Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
original.eml

Overview

General Information

Sample name:original.eml
Analysis ID:1676267
MD5:ceff9d37b4266bf49e42d01919751cec
SHA1:3a5ce9767fa6bd42699fd0215ebbaddd65cce37a
SHA256:19b93e1887fd6aa5853306637315f0b1a5bc35dd754e65ada003150e19c4d63d
Infos:

Detection

Score:21
Range:0 - 100
Confidence:80%

Signatures

AI detected suspicious elements in Email content
Queries the volume information (name, serial number etc) of a device
Sigma detected: Outlook Security Settings Updated - Registry
Stores large binary data to the registry

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 7088 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 3764 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8353F91-945E-4BC7-8A11-C6C182C71405" "822DD1ED-A3D8-4FBB-BDFC-7A023C835F07" "7088" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • OUTLOOK.EXE (PID: 3924 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\1HA9TWDC\phish_alert_sp2_2.0.0.0.eml" MD5: 91A5292942864110ED734005B7E005C0)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Source: Registry Key setAuthor: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\1HA9TWDC\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7088, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7088, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • Phishing
  • • System Summary
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion
  • • Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Phishing

barindex
Source: original.emlJoe Sandbox AI: Detected potential phishing email: The email claims to be from a Chinese steel company but is sent from a different domain (metalus.qc.ca). The sender's email domain (pipe.shinestar-steel.com) appears suspicious and doesn't match legitimate business patterns. The email combines unsolicited business offering with multiple contact channel options (Skype, WhatsApp), which is a common phishing tactic
Source: EmailClassification: Lure-Based Attack
Source: classification engineClassification label: sus21.winEML@5/4@0/61
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250428T0858400308-7088.etl
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8353F91-945E-4BC7-8A11-C6C182C71405" "822DD1ED-A3D8-4FBB-BDFC-7A023C835F07" "7088" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\1HA9TWDC\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "B8353F91-945E-4BC7-8A11-C6C182C71405" "822DD1ED-A3D8-4FBB-BDFC-7A023C835F07" "7088" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\1HA9TWDC\phish_alert_sp2_2.0.0.0.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935} DeviceTicket
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation11
Browser Extensions		1
Process Injection		1
Masquerading		OS Credential Dumping1
Process Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		1
DLL Side-Loading		1
Modify Registry		LSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Process Injection		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
s-0005.dual-s-msedge.net
52.123.129.14
truefalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    52.109.20.47
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    23.55.241.177
    		unknownUnited States
    		20940AKAMAI-ASN1EUfalse
    52.109.0.140
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    13.89.178.27
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    52.123.129.14
    		s-0005.dual-s-msedge.netUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    52.109.0.91
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

    General Information

    Joe Sandbox version:42.0.0 Malachite
    Analysis ID:1676267
    Start date and time:2025-04-28 14:57:02 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowsinteractivecookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:11
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    Analysis Mode:stream
    Analysis stop reason:Timeout
    Sample name:original.eml
    Detection:SUS
    Classification:sus21.winEML@5/4@0/61
    Cookbook Comments:
    • Found application associated with file extension: .eml
    • Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe
    • Excluded IPs from analysis (whitelisted): 20.109.210.53, 184.29.183.29
    • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
    • Not all processes where analyzed, report is missing behavior information
    • Report size getting too big, too many NtQueryValueKey calls found.
    • Report size getting too big, too many NtSetValueKey calls found.

    Created / dropped Files

    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250428T0858400308-7088.etl

    Download File
    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
    File Type:data
    Category:modified
    Size (bytes):118784
    Entropy (8bit):4.517016398562447
    Encrypted:false
    SSDEEP:
    MD5:A4A9BB5A0CE0087C54F7EDF609F2B5FF
    SHA1:ECBFA486353276764DED13F924BBEA8D8AE91710
    SHA-256:CB4BE3B854E97E46B98AFF44B0EE37B07385DC8D7D30E0DF428F01A7969BE72A
    SHA-512:5C73C42632DFD38B2271AA05983AF0E7420DD850B5E4F295E2BC6D81F47590933ACD85C33D8C0225B60A9B6FA2ED1183B9365BD6B5D5C53E8EA96860BF1D92E6
    Malicious:false
    Reputation:unknown
    Preview:............................................................................`............U.C=...................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1........................................................... ..^5............U.C=...........v.2._.O.U.T.L.O.O.K.:.1.b.b.0.:.2.7.b.3.b.7.3.4.4.5.b.e.4.e.6.1.a.4.b.c.7.0.8.e.3.f.1.e.d.7.c.1...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.4.2.8.T.0.8.5.8.4.0.0.3.0.8.-.7.0.8.8...e.t.l.......P.P..........U.C=...........................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250428T0858480954-3924.etl

