoWl0AEcdnisMRbY4G/tyo5X6yI7FjAipqHbO3qH39bwTHpve86n/4rHUyPZg==
                                                ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=metalus.qc.ca; dmarc=pass action=none header.from=metalus.qc.ca; dkim=pass header.d=metalus.qc.ca; arc=none
                                                DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=metalusinc.onmicrosoft.com; s=selector1-metalusinc-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WZ9FpLPrUGcjzR6Jtato8RMM+vs6NkutA4nXthAUNIM=; b=Y03eKSOwi8OvWmux28CJVj5vL318mXeI4Cf8fwYJAOW29U8SithaQ8RJIWikGTYEJOHyIY3EEp7tesNLAsbakRygHeOMychhq1dLw5JmuWVHXu9EXSQPHVAaL/rR48/8m+kxLyJKNRehLuAQJhrNrUr0Vptx56xqMsL2T3x9pWo=
                                                FromJimmy Levasseur <jimmy.levasseur@metalus.qc.ca>
                                                To"c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com" <c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com>
                                                Subject [Phish Alert] 7 Nouveaux Coupons Ajouts Votre Compte !
                                                Thread-Topic [Phish Alert] 7 Nouveaux Coupons Ajouts Votre Compte !
                                                Thread-IndexAQHbKVc1TGiy7AaAmUGQldureK2ZkbKcXdMw
                                                DateMon, 28 Oct 2024 16:41:42 +0000
                                                Message-ID <YT3PR01MB9802613EFF72970245A3CF33B54A2@YT3PR01MB9802.CANPRD01.PROD.OUTLOOK.COM>
                                                References<nTrkyDlxR8qVTFd0TuHo2w@geopod-ismtpd-13>
                                                In-Reply-To<nTrkyDlxR8qVTFd0TuHo2w@geopod-ismtpd-13>
                                                Accept-Languagefr-FR, en-US
                                                Content-Languagefr-FR
                                                X-MS-Has-Attachyes
                                                X-MS-TNEF-Correlator
                                                authentication-resultsdkim=none (message not signed) header.d=none;dmarc=none action=none header.from=metalus.qc.ca;
                                                x-ms-publictraffictypeEmail
                                                x-ms-traffictypediagnosticYT3PR01MB9802:EE_|YT3PR01MB8146:EE_
                                                x-ms-office365-filtering-correlation-id573ea235-00d0-4881-6cd8-08dcf76f66f6
                                                x-ms-exchange-atpmessagepropertiesSA
                                                x-ms-exchange-senderadcheck1
                                                x-ms-exchange-antispam-relay0