    Download File
    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
    File Type:data
    Category:dropped
    Size (bytes):16384
    Entropy (8bit):3.5875511078404165
    Encrypted:false
    SSDEEP:
    MD5:F8F05A2B77194CE09DF570A98B9A0C74
    SHA1:F7D8647F76B20B495B184B8E8771638F50907471
    SHA-256:A654B90C5236CD0F34595085A001FE576BEED2CA843112D47953DF745EF76FA6
    SHA-512:026CF8BE7E22B60DB2A4E394055427DEE2A64F9915435F7CE3A052AB7FD28A57291C021782584192A55ECF45BD21C303AF2A64BE09897E399EB856F4B9BBCE92
    Malicious:false
    Reputation:unknown
    Preview:............................................................................^.......T.../..H=...................eJ........H=...Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1........................................................... ..^5.........../..H=...........v.2._.O.U.T.L.O.O.K.:.f.5.4.:.5.d.b.5.8.5.6.6.6.d.d.6.4.3.e.7.9.9.7.3.e.c.1.b.9.0.f.6.1.2.6.a...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.4.2.8.T.0.8.5.8.4.8.0.9.5.4.-.3.9.2.4...e.t.l.........P.P.....T.../..H=...........................................................................................................................................................................................................................................................................................................

    C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

    Download File
    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
    File Type:Microsoft Outlook email folder (>=2003)
    Category:dropped
    Size (bytes):271360
    Entropy (8bit):4.8378375385831225
    Encrypted:false
    SSDEEP:
    MD5:F94855D1E399A077B370A13596E11C52
    SHA1:79D6179C0393ECBE28A62080FD967C3C64A9861E
    SHA-256:F9AC46D5E166B891B56FCF1C7E8E2B99E9F67996CCEEC55CA678D0E88502CE6F
    SHA-512:4D0571A28CC44EAC1680991147F3370085BC3F88FEA972C94280E28A75328AAD949E883AF9B41111931588CD66D68904852701385756C5EA7B4ABCA833D13D28
    Malicious:false
    Reputation:unknown
    Preview:!BDN+...SM......\........Q......z.......f................@...........@...@...................................@...........................................................................$.......D......................u...............y......................................................................................................................................................................................................................................................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

    Download File
    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
    File Type:data
    Category:dropped
    Size (bytes):262144
    Entropy (8bit):4.3206657968300695
    Encrypted:false
    SSDEEP:
    MD5:BC4171858C7E1ED56CC343F983CAE675
    SHA1:6E0AF3550C0D61D5279D5AE91C7E2760F7293861
    SHA-256:B4225B00A92511F4F784F1C3BB9DF585A2304ADFD0199D690344A8CEA79872A6
    SHA-512:F95950FFF16A880E11DE5ECE4FC2C45957E171B1C0C3998A4B8415B1D87D2EFF0925732366AB6BADDBC7B468B5C51366607BB8625511B168E272E86C0C91C8D7
    Malicious:false
    Reputation:unknown
    Preview:5..#0.................aC=........D............#.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................;_.D......w..N0.................aC=........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

    Static File Info

    General

    File type:SMTP mail, ASCII text, with very long lines (459), with CRLF line terminators
    Entropy (8bit):6.064535829602424
    TrID:
    • E-Mail message (Var. 1) (20512/2) 100.00%
    File name:original.eml
    File size:85'557 bytes
    MD5:ceff9d37b4266bf49e42d01919751cec
    SHA1:3a5ce9767fa6bd42699fd0215ebbaddd65cce37a
    SHA256:19b93e1887fd6aa5853306637315f0b1a5bc35dd754e65ada003150e19c4d63d
    SHA512:fbfd5c97fb5de354daaa7783fb7e49457faabf61d374792baef3d078ac961e0b95f0e771f99406346a57261ca0c84cdccb1fa32d457a3a54a881a81d2ae21cd4
    SSDEEP:1536:peKn+Bhtu+E1SteQH1ee2l9eeTXPeeH5eeeeT+PeeHQeeeeTFPeeHceeeT1PeeHf:peK+BhZE1SP2B1RCiPh/KpAhkSuG6zVG
    TLSH:9B83FA5B929514A080FD99D8A01737793BB43ACE96F11935AB3CBF7DAE5CCE23181348
    File Content Preview:Return-Path: <stephan.lemire@metalus.qc.ca>..Received: from YT3PR01CU008.outbound.protection.outlook.com (mail-canadacentralazon11020094.outbound.protection.outlook.com [52.101.189.94]).. by inbound-smtp.us-east-1.amazonaws.com with SMTP id 07l3on66tis6k1