                                                x-microsoft-antispam BCL:0;ARA:13230040|1800799024|366016|376014|69100299015|38070700018|8096899003;
                                                x-microsoft-antispam-message-info gPR5ybw+RIAi2uWQmGF0rVhK6lqfHbz20p9JnH9VbCPCLJdBBH5nz4p+dT/6AN3Cn/lzSPuatg5FghZOdI2y5tsLzojav92B7vZL+RoxVTpAbx/ImVkC7tWXYbJQHnJhmK8dRL4d5CU/8Cqn4SxMxXTKX5U9/1MxaynLGteX99DSaqJSfLf9AO8gK0eGmjLhLZkHBGdo7qUuwZaoc4gxMAzQIpXY+X0lOY7C5BrJHZ1MuxjwqDY3ShI+6XbVGyrJ2KskBg4PPqSqhAPgocRl8xIuNOGMKBzJrCuGxusYl6M2XC4hDdLz2zmapkH/CAHA46t83hl0Cz/BRUN/1iZMhBNp/C1a17HyX/BaH/Gqpm47t5ikgBM1mPUZuZE9ObF/u9LaKhBdSTnL4/rlqCyBI0WTQRPv7q7V+B8iLiLY+2IolbX1HnnPGt3O7DfnznWt8f5ip9w0oWcpPTxjqr2JBM4zPq3kYqtDl0lcyI+i9JDeF/ZIemmCATBrqPzqFBMbwnxNocWl9BtnIb6ygHiYcxE1pq0IWXlAp4Uh/8YwoU3eUSjD4nlV+Fe078gncbO+2XHESAP+wjvmUjfEQWgonYrCCDQtMHGRZyDmDznab+25qVgQxzqxhGTrtyOWh8v4wBjOZ9D2+BTKr6LwByWvEumfjc96m6MZAN1yyZ9WKKI5jvAAVohXKOslrSnUomqX0xpWfmgpAm3j+c7PwT6NIf+yptdkL6ehCQvwsaxgNSxcR5DsaXdZgjq+0WrfSK1pBRH+mxOJH8+X826tuZbJOqgHwoHNY+a1rviHHkYzfzxzKt7iG2ngwUXo6RcwPBaXFFsQ7mXRgY8TXhFB5REeerOprAIgpIHJlGb541l823POotf+0BSiHy5bdM715fpzyi+VlPLcAXWN5bzLXp/UWfCBODfC+XgVH7yGCf58vREz6mKZeyV669jksEegNxs9lg9FROUQk97XapXEvQH0UlxZIZ/NpouvzGGZJfYibmcD614+ggct7YS8T7Gwoc4QXds6ONVwwWqRPuh+V4OHixxIFiwRM+tx9vfK2ntm90uAo6E2t20alEjIGI+7LSnmZzrsTbZ6mB5hA5fN9OR38SYxcZwhHAzd3Fkk/Xc2ceq3oI6sYHMWQ8aKFY8gTa9/aUA3xx59IfQv199HhftYMW5yUCHuIuotZtuONw42FqmfdLhCwd4Gn4prq4NnhXsX5g677bhctbwvan3s8/oRDPsjcsKlkieRqDTdgT0p57ffrrfhUJP27a5ZEwtZxuQON941qlxEbNJPvHoLwc+ruuOR2Y1AnDUgNQh62cE1OKIx/M6doNuBtbfNUpvA4WVUZFeQt8cz4eO2/P9AcRpejFv0W6ctZgIAv1pYPBfrb7RE7gJ7hOgd2JKoHEtZtP1PyLGSX0bHRxZR3lf08aMr8kvtZtK7b6+Nm/oXxEQ0Yh52mMkPhN1PM2LoSiPZhDF/CcMCFYhbk7SSiVWIJbx7PkNfseWUodvdKVSsNiDksc9JhKB5ViFwV7XGp5QlADfOIIuXlxp+3bgsbbxihEzOYXeaP8o6EXRqmsbX8Sa3Umb7pzkzYLvI8scjAvaFDAC5vRYacIYa46/annFszGOhBw==
                                                x-forefront-antispam-report CIP:255.255.255.255;CTRY:;LANG:fr;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:YT3PR01MB9802.CANPRD01.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(69100299015)(38070700018)(8096899003);DIR:OUT;SFP:1102;
                                                x-ms-exchange-antispam-messagedata-chunkcount1
                                                x-ms-exchange-antispam-messagedata-0 