    Static Mail

    General

    Subject:[Phish Alert] RFQ Titanium
    From:Stphan Lemire <stephan.lemire@metalus.qc.ca>
    To:"c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com" <c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com>
    Cc:
    BCC:
    Date:Mon, 28 Apr 2025 11:08:10 +0000
    Communications:
    • Vous nobtenez pas souvent de-mail partir de amyai@pipe.shinestar-steel.com. Pourquoi cest important<https://aka.ms/LearnAboutSenderIdentification> Avertissement: Ce courriel provient d'un expditeur externe. Ne cliquez sur aucun lien et n'ouvrez pas de pice jointe, sauf si vous connaissez l'expditeur et si le contenu est fiable Hi, I am Amy Ai from Hunan Great Steel Pipe in China, here share our Titanium products: Standard Product Form ASTM B265 Sheet, Strip and Plate ASTM B338 Tube, Seamless and Welded ASTM B348 Bars and Billets ASTM B861 Seamless Pipe ASTM B863 Wire ASTM F67 Unalloyed Titanium for Surgical Implants ASTM B363 Fittings SGS report and BL copy can be refered if you are interested in. If there is any RFQ or enquiries, send me by email or by Skype or Whatsapp, all are okay. Best Regards, ________________________________ Amy Ai(Ms) Sales Manager Hunan Great Steel Pipe Co., Ltd Tel/Wechat/Whatsapp: 0086 157 1711 6648 Skype: amyxiaotu 22nd Floor,Longchamp International,No.09, Xiangfu Road, Changsha,China Stphan Lemire Planificateur de production 819-475-3114 #232 Drummondville, QC [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logocarteMetalusBleuWhiteSmall.png] [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logofacebooksmall.png]<https://www.facebook.com/MetalusInc/> [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logolinkedsmall.png] <https://ca.linkedin.com/company/m-talus> [https://raw.githubusercontent.com/Metalus-Inc/signature/main/logoinstasmall.png] <https://www.instagram.com/metalusinc/> [https://raw.githubusercontent.com/Metalus-Inc/signature/main/FR-SCEAU%20300%20PME%20-%202024.png]
    Attachments:
    • phish_alert_sp2_2.0.0.0.eml
    Key Value
    Return-Path<stephan.lemire@metalus.qc.ca>
    Receivedfrom YT2PR01MB9796.CANPRD01.PROD.OUTLOOK.COM ([fe80::a7a4:b7a9:5e7c:6eb9]) by YT2PR01MB9796.CANPRD01.PROD.OUTLOOK.COM ([fe80::a7a4:b7a9:5e7c:6eb9%7]) with mapi id 15.20.8678.028; Mon, 28 Apr 2025 11:08:11 +0000
    Received-SPFpass (spfCheck: domain of metalus.qc.ca designates 52.101.189.94 as permitted sender) client-ip=52.101.189.94; envelope-from=stephan.lemire@metalus.qc.ca; helo=YT3PR01CU008.outbound.protection.outlook.com;
    Authentication-Resultsamazonses.com; spf=pass (spfCheck: domain of metalus.qc.ca designates 52.101.189.94 as permitted sender) client-ip=52.101.189.94; envelope-from=stephan.lemire@metalus.qc.ca; helo=YT3PR01CU008.outbound.protection.outlook.com; dkim=pass header.i=@metalusinc.onmicrosoft.com; dmarc=pass header.from=metalus.qc.ca;
    X-SES-RECEIPTAEFBQUFBQUFBQUFFOEVhL0dzRXdKSEtiN0F0bUd5YWZucmJVRGZRY3ZJdldPcUJmUnQrT28wUjE5MmtkdC9ERSsxQytxZUVTcFB4ZGhObW1XbXVZTGlmcVAxSXNiRVRFYzkvVXR4ZHlpZy9MdkhFQlVrWkZRK283Y0M2aHFGZkc2aXgzOFl4R2NuQTU2OFpCUnh1WHQxb1kvMXEwdlN2Rlo4MTM4RW8wSnJkcUZycDc2U2RwYjJXNlFqdTNNdWZFRmlSY1V0bThpNkJTNzUvS3dVbitscSt0eEdxSHFlYTQvSEZtQTRBcVBCWDdVWVZkTnh1ekUva2ZMbkFrVFFiVENCM1lYelR4TkpNMWpjV2djNmVMV0FKS01DSm12ckV6RzdtZEo3Ymc3TmFKcVpaQXhSUERzaDFXZ01oTlVuc0V6UDN3aHNJcGViWVk9
    X-SES-DKIM-SIGNATUREa=rsa-sha256; q=dns/txt; b=UCZXPa7DWwYiqv49ht06fUxd6CLf8KpKNeMay6IQ0MdaOBMqBhXimIvGmCITL1r/x2OhhbN5OWkffzViuEZavlJyYmx8SSSTTb2z5QEXrPr78YIwayXaIHqD1DdA01ZtiFvJ77z+T5Burg6X70ZzFQVkkVec836KE/kdeePnx0c=; c=relaxed/simple; s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; d=amazonses.com; t=1745838498; v=1; bh=KcGkEzSqmoNrxgaXIDCarKLGw5TcDUHCBTWREsKC6X8=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT;
    ARC-Seali=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=oHfyQT9GQuKsfOHOlnmqhFsmDPzEVzlgrQp+yhMEmuwk6/O6OMiHlOw4n6I2z4rPSE8NUtbafN8OEOBG52tS4PoUH/3yOX/uRcZPTcSinjPThto+mdjYyvFMUOI6T85eV5xVCEj8spW8qLAhpGJGei402EOeqVmV7U2tBH9BjlvOwFIJ0g9Huf5jaFAZF1JgwjxSsp7CktZtUPIZsZiY93Qhl7Ah5Q/NDDW+yQg9zmyNCXL3ltTU67P6RGDvgDAY1lWkAGn2INLNEvhsnAwRu6RpOzx29fwM8uyt04cQKnst8fIvYzBq3wyj5V/TYJbbudF2lkRSOSgV4PVGSnqwWA==
    ARC-Message-Signaturei=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/wsgLR77McDLUBFAggWgmRI/yoQU/buixpib/tcqZ14=; b=qOPkIQRvigzBANcC99HiKGRkboQ2Tlh5c+aHn1r2NFxx9idkDIgNHZRFIo5rfTUD+440IRQHGGTqvt6ZW21G8y5XNdWn3iC1JwKMoWT6KgAXTYwlxKvMh7Y3pSrFhXDZj4eEsxduV7qtgHIi2ah1kTKxMZsjBtJtdKgxq1FXiD94KpaLGTW9AX8R/+8Aeb2DMtCxxB0a3QdqnXbEJVezbF1MlPCUFPqPwPqj497Oa0bczhIs8FKvmdGNqsqptvrmkl6T4bxqcD6V6tvpfVvf+3/LKcwG2r8Hoa6E6euRrAoGSV7YlI1A8yBgIpG7ITkCwV2r8Y6VLuBabt2JuYLZOw==
    ARC-Authentication-Resultsi=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=metalus.qc.ca; dmarc=pass action=none header.from=metalus.qc.ca; dkim=pass header.d=metalus.qc.ca; arc=none
    DKIM-Signaturev=1; a=rsa-sha256; c=relaxed/relaxed; d=metalusinc.onmicrosoft.com; s=selector1-metalusinc-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/wsgLR77McDLUBFAggWgmRI/yoQU/buixpib/tcqZ14=; b=qicx4VcAODZRvTvvspwIpkaVyrtve974io6pi3VynMmLfWNZCzY3lajnx6sU1PeDMelN9BFpihL3x+Fx96XvN5xHJXV03dBo0Ulywo5TkdmqTEP362VwxfSAZ3IqQhGmXyAim9JaL59XlZbo9vfduZnwY5FxNQLF3Ll0Z8V2z8A=
    FromStphan Lemire <stephan.lemire@metalus.qc.ca>
    To"c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com" <c9025caf-ebfb-4a55-8a88-3cf1915dac7c@ca.phisher.knowbe4.com>
    Subject[Phish Alert] RFQ Titanium
    Thread-Topic[Phish Alert] RFQ Titanium
    Thread-IndexAQHbt9yRCo5e7Y3DNUacPJ+J8zfrgrO46+/R
    DateMon, 28 Apr 2025 11:08:10 +0000