fzAZHJ/XoCJheokIA/QjbGB3H4oq/bIFDls+FK8jjxiHAn+sbIjaDopB/65Wtzdo0vWSf4YprpVsNDifHUgDxoGQmiW1leRDsMj97dRNaqeevu2iZzzUTuDXg59/iuqLjEIMBOIKKV1e/U0EdDYA/XI956bAcF/bJ7c+k0UHzR3rjGqAvtUq6yOKDWPXWd9u/+mh3RQ0L99zTE6ZXepxIotzjpwMx2+m6pxex1utRrqBpvwtQXwh2aLSMzEVi4bvoQnSP7v6U/F/U9836gjXzfCpOiyfRsGS3WbYa5hl1kLBn4iUojQw+yBdaO32mehuaKHLYZ1niOrIyb56vVPKSjp4611wUjDHUsTAPIguaIQ6EgWqXO3uSD2jbU4Nhr9qK8+QHLX0KfrGCXKugJtixq1KxJL8+Cp30acywexSatB7+ifEWNCVm1lZBN83OLLhvGVDajnD2D8RVqTnmSB/zBfyUQ5yZB5oQAVpBoWs4zqVZ/Bz33alJlFHg5Tozm2AVk5+/TNcf19hDTErIzP0w0dar9qyX7NbuF3166cWNZ3gy20aucXFwdpUoKac6kWt99NbeGM28f+Gj6mJVsFfWd2eArMgcdpn/r0mByrPNTEZyLD4NkUrqL8tyq1HcMTwHNj5zoLCJ5wJwjdLPLVw+WgEyhVPcyubnAZiAxb78XKjZoYOcTIfjxuQ3xjH2inQkVkLAT6OQc3VDY5gN/F2VlZoVtgl6rstHpAjqU+jCjZiRfWmDMIeFAxKaLJE94gD9J8CL1S54cvuN9yQtTcYCxXr7imOqMNE/8KXUB9TCYAqWLbh+M7yGJZafd4k4AM9GLwaHhHHRZVRqTYGBQdN4E5ZpNVMEza6hcZkWy5osOZD5ZETGE1Q5bLtMBkNpgxNPRmxMVWbDkgxcA7u0HAF3QtJmxwY0zr3Ucdt8VXCAaS1WQQ7qsRAo5SdStWaRUkDhwaxrX/pS5QGhRzGudOKCfZxR7dPBeZfVah5/vrDX5ptvv6yxNEYY6LhS8qYoQExMwKfKOGhCHF4yZM81hd90VXjg+JvA9mL/5SVtCazbw5JyPiCKeLVIUVLyxMxJc+WQByKjmIKX0sPsV3rR9vpdfxvJD8vEBfKxZH6gy3cKgrWv63H6TSoAj/v5Ty04gYcpIwL1Y3mZPhUPoDZNGXqc380ks+XIT7lbSJecrivp++JDtLSkgXnoHrFYF64v42CaZNmrR3g40DaYX/iNc2jsyvxMtEU1onY8ogfAv+rt9u5oo1JFEYltR0idJba3vASy0M4kQORSUDfBzQDM5J9uy4WGLgYGZ7HajsBXprRKRcoxiK/Rcm1IaZ6H1YT7nAu0uXcmEPiNTKozAK6bCuFYGWNmk5W4b8PgCHtXnxl7dNfdmOMNtD/tmMyAfsxzsKnucP0XZXrjjovezekaum8Vh34jZRItlGjR1ruEQZYunn/PczUUyvqdEzA/MvQNw4jwnIaJFQCWxh1/PCNRybfHGazYmltjFD+Um7fM5baq/KkAcbMlPnkra/jc8jj/UTNqJRHzk2FzDm94LRGPEmKm5J+7dSSjNue3ddglhk8K+V7N4IPVUI2Fvri+OzqHgxMfSwJr4VvwB68/YLLn/JJPw==
                                                Content-Typemultipart/mixed; boundary="_004_YT3PR01MB9802613EFF72970245A3CF33B54A2YT3PR01MB9802CANP_"
                                                MIME-Version1.0
                                                X-OriginatorOrgmetalus.qc.ca
                                                X-MS-Exchange-CrossTenant-AuthAsInternal
                                                X-MS-Exchange-CrossTenant-AuthSourceYT3PR01MB9802.CANPRD01.PROD.OUTLOOK.COM
                                                X-MS-Exchange-CrossTenant-Network-Message-Id573ea235-00d0-4881-6cd8-08dcf76f66f6
                                                X-MS-Exchange-CrossTenant-originalarrivaltime28 Oct 2024 16:41:42.0278 (UTC)
                                                X-MS-Exchange-CrossTenant-fromentityheaderHosted
                                                X-MS-Exchange-CrossTenant-id4f85cc14-eaa8-4e0b-8291-93aab6969f78
                                                X-MS-Exchange-CrossTenant-mailboxtypeHOSTED
                                                X-MS-Exchange-CrossTenant-userprincipalnameBAdSzCP1pH7RnNzeXG1b7EshJ1LvSwHqbELjO2wsosIm83HvSyA8FFCowimswMq+BD+0EaSIZ+wDs29cNlF2tgYJp5MBy6F2HgWDRF6AwTs=
                                                X-MS-Exchange-Transport-CrossTenantHeadersStampedYT3PR01MB8146

                                                Icon Hash:46070c0a8e0c67d6