    Message-ID <YT2PR01MB9796B05557D0050A89B941A3DC812@YT2PR01MB9796.CANPRD01.PROD.OUTLOOK.COM>
    References <20250427173144.71634-{12874:20250427142033-12874-97}-0018821@pipe.shinestar-steel.com>
    In-Reply-To <20250427173144.71634-{12874:20250427142033-12874-97}-0018821@pipe.shinestar-steel.com>
    Accept-Languagefr-FR, en-US
    Content-Languageen-US
    X-MS-Has-Attachyes
    X-MS-TNEF-Correlator
    authentication-resultsdkim=none (message not signed) header.d=none;dmarc=none action=none header.from=metalus.qc.ca;
    x-ms-publictraffictypeEmail
    x-ms-traffictypediagnosticYT2PR01MB9796:EE_|YT2PR01MB8247:EE_
    x-ms-office365-filtering-correlation-id39435311-32ec-4324-1d55-08dd8644f69f
    x-ms-exchange-atpmessagepropertiesSA
    x-ms-exchange-senderadcheck1
    x-ms-exchange-antispam-relay0
    x-microsoft-antispam BCL:0;ARA:13230040|366016|69100299015|376014|39142699007|31052699007|1800799024|4053099003|8096899003|38070700018;
    x-microsoft-antispam-message-info pUop6Buf5K6ClRr6vglIwSrLrrLEGl32CdGr/kDFENLYqvuD3Ty12UCACrhZYbMeXGNn6/zGHXSsBa/giwFax4Xq7cmLNTjNFJ/UoT/8qptA+8ld5D7mK4IH3e1Ka0Z5jIWrHdwwmEiSCl/PJnWHsVIEIOKSGgEZyoxnU/Ttd4YhRIKNg33quTSu8iUSxTR0fxpaAf9pO9FzqnZg+LYmh/5msT+1NDR9+FZXCl2Q2qBVJI3HsJGOIk5s7Ada/51QIGVMqSpvCu0izZcKKK+GhodwybMvUTB9i0WJIbaI2xKNiH6A7UkZEht84kzb9eBsm/bgqMG+9zZ3u9sd+zUubxcdyIgLmEndYvwrUBZOFGT4IqVhBvix7fWmZZ8M7EWg54lRilmcmMZ4ZXeaoYhuCnAHQMnOKTN/XrZIXtwdBX17K7b0BkTzD+ocMS7tvm3wo12OMyxr0cd+qKcq/uCpH3J91p/Pv3Jparhrme77pNNiGAqnXxxtUUkF1Nav5cV4RklqCt9mZ+J1TSGSxhPPryrci/uvbUKUzSm4/3igLuV9HRy8lmsp0cUTD02gRYGbc0i2OoATKYuuUiHI7qYwNvNbj6aRc7PC8eH5EwuCmm554u2e5KA8YwCOBUszxkEhxXKbTG9MiPMHtV9nLLmd/pUoldBLD2jVJxGMrNGBr7DArz+Hq00zCt9sctx9vCYJNJsjISATrndRRjG6tsphxAisCyTnEdlBYetLx3QkFQd+EUo1v33OfI6JxtBlLQWVUDlUwlgtXxgrutx0pfyHMGcM2jt/riomRSZ4Jvlo52JEaGp/j7/cUieTLin7a4nrRObFgzcv/TFcKXn1ECuAhSM/GqCz2vgjz8djGD/etPKVOtnFDuzZ1rHl33uKPfiCKoB7xvkPXoyzAZ6fheWdTSvRiAMsSuqJTVqZc/9N2E8hNeX0YrCbK7aSRr7VPL8aMUoov3RWiuxSzSfhbSEMU9YqIQ74xCk91NrpW7XHb8JCs+m2upYxEXPA/PfapMkMwBYVBUp2xigOrIK4DADjBfg+l8A79UASx6+BVV5zCDxUvlzG1BNPunuDCP5L5cBfXWI5VghyjZY4olNRG1uZqwB531hPIJ1+yt1rslliMJ5eFS0k7DHwkSw5xpSSAUTVAdIfU5OYj+7ksvjtrNQOaKmTqa81XDttvRHuAbDWHLkF5Y2Re9QvVkaVokfKC/bEWf2FTidLji9ZnOBTR7lsHiJTeH9fJSawnrTZMAzO23mQjei0AFAfsJX+/UqMh/zrp45cCk1ONtBgbC/94P3izNY6i2Z9ia9IdjlPwnFReOgDWvzZ4viUBacc8HGuKzq7Uke0MfMlXfNiF0587Di04d68BdwXrmpgTA/aIkqpre9TpuXU/7FwAARzluHsfbTaVC/EkA7A8rQsenvS4Q1WGdOiOnh4u5KIIV5B1FK6hyWxcLyhywVSJ8WqSfFq0rvoO1gDq9iHkXU2OSeQ/+hP49KTWM+zqf7hDm+W1FDgVKnCWKVyJC1aHzohdHQYx/mEoA6XSr5HIocxJ9TCKPTqMrOAnMmdwm4ktZ6uMSqd5s2diqKkRlvhQdJ5x27bQY3813n0RnCLXZOOppxWBfhekHHCY5/fpXvtrboh26KII9MpOTgG0xwhhchEfdKyywhJE7i4xrKRKeVsMTt1v/453Fmaez/+IIS8GAi0vpVzYSO+CaUPdPbDGFra1vu1uWGVklgQpJGp0BF+502Uo4B3WQ==
    x-forefront-antispam-report CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:YT2PR01MB9796.CANPRD01.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(69100299015)(376014)(39142699007)(31052699007)(1800799024)(4053099003)(8096899003)(38070700018);DIR:OUT;SFP:1102;
    x-ms-exchange-antispam-messagedata-chunkcount1
    x-ms-exchange-antispam-messagedata-0 fbcMj3S3vCb79Ych3ezOoIjReIDFfySgEF4VztNv2ZaJ4dy/NNFBUUVFa9bAS+gdR78ESeARJxhiQyPfBql7at7duH8AvGeZqrrX4arayQuNWDkYHrQaVYLPAKdHk5lXgySmyDV9jgNQrCNTw4QkzReueVS53yQNVPuQUIztkxv1+oo7/zr2Q3juEO17SYCmOOHuztOgdFMyCfWsfWeDAFBVoNzAPGHxqr9KglJyVbCO+qGS81e7jh+PFgaH8r0BqDOeXX/iB1ekqM2oJWYoSP3kA2NLCUZUBQS8WhwoZlnvTnBPsexIcHxGlI85aYNU+sQFWYQC5nKYKdsEHc3D9utn4hw4x8cjHSVM1W/M677VePjeTfGBTkoUYRGrCTADV2IxLlrUO4Cu52lRQ7tQdQK6oDxbOtZxLy+w4k76cplRbgXYHe03vGUs/FEZ8ruw1cDTtpUED99nOuZZXaYtxC7friB94rlGOxLoPTZ8giLbRPCbJUC16pWCvDjmZH/27hucbmqGZtnyYl3X2bl4Q6Xl03tBHOqzVSJ7MMX3VfaQzGv4aJJnlBfg1qov8N4/kx7IMmmJ9fC2NnqGX1d5kmse35xXlR1NeoTOFK2v0IDkadhSbskGwRpX9RXpqHlsdZxrtCsv/X1NvL7L0pt+utBSVPARbettMpwX+cux1oRZQa7fVCAc3IjMhGN7upQSJvqPQ/LX06Xi2QG9FJiRQKhmivaqKpfIgid3rLbO6kYGX9vzS+mdn0jq05060yQxpnIwPRc00OnXWGCL3hcICvPdKfBOdwvwV0s3YyxTTBAGlJh3c1AlU1qASsC/iPGQSnlenD8B4OaqYDmO5tfveRJBK8s/hJKY6VWpKYYcv0Pbn0OzHMMb/D38wWvoFqWrxukU/C7n4nlIRXthL058Hc/Y+mWnpFDJRb5RLigd2zvNLUEUN5DHG+oxwhmVrgBfZfbpEW9NzdVhXfW85PptRuAepse+8xstGArf9b8WRwtObOpe299T8V9QVJUCRldjCbLyTWUB2isHeySYOajEMeWG+MvjinA40lfklupkyuxB7UeSEKECHXvFRQ3C4Lvg0SVUTcrwp7sGtqmOAVo/ya9z+YbhdOWT8I1NpJeV+pACxgbSIFXNA7vYv9csMDBF85rXf21Fo93qjoXvpKkN84vy/NreFHXCrCpG0iNatGUPHO27qXjtQchL6yE5q6sK7eylfNuipQ7Sb4NvEs4jexgW2Cc01T5nFk29yPDRrmjqgeK3bVjVF30uzJU0i+R3B1FpB4IsDyiRC1ukKlKyPrkjziiWLI/bD9kpbdFPA5ajQDTBJdHbWJSTGbuFNOC1tAkShxTg2Vop3psYqhSqQIdQj9HtbfSin0F83S1bpAKjhmoC4iX/AVIxzmmupywQDOGRHKKYZG9hV51NDBBGwLRm9Ylb2w3ZExaKc7pOr+vcDMFlc7TGCZmM5CoKQIDZm5I8laAS3Qx2B+vwnOu/2vfCw+F7PsLOsymvaiCug6t3oYCKpAoS1MiGlHID8xAPuppWMV1t6D2OIhUiU/3iE4OP/QJ4XWhZ/r7oyCQWKkg0ONSj+rjKCcfL9Ap1TXAx9IFa7X8+Mw7WLg5ZIyaPpw==
    Content-Typemultipart/mixed; boundary="_004_YT2PR01MB9796B05557D0050A89B941A3DC812YT2PR01MB9796CANP_"
    MIME-Version1.0
    X-OriginatorOrgmetalus.qc.ca
    X-MS-Exchange-CrossTenant-AuthAsInternal
    X-MS-Exchange-CrossTenant-AuthSourceYT2PR01MB9796.CANPRD01.PROD.OUTLOOK.COM
    X-MS-Exchange-CrossTenant-Network-Message-Id39435311-32ec-4324-1d55-08dd8644f69f
    X-MS-Exchange-CrossTenant-originalarrivaltime28 Apr 2025 11:08:10.9434 (UTC)
    X-MS-Exchange-CrossTenant-fromentityheaderHosted
    X-MS-Exchange-CrossTenant-id4f85cc14-eaa8-4e0b-8291-93aab6969f78
    X-MS-Exchange-CrossTenant-mailboxtypeHOSTED
    X-MS-Exchange-CrossTenant-userprincipalnameR+rGP3notFiYnG3M0IaRQQ4cZ3qVSGzh8Txo1Z1648JGYlXXtphV/NSuRmXFEjqj4PgsewmIXti8hqfEhGrVYW/RtgAQBQfzbNsbdeFwEZw=
    X-MS-Exchange-Transport-CrossTenantHeadersStampedYT2PR01MB8247

    File Icon

    Icon Hash:46070c0a8e0c67d6